Skip to content

testing/ostest: extend multiuser identity and permission tests - #3677

Merged
xiaoxiang781216 merged 3 commits into
apache:masterfrom
Abhishekmishra2808:multiuser
Jul 30, 2026
Merged

testing/ostest: extend multiuser identity and permission tests#3677
xiaoxiang781216 merged 3 commits into
apache:masterfrom
Abhishekmishra2808:multiuser

Conversation

@Abhishekmishra2808

Copy link
Copy Markdown
Contributor

Summary

Extends testing/ostest/multiuser.c with regression tests for POSIX credential switching (getresuid/setreuid, saved set-UID/GID) and file/IPC permission enforcement. Enhances NSH id to print real, effective, and saved UID/GID in Linux-style format. Creates a temporary passwd file at build-configured path before getpwnam() checks, so sim:ostest multiuser tests do not need a pre-built /etc/passwd.

Impact

Enables automated validation of multi-user identity and permission behavior when CONFIG_TESTING_OSTEST_MULTIUSER and CONFIG_SCHED_USER_IDENTITY are enabled. The id command output is richer but backward-compatible (same command, more detail). No effect on builds that do not enable multiuser ostest options.

Testing

user_main: multi-user test
multiuser_test: start
multiuser: effective UID/GID switching
  PASS: initial uid == 0
  PASS: initial euid == 0
  PASS: initial gid == 0
  PASS: initial egid == 0
  PASS: root seteuid(1000)
  PASS: euid after seteuid(1000) == 1000
  PASS: root seteuid(0) restore
  PASS: euid restored to 0 == 0
  PASS: root setegid(2000)
  PASS: egid after setegid(2000) == 2000
  PASS: root setegid(0) restore
  PASS: egid restored to 0 == 0
multiuser: getresuid/getresgid and setreuid/setregid
  PASS: getresuid(initial)
  PASS: initial real uid == 0
  PASS: initial eff uid == 0
  PASS: initial saved uid == 0
  PASS: getresgid(initial)
  PASS: initial real gid == 0
  PASS: initial eff gid == 0
  PASS: initial saved gid == 0
  PASS: root setreuid(-1,1000)
  PASS: real uid after setreuid(-1,1000) == 0
  PASS: eff uid after setreuid(-1,1000) == 1000
  PASS: saved uid after setreuid(-1,1000) == 1000
  PASS: non-root setreuid(2000,-1) denied errno=1
  PASS: setreuid(-1,0) drop effective
  PASS: root setreuid(0,-1) restore
  PASS: real uid restored == 0
  PASS: eff uid restored == 0
  PASS: saved uid restored == 0
  PASS: root setregid(-1,1000)
  PASS: real gid after setregid(-1,1000) == 0
  PASS: eff gid after setregid(-1,1000) == 1000
  PASS: saved gid after setregid(-1,1000) == 1000
  PASS: non-root setregid(2000,-1) denied errno=1
  PASS: setregid(-1,0) drop effective
  PASS: root setregid(0,-1) restore
multiuser: setreuid(1000,1000) full assignment (child task)
  PASS: root setreuid(1000,1000)
  PASS: getresuid(after setreuid)
  PASS: real uid after setreuid == 1000
  PASS: eff uid after setreuid == 1000
  PASS: saved uid after setreuid == 1000
multiuser_resuid_child: 0 failure(s)
  PASS: mu_resuid child completed successfully
  PASS: parent euid after resuid child == 0
  PASS: parent egid after resuid child == 0
multiuser: saved set-UID/GID semantics (child task)
multiuser_suid_child: saved set-UID/GID semantics
  PASS: setuid(1000) as root
  PASS: uid after setuid(1000) == 1000
  PASS: euid after setuid(1000) == 1000
  PASS: non-root seteuid(0) denied errno=1
  PASS: euid unchanged after denied seteuid(0) == 1000
  PASS: non-root seteuid(1000)
  PASS: root-group setegid(2000)
  PASS: egid after setegid(2000) == 2000
  PASS: root-group setegid(0) restore
  PASS: setgid(3000)
  PASS: gid after setgid(3000) == 3000
  PASS: egid after setgid(3000) == 3000
  PASS: non-root setegid(0) denied errno=1
  PASS: egid unchanged after denied setegid(0) == 3000
multiuser_suid_child: 0 failure(s)
  PASS: mu_suid child completed successfully
  PASS: parent euid after child == 0
  PASS: parent egid after child == 0
multiuser: pseudoFS chmod/chown/open permissions
  PASS: /ostest_mu_perm owner 0:0
  PASS: root chmod(0600)
  PASS: non-owner chmod(0777) denied errno=1
  PASS: non-root chown(0,0) denied errno=1
  PASS: root chown to 1000:1000
  PASS: /ostest_mu_perm owner 1000:1000
  PASS: owner chmod(0777)
  PASS: /ostest_mu_secret owner 0:0
  PASS: open(/ostest_mu_secret) denied with EACCES
  PASS: open(/ostest_mu_secret) allowed
  PASS: /ostest_mu_user owner 1000:1000
  PASS: open(/ostest_mu_user) allowed
multiuser: tmpfs open permission enforcement
  PASS: /tmp/ostest_mu_secret owner 0:0
  PASS: open(/tmp/ostest_mu_secret) denied with EACCES
  PASS: open(/tmp/ostest_mu_secret) allowed
multiuser: message queue ownership and permissions
  PASS: /var/mqueue/ostest_mu_mq owner 1000:1000
  PASS: /var/mqueue/ostest_mu_mq mode 0600
  PASS: mq_open(other user) denied errno=13
  PASS: mq_open(owner)
multiuser: named semaphore ownership and permissions
  PASS: /var/sem/ostest_mu_sem owner 1000:1000
  PASS: sem_open(other user) denied errno=13
  PASS: sem_open(owner)
multiuser: shared memory ownership and permissions
  PASS: /var/shm/ostest_mu_shm owner 1000:1000
  PASS: shm_open(other user) denied errno=13
  PASS: shm_open(owner)
multiuser: FIFO ownership and permissions
  PASS: /ostest_mu_fifo owner 1000:1000
  PASS: open fifo (other user) denied errno=13
  PASS: open fifo (owner)
multiuser: passwd lookup after credential drop
  PASS: installed /tmp/ostest_passwd
  PASS: getpwnam(root) uid=0
  PASS: getpwnam(testuser) uid=1000
multiuser_test: 0 failure(s)

@Abhishekmishra2808 Abhishekmishra2808 changed the title Multiuser testing/ostest: extend multiuser identity and permission tests Jul 29, 2026
Comment thread nshlib/nsh_identity.c Outdated
Comment thread nshlib/nsh_identity.c Outdated
Comment thread nshlib/nsh_identity.c Outdated
Comment thread nshlib/nsh_identity.c Outdated
Comment thread testing/ostest/Kconfig Outdated
Comment thread testing/ostest/multiuser.c Outdated
Comment thread nshlib/nsh_identity.c
Use getresuid() and getresgid() for Linux-style id output with name
resolution and a groups= list based on the effective GID.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add getresuid/setreuid coverage plus ownership and permission checks
for message queues, named semaphores, shared memory, and FIFOs.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Install a minimal passwd file at CONFIG_LIBC_PASSWD_FILEPATH before
getpwnam() checks so sim:ostest does not require a pre-built /etc/passwd.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
@Abhishekmishra2808

Copy link
Copy Markdown
Contributor Author

@acassis PTAL !!

@xiaoxiang781216
xiaoxiang781216 merged commit 917e2e8 into apache:master Jul 30, 2026
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants