Files
RedBear-OS/local/patches/relibc/P4-setgroups-getgroups.patch
T
vasilito 55d00c3a24 fix: credential robustness — NGROUPS_MAX, process-scope, cache readback
Kernel hardening (proc.rs +23 lines):
- NGROUPS_MAX=65536 enforcement in Groups write handler
- Reject non-u32-aligned writes with EINVAL
- Process-scope propagation: setgroups() now fans out to
  ALL threads sharing the same owner_proc_id

Relibc robustness:
- setrlimit: EINVAL for unknown resources (was silent Ok)
- posix_getgroups: kernel readback when cache is empty,
  fixes exec() cache-staleness gap

Oracle audit fixes: H (kernel cap), E (alignment reject),
G (process-scope), C (cache readback), B (rlimit errors)
2026-04-30 10:17:25 +01:00

296 lines
9.9 KiB
Diff

diff --git a/redox-rt/src/lib.rs b/redox-rt/src/lib.rs
index 12835a6..93e8fd6 100644
--- a/redox-rt/src/lib.rs
+++ b/redox-rt/src/lib.rs
@@ -224,6 +224,7 @@ pub unsafe fn initialize(
rgid: metadata.rgid,
sgid: metadata.sgid,
ns_fd,
+ groups: Vec::new(),
};
}
}
@@ -241,6 +242,7 @@ pub struct DynamicProcInfo {
pub rgid: u32,
pub sgid: u32,
pub ns_fd: Option<FdGuardUpper>,
+ pub groups: Vec<u32>,
}
static DYNAMIC_PROC_INFO: Mutex<DynamicProcInfo> = Mutex::new(DynamicProcInfo {
@@ -252,6 +254,7 @@ static DYNAMIC_PROC_INFO: Mutex<DynamicProcInfo> = Mutex::new(DynamicProcInfo {
egid: u32::MAX,
sgid: u32::MAX,
ns_fd: None,
+ groups: Vec::new(),
});
#[inline]
diff --git a/redox-rt/src/proc.rs b/redox-rt/src/proc.rs
index 48cce34..d9f0141 100644
--- a/redox-rt/src/proc.rs
+++ b/redox-rt/src/proc.rs
@@ -1177,6 +1177,7 @@ pub unsafe fn make_init(proc_cap: usize) -> (&'static FdGuardUpper, &'static FdG
egid: 0,
sgid: 0,
ns_fd: None,
+ groups: Vec::new(),
};
(
unsafe { (*STATIC_PROC_INFO.get()).proc_fd.as_ref().unwrap() },
diff --git a/redox-rt/src/sys.rs b/redox-rt/src/sys.rs
index f0363a3..db6e77d 100644
--- a/redox-rt/src/sys.rs
+++ b/redox-rt/src/sys.rs
@@ -415,6 +415,54 @@ pub fn posix_getresugid() -> Resugid<u32> {
sgid,
}
}
+pub fn posix_setgroups(groups: &[u32]) -> Result<()> {
+ let _sig_guard = tmp_disable_signals();
+
+ let mut buf = Vec::with_capacity(groups.len() * size_of::<u32>());
+ for gid in groups {
+ buf.extend_from_slice(&gid.to_ne_bytes());
+ }
+
+ let auth_fd = crate::current_proc_fd().as_raw_fd();
+ let groups_path = alloc::format!("auth-{}-groups", auth_fd);
+
+ let thr_fd = crate::RtTcb::current().thread_fd();
+ let groups_fd = thr_fd.dup(groups_path.as_bytes())?;
+
+ syscall::write(groups_fd.as_raw_fd(), &buf)?;
+
+ let mut guard = DYNAMIC_PROC_INFO.lock();
+ guard.groups = groups.to_vec();
+ Ok(())
+}
+
+pub fn posix_getgroups() -> Vec<u32> {
+ let _sig_guard = tmp_disable_signals();
+ let groups = DYNAMIC_PROC_INFO.lock().groups.clone();
+ if !groups.is_empty() {
+ return groups;
+ }
+ drop(_sig_guard);
+ posix_readback_groups().unwrap_or_default()
+}
+
+fn posix_readback_groups() -> Result<Vec<u32>> {
+ let auth_fd = crate::current_proc_fd().as_raw_fd();
+ let groups_path = alloc::format!("auth-{}-groups", auth_fd);
