Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fs/binfmt: close symlink TOCTOU and harden setuid/setgid exec hygiene
Some checks are pending
Build Documentation / build-html (push) Waiting to run
Details
MemBrowse Memory Report / changes-filter (push) Waiting to run
Details
MemBrowse Memory Report / load-targets (push) Waiting to run
Details
MemBrowse Memory Report / identical (push) Blocked by required conditions
Details
MemBrowse Memory Report / analyze (push) Blocked by required conditions
Details

Browse source 
Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.

On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
This commit is contained in:
Abhishek Mishra 2026-08-01 13:02:19 +00:00 • committed by Alan C. Assis
parent 06ca196d56
commit db6ab892a2
23 changed files with 392 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

28
binfmt/binfmt_execmodule.c
View file

@ -45,6 +45,7 @@
#include <nuttx/binfmt/binfmt.h>
#include "binfmt.h"
#include "environ/environ.h"
#ifndef CONFIG_BINFMT_DISABLE
@ -301,14 +302,29 @@ int exec_module(FAR struct binary_s *binp,
#endif
#ifdef CONFIG_SCHED_USER_IDENTITY
if (binp->mode & S_ISUID)
{
tcb->group->tg_euid = binp->uid;
}
/* Apply set-user-ID / set-group-ID credentials for the new image. */
if (binp->mode & S_ISGID)
if ((binp->mode & (S_ISUID | S_ISGID)) != 0)
{
tcb->group->tg_egid = binp->gid;
FAR struct task_group_s *group = tcb->group;
if ((binp->mode & S_ISUID) != 0)
{
group->tg_euid = binp->uid;
group->tg_suid = binp->uid;
}
if ((binp->mode & S_ISGID) != 0)
{
group->tg_egid = binp->gid;
group->tg_sgid = binp->gid;
}
group->tg_flags |= GROUP_FLAG_SECURE_EXEC;
group->tg_flags &= ~(GROUP_FLAG_FD_BACKTRACE | GROUP_FLAG_DUMPABLE);
#ifndef CONFIG_DISABLE_ENVIRON
env_sanitize_secure(group);
#endif
}
#endif