This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new e29db6724c2 sched,fs,docs: support setuid sudo helper
e29db6724c2 is described below
commit e29db6724c2e6d2f7ac835838891c4c3943dbd5d
Author: Abhishek Mishra <[email protected]>
AuthorDate: Sat Aug 15 16:34:36 2026 +0000
sched,fs,docs: support setuid sudo helper
Supports the UNIX setuid-on-exec sudo helper. Documents the model,
generates an extra ROMFS user and /etc/sudoers for a non-root test,
reports BINFS modes from the builtin table so ls -l matches execute
bits, and skips NULL environment entries when sanitizing a setuid exec.
Signed-off-by: Abhishek Mishra <[email protected]>
---
Documentation/applications/nsh/commands.rst | 65 ++++++++++++++++++++++++
Documentation/components/tools/index.rst | 9 +++-
Documentation/implementation/user_identity.rst | 12 +++++
boards/Kconfig | 51 +++++++++++++++++++
cmake/nuttx_add_application.cmake | 3 ++
cmake/nuttx_add_romfs.cmake | 23 ++++++---
cmake/savedefconfig.cmake | 3 +-
fs/binfs/fs_binfs.c | 21 +++++---
sched/environ/env_secureexec.c | 11 +++-
tools/Unix.mk | 1 +
tools/board_romfs_mkpasswd.sh | 45 +++++++++++++++++
tools/update_romfs_password.sh | 69 ++++++++++++++++----------
12 files changed, 268 insertions(+), 45 deletions(-)
diff --git a/Documentation/applications/nsh/commands.rst
b/Documentation/applications/nsh/commands.rst
index f1d80040457..d1477e958df 100644
--- a/Documentation/applications/nsh/commands.rst
+++ b/Documentation/applications/nsh/commands.rst
@@ -1833,6 +1833,71 @@ Option Purpose
nsh$ whoami
testuser
+.. _cmdsudo:
+
+``sudo`` Run a Command as Root (setuid helper)
+==============================================
+
+**Command Syntax**::
+
+ sudo <command> [args...]
+
+**Synopsis**. Run a single command with root privileges using a
+Linux-style setuid-root helper program (``CONFIG_SYSTEM_SUDO``). The
+kernel raises the effective UID to the file owner when the ``sudo`` ELF
+is loaded (``S_ISUID`` via ``nx_mode`` in the application build).
+``sudo`` then:
+
+1. Identifies the invoking user from the real UID (``getuid()``).
+2. Checks that user against the sudoers allowlist (``/etc/sudoers`` and/or
+ ``CONFIG_SYSTEM_SUDO_ALLOWED_USERS``). Real UID 0 is always allowed.
+3. Verifies that user's password with ``passwd_verify()`` in userspace.
+4. Calls ``setresuid()`` / ``setresgid()`` / ``initgroups()`` to become
+ fully root.
+5. ``execvp()``s the requested command, replacing the ``sudo`` process.
+
+Unlike the NSH ``su`` builtin (which changes the shell session),
+``sudo`` runs one command and exits. After a hard credential drop
+(``setuid()`` to a non-zero user), unprivileged code cannot call
+``seteuid(0)``; executing the setuid ``sudo`` binary is the supported
+way to regain root for a single command.
