casaroli opened a new pull request, #20771: URL: https://github.com/apache/nuttx/pull/20771
## Summary `access()` ignored `X_OK`: it returned 0 for a file without execute permission. Also, a successful `W_OK` check returned before the other bits were checked. With `CONFIG_BINFMT_CHECKEXEC`, `access()` now checks `X_OK` with the rule that `exec()` uses, but with the real user and group IDs, as POSIX requires. `W_OK` and `X_OK` are checked one after the other. A directory is still always accessible. depends-on: apache/nuttx/pull/20764 ## Impact Only with `CONFIG_BINFMT_CHECKEXEC` (apache/nuttx#20764): `access(path, X_OK)` fails with `EACCES` for a file that `exec()` refuses. Without the option, `X_OK` is not checked, as before. ## Testing A test program on `qemu-armv8a:knsh` (QEMU 11 with HVF on an Apple M4), with apache/nuttx#20762, apache/nuttx#20764 and apache/nuttx-apps#3865. It checks `posix_spawn()` and `access(X_OK)` for a file with and without execute bits, a directory, scripts, and files on tmpfs mounts with and without `noexec`: | Configuration | Result | |---|---| | without `CONFIG_BINFMT_CHECKEXEC` | 13/13 (`X_OK` is not checked) | | `CONFIG_BINFMT_CHECKEXEC` | 13/13 | | `CONFIG_BINFMT_CHECKEXEC`, `CONFIG_SCHED_USER_IDENTITY`, `CONFIG_FS_PERMISSION` | 13/13 | `tools/checkpatch.sh -c -u -m -g` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
