Abhishekmishra2808 opened a new pull request, #19900:
URL: https://github.com/apache/nuttx/pull/19900
## Summary
`CONFIG_FS_CHROOT` adds POSIX `chroot()` so a task group can pin a directory
as its filesystem root. Absolute lookups start at that inode, children inherit
the jail, and `PWD` is rewritten so relative paths cannot walk out. This is a
filesystem jail, not a container: descriptors opened before `chroot()` that
already point outside the tree remain usable.
## Impact
The option is off by default. When enabled, `chroot()` is a new syscall and,
with `SCHED_USER_IDENTITY`, requires effective UID 0. On `CONFIG_BUILD_FLAT`
the `euid == 0` gate and `tg_root` share the same trust boundary as
credentials. Companion apps change: NSH `chroot` command and ostest coverage.
## Testing
Host: WSL2 x86_64. Board: `sim` (`CONFIG_FS_CHROOT=y`). Companion apps
branch `feature/nsh-chroot`.
```
$ ./tools/checkpatch.sh -f fs/inode/fs_inodesearch.c fs/vfs/fs_chroot.c \
include/nuttx/sched.h include/unistd.h sched/group/group_create.c \
sched/group/group_leave.c include/nuttx/fs/fs.h syscall/syscall.csv \
fs/Kconfig fs/vfs/Make.defs fs/vfs/CMakeLists.txt \
Documentation/implementation/chroot.rst \
Documentation/implementation/user_identity.rst \
Documentation/applications/nsh/commands.rst
✔️ All checks pass.
```
```
$ cd Documentation && make html
build succeeded.
The HTML pages are in _build/html.
```
```
login: root
User Logged-in!
nsh> ostest
...
user_main: chroot test
chroot_test: Starting test
chroot_test: /marker is visible inside the jail
chroot_test: host paths are not visible inside the jail
chroot_test: pre-opened host fd still usable after chroot
chroot_test: grandchild still sees the jail
chroot_test: PASSED
```
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