+
+**Requirements**
+
+.. list-table::
+ :header-rows: 1
+ :widths: 60 40
+
+ * - Option
+ - Purpose
+ * - ``CONFIG_SCHED_USER_IDENTITY``
+ - UID/GID tracking and setuid-on-exec
+ * - ``CONFIG_FSUTILS_PASSWD``
+ - ``passwd_verify()`` password check
+ * - ``CONFIG_LIBC_EXECFUNCS``
+ - Load the ``sudo`` ELF (not builtin main)
+ * - ``CONFIG_SYSTEM_SUDO``
+ - Build and install the setuid helper
+ * - ``CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE``
+ - Unprivileged ``user`` plus ``/etc/sudoers``
+ * - ``CONFIG_EXAMPLES_HELLO_RESTRICTED``
+ - ``/bin/hello`` as ``-rwxr--r--`` root
+
+**Example** (login as root, then drop to a sudoers user)::
+
+ nsh# id
+ uid=0(root) gid=0(root)
+ nsh# ls -l /bin/sudo
+ -rwsr-xr-x root root 0 /bin/sudo
+ nsh# ls -l /bin/hello
+ -rwxr--r-- root root 0 /bin/hello
+ nsh# su user
+ nsh$ /bin/hello
+ nsh: /bin/hello: Permission denied
+ nsh$ sudo /bin/hello
+ [sudo] password for user:
+ Hello, World!!
+
.. _cmdtelnetd:
``telnetd`` Time Start the Telnet Daemon
diff --git a/Documentation/components/tools/index.rst
b/Documentation/components/tools/index.rst
index a3c5a446eb1..294e4b0a6dc 100644
--- a/Documentation/components/tools/index.rst
+++ b/Documentation/components/tools/index.rst
@@ -103,11 +103,18 @@ Kconfig
CONFIG_CRYPTO_CRYPTODEV=y
CONFIG_BOARD_ETC_ROMFS_PASSWD_USER="root"
CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD="<secret>"
+ CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE=y
CONFIG_FSUTILS_PASSWD_PBKDF2_ITERATIONS=10000
-``make savedefconfig`` omits ``CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD`` and
+``make savedefconfig`` omits ``CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD``,
+``CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD``, and
``CONFIG_FSUTILS_PASSWD_PBKDF2_ITERATIONS`` to avoid leaking credentials.
+With ``CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE``, ``mkpasswd`` appends a
+second account (default ``user``, UID 1000). By default that account
+reuses the root password. ``CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_SUDOERS``
+also writes ``/etc/sudoers`` listing ``root`` and the extra user.
+
Host files
~~~~~~~~~~
diff --git a/Documentation/implementation/user_identity.rst
b/Documentation/implementation/user_identity.rst
index e7fe651069a..ffb08aee3b5 100644
--- a/Documentation/implementation/user_identity.rst
+++ b/Documentation/implementation/user_identity.rst
@@ -120,6 +120,18 @@ Hard drop (clear saved-root)::
``setresgid()`` requires effective UID zero to assign arbitrary GIDs.
Change group IDs before dropping the effective UID.
+Setuid-on-exec
+================
+
+When ``binfmt`` loads an executable with the set-user-ID bit set
+(``S_ISUID`` in ``nx_mode``), the new task group's effective and saved
+UIDs become the file owner's UID while the real UID remains the caller's.
+This is the mechanism used by the setuid-root ``sudo`` helper
+(``CONFIG_SYSTEM_SUDO``); see :ref:`cmdsudo`. A valid test logs in as
+root, drops to an unprivileged sudoers account (``su user``), confirms
+that account cannot exec a root-only binary, then runs that binary
+through ``sudo``.
+
Configuration
=============
diff --git a/boards/Kconfig b/boards/Kconfig
index 0eca78c8a96..784b2c06286 100644
--- a/boards/Kconfig
+++ b/boards/Kconfig
@@ -5741,4 +5741,55 @@ config BOARD_ETC_ROMFS_PASSWD_HOME
string "Root home directory"
default "/"
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE
+ bool "Add an unprivileged user to /etc/passwd"
+ default n
+ ---help---
+ Append a second passwd entry (default name ``user``, UID/GID
+ 1000) so ``su user`` works on ROMFS-backed /etc/passwd.
+ Needed for a valid setuid sudo test: drop to this user, then
+ run ``sudo``.
+
+if BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_USER
+ string "Extra username"
+ default "user"
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_UID
+ int "Extra user ID"
+ default 1000
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_GID
+ int "Extra group ID"
+ default 1000
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_HOME
+ string "Extra user home directory"
+ default "/"
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_USE_ROOT_PASSWORD
+ bool "Use the root password for the extra user"
+ default y
+ ---help---
+ If enabled, the extra user gets the same password as root.