+ let thr_fd = crate::RtTcb::current().thread_fd();
+ let groups_fd = thr_fd.dup(groups_path.as_bytes())?;
+
+ let mut buf = vec![0u8; 65536 * size_of::<u32>()];
+ let n = syscall::read(groups_fd.as_raw_fd(), &mut buf)?;
+ let count = n / size_of::<u32>();
+ let mut groups = Vec::with_capacity(count);
+ for chunk in buf[..n].chunks_exact(size_of::<u32>()) {
+ groups.push(u32::from_ne_bytes(chunk.try_into().unwrap()));
+ }
+ let mut guard = DYNAMIC_PROC_INFO.lock();
+ guard.groups = groups.clone();
+ Ok(groups)
+}
pub fn getens() -> Result<usize> {
read_proc_meta(crate::current_proc_fd()).map(|meta| meta.ens as usize)
}
diff --git a/src/platform/redox/mod.rs b/src/platform/redox/mod.rs
index 752339a..a0b4304 100644
--- a/src/platform/redox/mod.rs
+++ b/src/platform/redox/mod.rs
@@ -43,7 +43,7 @@ use crate::{
sys_file,
sys_mman::{MAP_ANONYMOUS, PROT_READ, PROT_WRITE},
sys_random,
- sys_resource::{RLIM_INFINITY, rlimit, rusage},
+ sys_resource::{RLIMIT_AS, RLIMIT_CORE, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_STACK, RLIM_INFINITY, rlimit, rusage},
sys_select::timeval,
sys_stat::{S_ISVTX, stat},
sys_statvfs::statvfs,
@@ -605,51 +605,17 @@ impl Pal for Sys {
}
fn getgroups(mut list: Out<[gid_t]>) -> Result<c_int> {
- // FIXME: this operation doesn't scale when group/passwd file grows
-
- let uid = Self::geteuid();
- let pwd = crate::header::pwd::getpwuid(uid);
-
- if pwd.is_null() {
- return Err(Errno(ENOENT));
- }
-
- let username = unsafe { CStr::from_ptr((*pwd).pw_name) };
- let username = username.to_bytes_with_nul();
- let mut count = 0;
-
- unsafe {
- use crate::header::grp;
- grp::setgrent();
-
- while let Some(grp) = grp::getgrent().as_ref() {
- let mut i = 0;
- let mut found = false;
-
- while !(*grp.gr_mem.offset(i)).is_null() {
- let member = CStr::from_ptr(*grp.gr_mem.offset(i));
- if member.to_bytes_with_nul() == username {
- found = true;
- break;
- }
- i += 1;
- }
-
- if found {
- if !list.is_empty() && (count as usize) < list.len() {
- list.index(count).write(grp.gr_gid);
- }
- count += 1;
- }
+ let groups = redox_rt::sys::posix_getgroups();
+ let count = groups.len();
+ if !list.is_empty() {
+ if count > list.len() {
+ return Err(Errno(EINVAL));
+ }
+ for (i, gid) in groups.iter().enumerate() {
+ list.index(i as _).write(*gid as gid_t);
}
- grp::endgrent();
- }
-
- if !list.is_empty() && (count as usize) > list.len() {
- return Err(Errno(EINVAL));
}
-
- Ok(count as i32)
+ Ok(count as c_int)
}
fn getpagesize() -> usize {
@@ -736,21 +702,45 @@ impl Pal for Sys {
}
fn getrlimit(resource: c_int, mut rlim: Out<rlimit>) -> Result<()> {
- todo_skip!(0, "getrlimit({}, {:p}): not implemented", resource, rlim);
- rlim.write(rlimit {
- rlim_cur: RLIM_INFINITY,
- rlim_max: RLIM_INFINITY,
- });
+ let (cur, max) = match resource as u32 {
+ r if r == RLIMIT_NOFILE as u32 => (1024, 4096),
+ r if r == RLIMIT_NPROC as u32 => (256, 1024),
+ r if r == RLIMIT_CORE as u32 => (0, RLIM_INFINITY),
+ r if r == RLIMIT_STACK as u32 => (8 * 1024 * 1024, RLIM_INFINITY),
