sched/group: add getresuid, getresgid, setreuid, and setregid

Implement POSIX real/effective/saved credential getters and paired
setters in the task group layer, with libc stubs and syscalls.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

sched/group/CMakeLists.txt

@@ -52,7 +52,11 @@ if(CONFIG_SCHED_USER_IDENTITY)
     group_seteuid.c
     group_setegid.c
     group_geteuid.c
-    group_getegid.c)
+    group_getegid.c
+    group_setreuid.c
+    group_setregid.c
+    group_getresuid.c
+    group_getresgid.c)
 endif()
 
 if(CONFIG_SIG_SIGSTOP_ACTION)

sched/group/Make.defs

@@ -41,6 +41,7 @@ endif
 ifeq ($(CONFIG_SCHED_USER_IDENTITY),y)
 CSRCS += group_setuid.c group_setgid.c group_getuid.c group_getgid.c
 CSRCS += group_seteuid.c group_setegid.c group_geteuid.c group_getegid.c
+CSRCS += group_setreuid.c group_setregid.c group_getresuid.c group_getresgid.c
 endif
 
 ifeq ($(CONFIG_SIG_SIGSTOP_ACTION),y)

sched/group/group_getresgid.c

@@ -0,0 +1,79 @@
+/****************************************************************************
+ * sched/group/group_getresgid.c
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.  The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <nuttx/config.h>
+
+#include <unistd.h>
+#include <assert.h>
+
+#include <sched/sched.h>
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+/****************************************************************************
+ * Name: getresgid
+ *
+ * Description:
+ *   The getresgid() function gets the real, effective, and saved set-group
+ *   IDs of the calling process.
+ *
+ * Input Parameters:
+ *   rgid - Location to return the real group ID, or NULL.
+ *   egid - Location to return the effective group ID, or NULL.
+ *   sgid - Location to return the saved set-group ID, or NULL.
+ *
+ * Returned Value:
+ *   Zero if successful and -1 in case of failure, in which case errno is set
+ *   appropriately.
+ *
+ ****************************************************************************/
+
+int getresgid(FAR gid_t *rgid, FAR gid_t *egid, FAR gid_t *sgid)
+{
+  FAR struct tcb_s *rtcb          = this_task();
+  FAR struct task_group_s *rgroup = rtcb->group;
+
+  DEBUGASSERT(rgroup != NULL);
+
+  if (rgid != NULL)
+    {
+      *rgid = rgroup->tg_gid;
+    }
+
+  if (egid != NULL)
+    {
+      *egid = rgroup->tg_egid;
+    }
+
+  if (sgid != NULL)
+    {
+      *sgid = rgroup->tg_sgid;
+    }
+
+  return OK;
+}

sched/group/group_getresuid.c

@@ -0,0 +1,79 @@
+/****************************************************************************
+ * sched/group/group_getresuid.c
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.  The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <nuttx/config.h>
+
+#include <unistd.h>
+#include <assert.h>
+
+#include <sched/sched.h>
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+/****************************************************************************
+ * Name: getresuid
+ *
+ * Description:
+ *   The getresuid() function gets the real, effective, and saved set-user
+ *   IDs of the calling process.
+ *
+ * Input Parameters:
+ *   ruid - Location to return the real user ID, or NULL.
+ *   euid - Location to return the effective user ID, or NULL.
+ *   suid - Location to return the saved set-user ID, or NULL.
+ *
+ * Returned Value:
+ *   Zero if successful and -1 in case of failure, in which case errno is set
+ *   appropriately.
+ *
+ ****************************************************************************/
+
+int getresuid(FAR uid_t *ruid, FAR uid_t *euid, FAR uid_t *suid)
+{
+  FAR struct tcb_s *rtcb          = this_task();
+  FAR struct task_group_s *rgroup = rtcb->group;
+
+  DEBUGASSERT(rgroup != NULL);
+
+  if (ruid != NULL)
+    {
+      *ruid = rgroup->tg_uid;
+    }
+
+  if (euid != NULL)
+    {
+      *euid = rgroup->tg_euid;
+    }
+
+  if (suid != NULL)
+    {
+      *suid = rgroup->tg_suid;
+    }
+
+  return OK;
+}

sched/group/group_setregid.c

@@ -0,0 +1,154 @@
+/****************************************************************************
+ * sched/group/group_setregid.c
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.  The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <nuttx/config.h>
+
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+
+#include <sched/sched.h>
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+/****************************************************************************
+ * Name: setregid
+ *
+ * Description:
+ *   The setregid() function sets the real group ID and/or the effective
+ *   group ID of the calling process.
+ *
+ * Input Parameters:
+ *   rgid - Real group identity to set.  The special value (gid_t)-1
+ *          indicates that the real group ID should not be changed.
+ *   egid - Effective group identity to set.  The special value (gid_t)-1
+ *          indicates that the effective group ID should not be changed.
+ *
+ * Returned Value:
+ *   Zero if successful and -1 in case of failure, in which case errno is set
+ *   appropriately.
+ *
+ ****************************************************************************/
+
+int setregid(gid_t rgid, gid_t egid)
+{
+  FAR struct tcb_s *rtcb;
+  FAR struct task_group_s *rgroup;
+  gid_t old_rgid;
+  gid_t old_egid;
+  gid_t old_sgid;
+
+  if (rgid != (gid_t)-1 && (uint16_t)rgid > INT16_MAX)
+    {
+      set_errno(EINVAL);
+      return ERROR;
+    }
+
+  if (egid != (gid_t)-1 && (uint16_t)egid > INT16_MAX)
+    {
+      set_errno(EINVAL);
+      return ERROR;
+    }
+
+  if (rgid == (gid_t)-1 && egid == (gid_t)-1)
+    {
+      return OK;
+    }
+
+  rtcb   = this_task();
+  rgroup = rtcb->group;
+
+  DEBUGASSERT(rgroup != NULL);
+
+  old_rgid = rgroup->tg_gid;
+  old_egid = rgroup->tg_egid;
+  old_sgid = rgroup->tg_sgid;
+
+  if (old_egid == 0)
+    {
+      /* Super-user: may set any combination of real and effective IDs. */
+
+      if (rgid != (gid_t)-1)
+        {
+          rgroup->tg_gid = rgid;
+
+          if (egid == (gid_t)-1)
+            {
+              rgroup->tg_egid = rgid;
+              rgroup->tg_sgid = rgid;
+            }
+        }
+
+      if (egid != (gid_t)-1)
+        {
+          rgroup->tg_egid = egid;
+          rgroup->tg_sgid = egid;
+        }
+
+      return OK;
+    }
+
+  /* Non-super-user */
+
+  if (rgid != (gid_t)-1 &&
+      rgid != old_egid && rgid != old_sgid)
+    {
+      set_errno(EPERM);
+      return ERROR;
+    }
+
+  if (egid != (gid_t)-1 &&
+      egid != old_egid && egid != old_sgid && egid != old_rgid)
+    {
+      set_errno(EPERM);
+      return ERROR;
+    }
+
+  if (rgid != (gid_t)-1)
+    {
+      rgroup->tg_gid = rgid;
+    }
+
+  if (egid != (gid_t)-1)
+    {
+      rgroup->tg_egid = egid;
+    }
+
+  /* If the real group ID is being set, or the effective group ID is being
+   * changed to a value not equal to the real group ID, update the saved
+   * set-group-ID to the new effective group ID.
+   */
+
+  if ((rgid != (gid_t)-1 && rgroup->tg_gid != old_rgid) ||
+      (egid != (gid_t)-1 && rgroup->tg_egid != old_rgid))
+    {
+      rgroup->tg_sgid = rgroup->tg_egid;
+    }
+
+  return OK;
+}

sched/group/group_setreuid.c

@@ -0,0 +1,155 @@
+/****************************************************************************
+ * sched/group/group_setreuid.c
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.  The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <nuttx/config.h>
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+
+#include <sched/sched.h>
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+/****************************************************************************
+ * Name: setreuid
+ *
+ * Description:
+ *   The setreuid() function sets the real user ID and/or the effective user
+ *   ID of the calling process.
+ *
+ * Input Parameters:
+ *   ruid - Real user identity to set.  The special value (uid_t)-1
+ *          indicates that the real user ID should not be changed.
+ *   euid - Effective user identity to set.  The special value (uid_t)-1
+ *          indicates that the effective user ID should not be changed.
+ *
+ * Returned Value:
+ *   Zero if successful and -1 in case of failure, in which case errno is set
+ *   appropriately.
+ *
+ ****************************************************************************/
+
+int setreuid(uid_t ruid, uid_t euid)
+{
+  FAR struct tcb_s *rtcb;
+  FAR struct task_group_s *rgroup;
+  uid_t old_ruid;
+  uid_t old_euid;
+  uid_t old_suid;
+
+  if (ruid != (uid_t)-1 && (uint16_t)ruid > INT16_MAX)
+    {
+      set_errno(EINVAL);
+      return ERROR;
+    }
+
+  if (euid != (uid_t)-1 && (uint16_t)euid > INT16_MAX)
+    {
+      set_errno(EINVAL);
+      return ERROR;
+    }
+
+  if (ruid == (uid_t)-1 && euid == (uid_t)-1)
+    {
+      return OK;
+    }
+
+  rtcb   = this_task();
+  rgroup = rtcb->group;
+
+  DEBUGASSERT(rgroup != NULL);
+
+  old_ruid = rgroup->tg_uid;
+  old_euid = rgroup->tg_euid;
+  old_suid = rgroup->tg_suid;
+
+  if (old_euid == 0)
+    {
+      /* Super-user: may set any combination of real and effective IDs. */
+
+      if (ruid != (uid_t)-1)
+        {
+          rgroup->tg_uid = ruid;
+
+          if (euid == (uid_t)-1)
+            {
+              rgroup->tg_euid = ruid;
+              rgroup->tg_suid = ruid;
+            }
+        }
+
+      if (euid != (uid_t)-1)
+        {
+          rgroup->tg_euid = euid;
+          rgroup->tg_suid = euid;
+        }
+
+      return OK;
+    }
+
+  /* Non-super-user */
+
+  if (ruid != (uid_t)-1 &&
+      ruid != old_euid && ruid != old_suid)
+    {
+      set_errno(EPERM);
+      return ERROR;
+    }
+
+  if (euid != (uid_t)-1 &&
+      euid != old_euid && euid != old_suid && euid != old_ruid)
+    {
+      set_errno(EPERM);
+      return ERROR;
+    }
+
+  if (ruid != (uid_t)-1)
+    {
+      rgroup->tg_uid = ruid;
+    }
+
+  if (euid != (uid_t)-1)
+    {
+      rgroup->tg_euid = euid;
+    }
+
+  /* If the real user ID is being set, or the effective user ID is being
+   * changed to a value not equal to the real user ID, update the saved
+   * set-user-ID to the new effective user ID.
+   */
+
+  if ((ruid != (uid_t)-1 && rgroup->tg_uid != old_ruid) ||
+      (euid != (uid_t)-1 && rgroup->tg_euid != old_ruid))
+    {
+      rgroup->tg_suid = rgroup->tg_euid;
+    }
+
+  return OK;
+}