+ Disable to set CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD
+ or NUTTX_ROMFS_PASSWD_EXTRA_PASSWORD separately.
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD
+ string "Extra user password (required if not using the root password)"
+ depends on !BOARD_ETC_ROMFS_PASSWD_EXTRA_USE_ROOT_PASSWORD
+ ---help---
+ Hashed at build time; not stored in firmware and not saved in
+ defconfig. Same complexity rules as the root password.
+
+config BOARD_ETC_ROMFS_PASSWD_EXTRA_SUDOERS
+ bool "Install /etc/sudoers allowing the extra user"
+ default y
+ ---help---
+ Write /etc/sudoers with ``root`` and the extra username so
+ ``CONFIG_SYSTEM_SUDO`` can authorize that account.
+
+endif # BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE
+
endif # BOARD_ETC_ROMFS_PASSWD_ENABLE
diff --git a/cmake/nuttx_add_application.cmake
b/cmake/nuttx_add_application.cmake
index 131808739b5..4864eaedbd6 100644
--- a/cmake/nuttx_add_application.cmake
+++ b/cmake/nuttx_add_application.cmake
@@ -95,6 +95,9 @@ function(nuttx_add_application)
STACKSIZE
MODULE
DYNLIB
+ UID
+ GID
+ MODE
MULTI_VALUE
COMPILE_FLAGS
LINK_FLAGS
diff --git a/cmake/nuttx_add_romfs.cmake b/cmake/nuttx_add_romfs.cmake
index 7633872d037..d26bdfbfd02 100644
--- a/cmake/nuttx_add_romfs.cmake
+++ b/cmake/nuttx_add_romfs.cmake
@@ -366,22 +366,31 @@ function(process_all_directory_romfs)
endif()
set(GENPASSWD_OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/etc/passwd)
+ set(GENPASSWD_OUTPUTS ${GENPASSWD_OUTPUT})
+ if(CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE
+ AND CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_SUDOERS)
+ set(GENSUDOERS_OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/etc/sudoers)
+ list(APPEND GENPASSWD_OUTPUTS ${GENSUDOERS_OUTPUT})
+ endif()
+
add_custom_command(
- OUTPUT ${GENPASSWD_OUTPUT}
+ OUTPUT ${GENPASSWD_OUTPUTS}
COMMAND ${CMAKE_COMMAND} -E make_directory
${CMAKE_CURRENT_BINARY_DIR}/etc
COMMAND
- ${MKPASSWD_BIN} --user "${CONFIG_BOARD_ETC_ROMFS_PASSWD_USER}"
- --password "${CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD}" --uid
+ ${NUTTX_POSIX_SHELL} ${NUTTX_DIR}/tools/board_romfs_mkpasswd.sh
+ ${NUTTX_DIR} ${CMAKE_CURRENT_BINARY_DIR}/.romfs_passwd.txt
+ ${MKPASSWD_BIN} ${GENPASSWD_OUTPUT} --user
+ "${CONFIG_BOARD_ETC_ROMFS_PASSWD_USER}" --uid
${CONFIG_BOARD_ETC_ROMFS_PASSWD_UID} --gid
${CONFIG_BOARD_ETC_ROMFS_PASSWD_GID} --home
- "${CONFIG_BOARD_ETC_ROMFS_PASSWD_HOME}" --iterations
- ${MKPASSWD_ITERATIONS} -o ${GENPASSWD_OUTPUT}
+ "${CONFIG_BOARD_ETC_ROMFS_PASSWD_HOME}"
DEPENDS ${MKPASSWD_BIN} ${NUTTX_DIR}/.config
+ ${NUTTX_DIR}/tools/board_romfs_mkpasswd.sh
COMMENT "Generating /etc/passwd with PBKDF2 hash")
- add_custom_target(generate_passwd DEPENDS ${GENPASSWD_OUTPUT})
+ add_custom_target(generate_passwd DEPENDS ${GENPASSWD_OUTPUTS})
add_dependencies(generate_passwd build_host_mkpasswd)
- list(APPEND RCRAWS ${GENPASSWD_OUTPUT})
+ list(APPEND RCRAWS ${GENPASSWD_OUTPUTS})
list(APPEND dyn_deps generate_passwd)
endif()