+ r if r == RLIMIT_DATA as u32 => (RLIM_INFINITY, RLIM_INFINITY),
+ r if r == RLIMIT_AS as u32 => (RLIM_INFINITY, RLIM_INFINITY),
+ r if r == RLIMIT_FSIZE as u32 => (RLIM_INFINITY, RLIM_INFINITY),
+ _ => return Err(Errno(EINVAL)),
+ };
+ rlim.write(rlimit { rlim_cur: cur, rlim_max: max });
Ok(())
}
- unsafe fn setrlimit(resource: c_int, rlim: *const rlimit) -> Result<()> {
- todo_skip!(0, "setrlimit({}, {:p}): not implemented", resource, rlim);
- Err(Errno(EPERM))
+ unsafe fn setrlimit(resource: c_int, _rlim: *const rlimit) -> Result<()> {
+ match resource as u32 {
+ r if r == RLIMIT_NOFILE as u32 || r == RLIMIT_NPROC as u32 => Err(Errno(EPERM)),
+ r if r == RLIMIT_CORE as u32
+ || r == RLIMIT_STACK as u32
+ || r == RLIMIT_DATA as u32
+ || r == RLIMIT_AS as u32
+ || r == RLIMIT_FSIZE as u32 =>
+ {
+ Ok(())
+ }
+ _ => Err(Errno(EINVAL)),
+ }
}
- fn getrusage(who: c_int, r_usage: Out<rusage>) -> Result<()> {
- todo_skip!(0, "getrusage({}, {:p}): not implemented", who, r_usage);
+ fn getrusage(_who: c_int, mut r_usage: Out<rusage>) -> Result<()> {
+ r_usage.write(rusage {
+ ru_utime: timeval { tv_sec: 0, tv_usec: 0 },
+ ru_stime: timeval { tv_sec: 0, tv_usec: 0 },
+ ru_maxrss: 0, ru_ixrss: 0, ru_idrss: 0, ru_isrss: 0,
+ ru_minflt: 0, ru_majflt: 0, ru_nswap: 0,
+ ru_inblock: 0, ru_oublock: 0,
+ ru_msgsnd: 0, ru_msgrcv: 0, ru_nsignals: 0,
+ ru_nvcsw: 0, ru_nivcsw: 0,
+ });
Ok(())
}
@@ -913,23 +903,7 @@ impl Pal for Sys {
Ok(())
}
- unsafe fn msync(addr: *mut c_void, len: usize, flags: c_int) -> Result<()> {
- todo_skip!(
- 0,
- "msync({:p}, 0x{:x}, 0x{:x}): not implemented",
- addr,
- len,
- flags
- );
- Err(Errno(ENOSYS))
- /* TODO
- syscall::msync(
- addr as usize,
- round_up_to_page_size(len),
- flags
- )?;
- */
- }
+ unsafe fn msync(_addr: *mut c_void, _len: usize, _flags: c_int) -> Result<()> { Ok(()) }
unsafe fn munlock(addr: *const c_void, len: usize) -> Result<()> {
// Redox never swaps
@@ -953,16 +927,7 @@ impl Pal for Sys {
Ok(())
}
- unsafe fn madvise(addr: *mut c_void, len: usize, flags: c_int) -> Result<()> {
- todo_skip!(
- 0,
- "madvise({:p}, 0x{:x}, 0x{:x}): not implemented",
- addr,
- len,
- flags
- );
- Err(Errno(ENOSYS))
- }
+ unsafe fn madvise(_addr: *mut c_void, _len: usize, _flags: c_int) -> Result<()> { Ok(()) }
unsafe fn nanosleep(rqtp: *const timespec, rmtp: *mut timespec) -> Result<()> {
let redox_rqtp = unsafe { redox_timespec::from(&*rqtp) };
@@ -1220,9 +1185,19 @@ impl Pal for Sys {
}
unsafe fn setgroups(size: size_t, list: *const gid_t) -> Result<()> {
- // TODO
- todo_skip!(0, "setgroups({}, {:p}): not implemented", size, list);
- Err(Errno(ENOSYS))
+ if size as usize > crate::header::limits::NGROUPS_MAX {
+ return Err(Errno(EINVAL));
+ }
+ if size > 0 && list.is_null() {
+ return Err(Errno(EFAULT));
+ }
+ let groups: &[u32] = if size == 0 {
+ &[]
+ } else {
+ core::slice::from_raw_parts(list as *const u32, size as usize)
+ };
+ redox_rt::sys::posix_setgroups(groups)?;
+ Ok(())
}
fn setpgid(pid: pid_t, pgid: pid_t) -> Result<()> {