Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
During the Toybox port to NuttX, Claude noticed that changes in the
menuconfig weren't taking affect. This issue exists for a long time on
NuttX, in fact BayLibre's presentation from 2017 make jokes about our
building system not been reliable:
https://www.youtube.com/watch?v=XUJK2htXxKw&t=320s
Stale archive members from $(AR)'s additive-only behavior can linger
after Kconfig toggles change which files provide a symbol, causing dead
weight or "multiple definition" link errors on incremental builds.
Fixed by splitting ARCHIVE into two macros: ARCHIVE keeps the original
additive behavior for apps/libapps.a, which many independent
subdirectories contribute to across a build, while the new
ARCHIVE_REBUILD deletes then archives for the far more common case
of a single Makefile building its own self-contained $(OBJS)
- all 39 such call sites now use it.
Assisted-By: Claude Sonnet 5
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Parse application attributes (stacksize, priority, and uid/gid/mode under
CONFIG_SCHED_USER_IDENTITY) from absolute symbols (nx_stacksize,
nx_priority, nx_uid, nx_gid, nx_mode) embedded in the ELF at link time,
falling back to defaults when the symbols are absent.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
Adds a pre-load permission check in exec_internal() to verify the
calling task has the required execute (x) bits for the target file.
Properly evaluates root (euid == 0), owner, group, and other permissions.
This ensures POSIX compliance and cleanly rejects unauthorized files
with -EACCES before they reach the ELF loader, preventing unnecessary
memory allocation and downstream hardware execution faults.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Intermediate files of make depend like .ddc and .dds may remain
when make is interrupted. Remove them using make distclean.
Signed-off-by: SPRESENSE <41312067+SPRESENSE@users.noreply.github.com>
Move kernel stack allocation from exec_module() (binary format execution) to
nxtask_init() (task initialization) with proper type checking. Add conditional
check to allocate kernel stack only for non-kernel tasks (ttype != TCB_FLAG_TTYPE_KERNEL).
Enables kernel stack allocation for both exec'd tasks and regular task_create()
calls in protected builds, allowing userspace to create tasks with proper kernel
stack isolation.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Remove deprecated group_exitinfo() function and related critical section locking
from binfmt_exec.c, moving module unload setup directly into exec_module() where
it integrates naturally with task activation, simplifying code flow and reducing
unnecessary synchronization overhead.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
When opening the file succeeds but reading the file fails in
modlib_initialize, this will result in the open file not be closed.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
This flag can be used to store the filename of a loaded module or
executable in binfmt. The filename is useful for example in debugging.
For example, gdb or a jtag debugger can be configured to automatically
fetch the symbols for the currently executing module.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Renaming "modlib" to "libelf" is more in line with the implementation content,
which makes it easier for individual developers to understand the capabilities of this module.
CONFIG_LIBC_MODLIB -> CONFIG_LIBC_ELF
Signed-off-by: chao an <anchao.archer@bytedance.com>
test:
1.use mps3-an547 build helloxx as module and run it
2.use qemu-armv7a:knsh test kernel build helloxx and run it
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
We should not modify the input actions, casing when kernel build,
userspace call posix_spawn touch kernel address.
Signed-off-by: buxiasen <buxiasen@xiaomi.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
This patch fixed userspace headers conflict. Architecture-related definition and API should not be exposed to users.
Signed-off-by: ouyangxiangzhen <ouyangxiangzhen@xiaomi.com>
since bootloader may call modlib functions directly
to load elf firmware without binfmt, dlfcn or module.
BTW, this patch also remove the duplicated selecttion
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The feature depends on ARCH_USE_SEPARATED_SECTION
the different memory area has different access speed and cache
capability, so the arch can custom allocate them based on
section names to achieve performance optimization
test:
sim:elf
sim:sotest
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
maintains the same semantics as Kernel’s module build
and compatible with Kconfiglib implementation.
The problem of kconfiglib not being able to use tri-states is this:
linux is here torvalds/linux@6dd85ff
The module option is extracted from one of the triate three states into a MODULE keyword.
Kconfiglib supports the default implementation of module to be MODULE for compatibility with the linux kernel, and triate degenerates into bool two states
Refer to this code: 061e71f7d7/kconfiglib.py (L4274-L4284)
Signed-off-by: xuxin19 <xuxin19@xiaomi.com>
Revert "Parallelize depend file generation"
This reverts commit d5b6ec450f.
parallel depend ddc does not significantly speed up compilation,
intermediately generated .ddc files can cause problems if compilation is interrupted unexpectedly
Signed-off-by: xuxin19 <xuxin19@xiaomi.com>
reason:
1 On different architectures, we can utilize more optimized strategies
to implement up_current_regs/up_set_current_regs.
eg. use interrupt registersor percpu registers.
code size
before
text data bss dec hex filename
262848 49985 63893 376726 5bf96 nuttx
after
text data bss dec hex filename
262844 49985 63893 376722 5bf92 nuttx
size change -4
Configuring NuttX and compile:
$ ./tools/configure.sh -l qemu-armv8a:nsh_smp
$ make
Running with qemu
$ qemu-system-aarch64 -cpu cortex-a53 -smp 4 -nographic \
-machine virt,virtualization=on,gic-version=3 \
-net none -chardev stdio,id=con,mux=on -serial chardev:con \
-mon chardev=con,mode=readline -kernel ./nuttx
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
(1) Keep the `.init_array` and `.ctors` symbols and sort them according to their initialization priority.
(2) Exclude symbols ending with crtend.* and crtbegin.* to support c++
application.if we not exclude crtend.* crtbegin.* frame_dummy will be
added when enable any c++ application with global variables, this symbol
execution is problematic, removing it does not affect the application.
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
Set sh_addr for regions that are not allocated. Some relocations might
depend on this.
The fault in my case occurs when setting CONFIG_HAVE_CXX=y. In this case,
the .ctor and .dtor sections do not get allocated, but the crt code
depends on linker defined symbols _sctors/_ectors etc. These generate PC
relative relocations and thus, the .ctor and .dtor output sections need
an output VMA even though nothing is there. Otherwise the relocations will
point to god knows where (in my case to address 0).
The problem results in full system crash later:
elf_symvalue: Other: 00000000+00000001=00000001
up_relocateadd: PCREL_HI20 at c00002dc [00000417] to sym=0x80409e80 st_value=1
_calc_imm: offset=-3221226203: hi=-786432 lo=-731
up_relocateadd: ERROR: PCREL_HI20 at c00002dc bad:ffffffff40000000
elf_relocateadd: ERROR: Section 2 reloc 52: Relocation failed: -22
The RISC-V elf64 linker does not like the uninitialized PC relative
relocation entries, as the relocation offset cannot be reached with
with the RV64 instruction set.
More about this issue can be found here:
https://github.com/apache/nuttx/pull/11322
The ELF loader needs to load the app into the memory before
executing it from the same location. As expected, this memory space
should be able to execute code. For architectures containing data
and instruction buses, the instruction bus may not be able to be
accessed in a non-aligned way, which is usually required when
copying data to that location. Eventually, this same memory space
can be accessed through the data bus, using different address
ranges. This commit enables accessing the memory through the data
bus to copy the app's data before executing it when
`CONFIG_ARCH_HAVE_TEXT_HEAP_WORD_ALIGNED_READ` is enabled.
sched implementation not depends on macro abstraction, so revert below commit:
This reverts commit 4e62d0005a
This reverts commit 0f0c370520
This reverts commit ad0efd04ee
Signed-off-by: chao an <anchao@lixiang.com>