diff --git a/cmake/savedefconfig.cmake b/cmake/savedefconfig.cmake
index db6742a3621..aef701e6bf8 100644
--- a/cmake/savedefconfig.cmake
+++ b/cmake/savedefconfig.cmake
@@ -77,7 +77,8 @@ foreach(LINE IN LISTS LINES)
decode_brackets(LINE)
decode_semicolon(LINE)
if(NOT "${LINE}" MATCHES "^CONFIG_FSUTILS_PASSWD_PBKDF2_ITERATIONS="
- AND NOT "${LINE}" MATCHES "^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=")
+ AND NOT "${LINE}" MATCHES "^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD="
+ AND NOT "${LINE}" MATCHES
"^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD=")
file(APPEND ${OUTPUT_FILE} "${LINE}\n")
endif()
endforeach()
diff --git a/fs/binfs/fs_binfs.c b/fs/binfs/fs_binfs.c
index f65409b4e88..d9152e80803 100644
--- a/fs/binfs/fs_binfs.c
+++ b/fs/binfs/fs_binfs.c
@@ -279,9 +279,16 @@ static int binfs_fstat(FAR const struct file *filep, FAR
struct stat *buf)
{
DEBUGASSERT(buf != NULL);
- /* It's a execute-only file system */
+#ifdef CONFIG_SCHED_USER_IDENTITY
+ int index = (int)((uintptr_t)filep->f_priv);
+
+ buf->st_uid = builtin_getuid(index);
+ buf->st_gid = builtin_getgid(index);
+ buf->st_mode = S_IFREG | (builtin_getmode(index) & ~S_IFMT);
+#else
+ buf->st_mode = S_IFREG | S_IXOTH | S_IXGRP | S_IXUSR;
+#endif
- buf->st_mode = S_IFREG | S_IXOTH | S_IXGRP | S_IXUSR;
buf->st_size = 0;
buf->st_blksize = 0;
buf->st_blocks = 0;
@@ -491,12 +498,12 @@ static int binfs_stat(FAR struct inode *mountpt, FAR
const char *relpath,
/* It's a execute-only file name */
- buf->st_mode = S_IFREG | S_IXOTH | S_IXGRP | S_IXUSR;
-
#ifdef CONFIG_SCHED_USER_IDENTITY
- buf->st_uid = builtin_getuid(index);
- buf->st_gid = builtin_getgid(index);
- buf->st_mode |= builtin_getmode(index);
+ buf->st_uid = builtin_getuid(index);
+ buf->st_gid = builtin_getgid(index);
+ buf->st_mode = S_IFREG | (builtin_getmode(index) & ~S_IFMT);
+#else
+ buf->st_mode = S_IFREG | S_IXOTH | S_IXGRP | S_IXUSR;
#endif
}
else
diff --git a/sched/environ/env_secureexec.c b/sched/environ/env_secureexec.c
index b886bca1443..5315f496c14 100644
--- a/sched/environ/env_secureexec.c
+++ b/sched/environ/env_secureexec.c
@@ -71,12 +71,17 @@ static bool env_is_unsafe(FAR const char *pair)
for (name = names; *name != NULL; name++)
{
- if (strncmp(pair, *name, strlen(*name)) == 0)
+ if (pair != NULL && strncmp(pair, *name, strlen(*name)) == 0)
{
return true;
}
}
+ if (pair == NULL)
+ {
+ return false;
+ }
+
return strncmp(pair, "LD_", 3) == 0 ||
strncmp(pair, "MALLOC_", 7) == 0;
}
@@ -102,7 +107,9 @@ void env_sanitize_secure(FAR struct task_group_s *group)
for (index = group->tg_envc - 1; index >= 0; )
{
- if (env_is_unsafe(group->tg_envp[index]))
+ FAR char *pair = group->tg_envp[index];
+
+ if (pair != NULL && env_is_unsafe(pair))
{
env_removevar(group, index);
}
diff --git a/tools/Unix.mk b/tools/Unix.mk
index 625772aaae8..06cef9522c4 100644
--- a/tools/Unix.mk
+++ b/tools/Unix.mk
@@ -793,6 +793,7 @@ savedefconfig: apps_preconfig
$(Q) $(call kconfig_tweak_disable,defconfig.tmp,CONFIG_BASE_DEFCONFIG)
