mirror of
https://github.com/apache/nuttx-apps.git
synced 2026-08-19 12:38:19 +00:00
7358692c59
Install a UNIX-style setuid-root sudo app: the kernel raises euid on exec, userspace verifies the caller with passwd_verify(), then setresuid/setgroups and execvp() run the command. Ostest covers setuid exec after a hard credential drop. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
47 lines
1.6 KiB
Text
47 lines
1.6 KiB
Text
#
|
|
# For a description of the syntax of this configuration file,
|
|
# see the file kconfig-language.txt in the NuttX tools repository.
|
|
#
|
|
|
|
config SYSTEM_SUDO
|
|
tristate "sudo (setuid privilege helper)"
|
|
default n
|
|
depends on SCHED_USER_IDENTITY
|
|
depends on LIBC_PASSWD_FILE
|
|
depends on FSUTILS_PASSWD
|
|
depends on LIBC_EXECFUNCS
|
|
---help---
|
|
Install a Linux-style setuid-root ``sudo`` program. The kernel
|
|
raises the effective UID to zero when the ELF is loaded (see
|
|
``nx_uid`` / ``nx_mode`` in Application.mk). ``sudo`` verifies
|
|
the invoking user's password with ``passwd_verify()``, becomes
|
|
fully root via ``setresuid()`` / ``setresgid()``, then
|
|
``execvp()``s the requested command.
|
|
|
|
Requires ``CONFIG_LIBC_EXECFUNCS`` so NSH (or ``posix_spawn``)
|
|
loads the application ELF instead of calling its entry point
|
|
directly from the builtin registry.
|
|
|
|
Non-root callers must appear in the sudoers file
|
|
(``SYSTEM_SUDO_SUDOERS_PATH``) or in
|
|
``SYSTEM_SUDO_ALLOWED_USERS``. Real UID 0 is always allowed.
|
|
|
|
if SYSTEM_SUDO
|
|
|
|
config SYSTEM_SUDO_SUDOERS_PATH
|
|
string "Path to sudoers allowlist"
|
|
default "/etc/sudoers"
|
|
---help---
|
|
Simple allowlist, one username per line. Lines starting with
|
|
``#`` are comments. A Linux-style first field is also accepted
|
|
(``user ALL=(ALL) ALL``). Generate this file in ROMFS with
|
|
``CONFIG_BOARD_ETC_ROMFS_PASSWD_EXTRA_ENABLE``.
|
|
|
|
config SYSTEM_SUDO_ALLOWED_USERS
|
|
string "Compile-time sudoers usernames"
|
|
default ""
|
|
---help---
|
|
Optional comma-separated extra allowlist compiled into sudo.
|
|
Use this when /etc/sudoers is not present. Example: ``user``.
|
|
|
|
endif # SYSTEM_SUDO
|