casaroli opened a new pull request, #20764: URL: https://github.com/apache/nuttx/pull/20764
## Summary The ELF, NXFLAT and builtin loaders checked the execute permission only with `CONFIG_SCHED_USER_IDENTITY`, and the script loader did not check it at all. Without user identities, NuttX started any file that a loader recognized, whatever its mode. This PR adds `CONFIG_BINFMT_CHECKEXEC`, which is the default with `CONFIG_SCHED_USER_IDENTITY`. `load_absmodule()` then checks the file once, before it tries the loaders: - A file that is not a regular file (for example a directory) gives `EACCES`. - A file without execute permission gives `EACCES`. With `CONFIG_SCHED_USER_IDENTITY`, the owner, group or other bit is checked for the effective IDs, and root needs any execute bit. Without it, any execute bit is enough. - This covers every binary format, scripts and their interpreters too. The builtin loader keeps its own check for a name that is not a file. The ELF and NXFLAT loaders still save the owner, group and mode for set-user-ID. The second commit adds an "Execute permission" section to `Documentation/os/filesystem/file_permission.rst`. ## Impact Without `CONFIG_BINFMT_CHECKEXEC` (the default without `CONFIG_SCHED_USER_IDENTITY`), nothing changes. With `CONFIG_SCHED_USER_IDENTITY`, scripts are now checked too. File systems without a stored mode report execute permission for all files (#20754, #20755, #20756), so their programs still run. ## Testing A test program on `qemu-armv8a:knsh` (QEMU 11 with HVF on an Apple M4) starts files with `posix_spawn()`. The files are on v9fs, with the host mode, and on tmpfs mounts with and without `MS_NOEXEC` (#20762): | Check | default | `BINFMT_CHECKEXEC` | `SCHED_USER_IDENTITY` + `FS_PERMISSION` | |---|---|---|---| | program with execute bits | runs | runs | runs | | program without execute bits | runs | `EACCES` | `EACCES` | | script with / without execute bits | runs / runs | runs / `EACCES` | runs / `EACCES` | | directory | fails | `EACCES` | `EACCES` | | program on a `noexec` mount | runs | `EACCES` | `EACCES` | In the last configuration, a program copied to tmpfs with a mode without execute bits fails with "Permission denied" and runs after `chmod 755`. `ostest` on `qemu-armv8a:knsh` and `qemu-armv8a:nsh` gives the same result as master (it stops only at `rr_test`, which fails on master too when the host is busy). `tools/checkpatch.sh -c -u -m -g` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