$(Q) sed -i.bak -e '/^CONFIG_FSUTILS_PASSWD_PBKDF2_ITERATIONS=/d'
defconfig.tmp
$(Q) sed -i.bak -e '/^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=/d'
defconfig.tmp
+ $(Q) sed -i.bak -e '/^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD=/d'
defconfig.tmp
$(Q) grep "CONFIG_ARCH=" .config >> defconfig.tmp
$(Q) grep "^CONFIG_ARCH_CHIP_" .config >> defconfig.tmp; true
$(Q) grep "CONFIG_ARCH_CHIP=" .config >> defconfig.tmp; true
diff --git a/tools/board_romfs_mkpasswd.sh b/tools/board_romfs_mkpasswd.sh
index 2256bf91c98..b6e365c19cb 100755
--- a/tools/board_romfs_mkpasswd.sh
+++ b/tools/board_romfs_mkpasswd.sh
@@ -60,3 +60,48 @@ PASSWORD=$(cat "${PASSFILE}")
--iterations "${ITERATIONS}" \
"$@" -o "${OUTPUT}"
rm -f "${PASSFILE}"
+
+EXTRA_ENABLE=$(grep "^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE=y" \
+ "${CONFIG_FILE}" 2>/dev/null || true)
+
+if [ -n "${EXTRA_ENABLE}" ]; then
+ EXTRA_USER=$(read_int_config CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_USER user)
+ EXTRA_UID=$(read_int_config CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_UID 1000)
+ EXTRA_GID=$(read_int_config CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_GID 1000)
+ EXTRA_HOME=$(read_int_config CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_HOME /)
+ EXTRA_LINE="${OUTPUT}.extra"
+ EXTRA_PASS="${PASSWORD}"
+
+ if ! grep -q "^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_USE_ROOT_PASSWORD=y" \
+ "${CONFIG_FILE}" 2>/dev/null; then
+ "${TOPDIR}/tools/promptpasswd.sh" \
+ --min 8 \
+ --config CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD \
+ --config-file "${CONFIG_FILE}" \
+ --update-config \
+ --prompt "ROMFS extra user password (min 8 characters): " \
+ --output-file "${PASSFILE}"
+ EXTRA_PASS=$(cat "${PASSFILE}")
+ rm -f "${PASSFILE}"
+ fi
+
+ "${MKPASSWD}" --password "${EXTRA_PASS}" \
+ --iterations "${ITERATIONS}" \
+ --user "${EXTRA_USER}" \
+ --uid "${EXTRA_UID}" \
+ --gid "${EXTRA_GID}" \
+ --home "${EXTRA_HOME}" \
+ -o "${EXTRA_LINE}"
+ cat "${EXTRA_LINE}" >> "${OUTPUT}"
+ rm -f "${EXTRA_LINE}"
+
+ if grep -q "^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_SUDOERS=y" \
+ "${CONFIG_FILE}" 2>/dev/null; then
+ SUDOERS="$(dirname "${OUTPUT}")/sudoers"
+ {
+ echo "# NuttX sudo allowlist: one username per line"
+ echo "root"
+ echo "${EXTRA_USER}"
+ } > "${SUDOERS}"
+ fi
+fi
diff --git a/tools/update_romfs_password.sh b/tools/update_romfs_password.sh
index 8e8be3ae42b..17358076a38 100755
--- a/tools/update_romfs_password.sh
+++ b/tools/update_romfs_password.sh
@@ -20,10 +20,12 @@
# update_romfs_password.sh <path-to-.config>
#
# When CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y and the root password is not
-# set in .config, copy NUTTX_ROMFS_PASSWD_PASSWORD into .config. This is the
-# supported way to supply build-time credentials that must not live in
defconfig
-# (CI, automation, local scripts). No-op when the password is already set or
-# ROMFS passwd generation is disabled.
