sched: supplementary groups, setresuid/setresgid, and PR_NSHCRED_AUTHSETEID by Abhishekmishra2808 · Pull Request #19767 · apache/nuttx

Abhishekmishra2808 · 2026-08-10T16:01:21Z

Summary

Add per-task-group supplementary GIDs (setgroups / getgroups / initgroups) and honor them in DAC checks.
Add setresuid / setresgid for hard and soft credential drop.
Add PR_NSHCRED_ENABLE and atomic PR_NSHCRED_AUTHSETEID (passwd verify + raise euid/egid in one prctl).
Document the identity model and NSH login / su / sudo behavior.

Impact

This extends NuttX process credentials with supplementary groups and full setres* support, and adds an in-kernel password-authenticated path to raise effective IDs for hard-dropped NSH sessions. Boards that enable CONFIG_SCHED_USER_IDENTITY (and related passwd/crypto options for AUTHSETEID) get the new syscalls and prctl commands; default configs that leave user identity disabled are unchanged.

Testing

nsh# useradd testuser UserPass1!
nsh# cat /tmp/passwd
root:$pbkdf2-sha256$10000$uwK3GNfobksYkqa5H9-Rcw$kNsxMZi26PeLxdWKgFjNvZpOoouP_DcHyO2mwyACVc0:0:0:/
testuser:$pbkdf2-sha256$10000$LCsDACzp0RA26xvaHPsY2g$gfCJXfLINNOKNIpVqepoUaYJiMbB8ojezAlosZJnrXY:1000:1000:/
nsh# su testuser
nsh$ id
uid=1000(testuser) suid=0(root) gid=1000 sgid=0(root) groups=1000
nsh$ su root
password: 
nsh# id
uid=0(root) gid=0(root) groups=0(root)
nsh#

github-actions · 2026-08-10T16:09:16Z

MemBrowse Memory Report

No memory changes detected for:

xiaoxiang781216 · 2026-08-11T03:02:41Z

+#if CONFIG_SCHED_NGROUPS > 0
+  for (i = 0; i < size; i++)
+    {
+      if ((uint16_t)list[i] > INT16_MAX)


why add this check

matches existing UID/GID APIs

xiaoxiang781216 · 2026-08-11T03:03:45Z

+  rgroup = rtcb->group;
+  DEBUGASSERT(rgroup != NULL);
+
+#if CONFIG_SCHED_NGROUPS > 0


should we move the code related to CONFIG_SCHED_NGROUPS == 0 to libc?

xiaoxiang781216 · 2026-08-11T03:04:12Z

+    }
+
+  rgroup->tg_ngroups = size;
+#else


move the dummy code to libc too

xiaoxiang781216 · 2026-08-11T03:06:21Z

 int binfmt_checkexecperm(FAR struct binary_s *bin)
 {
  FAR struct tcb_s *rtcb;
+  FAR struct task_group_s *tgroup;


rgroup or group

xiaoxiang781216 · 2026-08-11T03:06:48Z

 int fs_checkmode(uid_t owner, gid_t group, mode_t mode, int amode)
 {
  FAR struct tcb_s *rtcb;
+  FAR struct task_group_s *tgroup;


xiaoxiang781216 · 2026-08-11T03:12:49Z

 #define GROUP_FLAG_SECURE_EXEC     (1 << 5)                      /* Bit 5: Secure (setuid/setgid) executable */
 #define GROUP_FLAG_DUMPABLE        (1 << 6)                      /* Bit 6: Process may be traced / coredumped */
-                                                                 /* Bit 7: Available */
+#define GROUP_FLAG_NSHCRED         (1 << 7)                      /* Bit 7: NSH credential agent (login/su) */


where use this flag

Set by PR_NSHCRED_ENABLE, required by AUTHSETEID.

xiaoxiang781216 · 2026-08-11T03:14:01Z

+  gid_t new_egid;
+  gid_t new_sgid;
+
+  if ((rgid != (gid_t)-1 && (uint16_t)rgid > INT16_MAX) ||


why limit to INT16_MAX

matches existing UID/GID APIs

xiaoxiang781216 · 2026-08-11T03:14:29Z

+  uid_t new_euid;
+  uid_t new_suid;
+
+  if ((ruid != (uid_t)-1 && (uint16_t)ruid > INT16_MAX) ||


xiaoxiang781216 · 2026-08-11T03:16:00Z

+      return -EPERM;
+    }
+
+  if ((uint16_t)euid > INT16_MAX || (uint16_t)egid > INT16_MAX)


xiaoxiang781216 · 2026-08-11T03:18:29Z

+ * Requires euid == 0.  Not inherited by child task groups.
+ * Required for PR_NSHCRED_AUTHSETEID.
+ *
+ * PR_NSHCRED_AUTHSETEID — verify username/password against the passwd


but why move the verify into kernel? it's better to keep it in userspace

After hard-drop, raise needs a privileged API. If that API only checks an agent flag (old TOKEN), userspace can skip verify and still raise. AUTHSETEID binds verify and raise together for that reason (on flat builds with no memory isolation).

Soft-drop / saved UIDs avoids kernel passwd checks, but then raise-after-hard-drop goes away.

Do you prefer keeping atomic kernel verify for hard-drop, or dropping hard-drop and using soft-drop only?

Track supplementary GIDs per task group, wire setgroups/getgroups syscalls when CONFIG_SCHED_NGROUPS > 0, and honor them in DAC checks via nxsched_has_gid(). When NGROUPS is 0, libc provides getgroups/ setgroups stubs. initgroups() fails instead of silently truncating when membership exceeds CONFIG_SCHED_NGROUPS. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Complete the POSIX credential setters for real/effective/saved UID and GID so login and privilege-drop paths can clear saved-root without relying on setreuid patterns alone. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Collapse password verification and euid/egid raise into one in-kernel prctl so hard-dropped NSH agents cannot mint privilege without the correct password. This replaces an earlier TOKEN+SETEID split that allowed mint-without-verify inside a flat address space. PR_NSHCRED_ENABLE still marks the agent task group at trusted init; AUTHSETEID requires that flag and a matching PBKDF2 passwd hash. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Document hard/soft drop, setresuid/setresgid, and PR_NSHCRED_AUTHSETEID for NSH login, su, and sudo. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Abhishekmishra2808 requested review from Donny9, GUIDINGLI, anchao, btashton, davids5, hartmannathan, jerpelea, pussuw, raiden00pl and xiaoxiang781216 as code owners August 10, 2026 16:01

github-actions Bot added Size: XL The size of the change in this PR is very large. Consider breaking down the PR into smaller pieces. Area: BINFMT labels Aug 10, 2026

Abhishekmishra2808 force-pushed the feature/supp-groups-and-sudo branch from 6602cf8 to f3e8f00 Compare August 10, 2026 16:08

Abhishekmishra2808 mentioned this pull request Aug 10, 2026

nshlib: hard/soft credential drop and sudo via PR_NSHCRED_AUTHSETEID apache/nuttx-apps#3714

Open

Abhishekmishra2808 force-pushed the feature/supp-groups-and-sudo branch 2 times, most recently from 055ab91 to 0fc9c1b Compare August 10, 2026 17:38

xiaoxiang781216 reviewed Aug 11, 2026

View reviewed changes

Abhishekmishra2808 added 4 commits August 11, 2026 18:01

sched: add setresuid and setresgid

be1cb3e

Complete the POSIX credential setters for real/effective/saved UID and GID so login and privilege-drop paths can clear saved-root without relying on setreuid patterns alone. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Documentation: document user identity and NSH credential drop

b569903

Document hard/soft drop, setresuid/setresgid, and PR_NSHCRED_AUTHSETEID for NSH login, su, and sudo. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>

Abhishekmishra2808 force-pushed the feature/supp-groups-and-sudo branch from 0fc9c1b to b569903 Compare August 11, 2026 18:03

Uh oh!

Conversation

Abhishekmishra2808 commented Aug 10, 2026

Summary

Impact

Testing

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 10, 2026 •

edited

Loading