+# set in .config, copy NUTTX_ROMFS_PASSWD_PASSWORD into .config. If an extra
+# ROMFS user is enabled without using the root password, also copy
+# NUTTX_ROMFS_PASSWD_EXTRA_PASSWORD. This is the supported way to supply
+# build-time credentials that must not live in defconfig (CI, automation,
+# local scripts). No-op when the password is already set or ROMFS passwd
+# generation is disabled.
set -e
@@ -43,33 +45,46 @@ if ! grep -q '^CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y'
"${CONFIG}"; then
exit 0
fi
-# True when CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD is unset or empty in .config
-get_password() {
- grep -E '^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=' "${CONFIG}" 2>/dev/null \
+# Apply a Kconfig string password if the symbol is empty and ENVVAL is set.
+
+apply_password() {
+ symbol=$1
+ envval=$2
+ envname=$3
+ cur=$(grep -E "^${symbol}=" "${CONFIG}" 2>/dev/null \
| tail -n 1 \
| sed 's/^[^=]*=//' \
- | tr -d '"'
-}
+ | tr -d '"')
+ if [ -n "${cur}" ]; then
+ return 0
+ fi
-cur=$(get_password)
-if [ -n "${cur}" ]; then
- exit 0
-fi
+ if [ -z "${envval}" ]; then
+ return 0
+ fi
-if [ -z "${PASSWD_ENV}" ]; then
- exit 0
-fi
+ if [ "${#envval}" -lt 8 ]; then
+ printf 'update_romfs_password: %s must be at least 8 characters\n' \
+ "${envname}" >&2
+ exit 1
+ fi
-if [ "${#PASSWD_ENV}" -lt 8 ]; then
- printf 'update_romfs_password: NUTTX_ROMFS_PASSWD_PASSWORD must be at least
8 characters\n' >&2
- exit 1
-fi
+ if command -v kconfig-tweak >/dev/null 2>&1; then
+ kconfig-tweak --file "${CONFIG}" --set-str "${symbol}" "${envval}"
+ else
+ sed -i.bak -e "/^${symbol}=/d" "${CONFIG}"
+ rm -f "${CONFIG}.bak"
+ printf '%s="%s"\n' "${symbol}" "${envval}" >> "${CONFIG}"
+ fi
+}
+
+apply_password CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD \
+ "${PASSWD_ENV}" NUTTX_ROMFS_PASSWD_PASSWORD
-if command -v kconfig-tweak >/dev/null 2>&1; then
- kconfig-tweak --file "${CONFIG}" \
- --set-str CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD "${PASSWD_ENV}"
-else
- sed -i.bak -e '/^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=/d' "${CONFIG}"
- rm -f "${CONFIG}.bak"
- printf 'CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD="%s"\n' "${PASSWD_ENV}" >>
"${CONFIG}"
+if grep -q '^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE=y' "${CONFIG}" &&
+ ! grep -q '^CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_USE_ROOT_PASSWORD=y' \
+ "${CONFIG}"; then
+ apply_password CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_PASSWORD \
+ "${NUTTX_ROMFS_PASSWD_EXTRA_PASSWORD:-}" \
+ NUTTX_ROMFS_PASSWD_EXTRA_PASSWORD
fi
