Security Foundation

credentials unconditionally with no privilege check, meaning any unprivileged. Why it matters: sys_linux_setuid and sys_linux_setgid currently set. Focus on `sys_linux_setuid` and `sys_linux_setgid` in `kernel/src/arch/x86_64/syscall.rs` while you trace the snippet.

/// `setuid(uid)` — set user ID (syscall 105).
///
/// Enforces POSIX-style privilege checks:
/// - If euid == 0 (root): sets both real uid and effective uid.
/// - If euid != 0: only allows setting effective uid back to the real uid.
/// - Otherwise returns -EPERM.
///
/// Login and su work because they run as root (euid 0) when transitioning.
fn sys_linux_setuid(uid_arg: u64) -> u64 {
    let new_uid = uid_arg as u32;
    let pid = crate::process::current_pid();
    let mut table = crate::process::PROCESS_TABLE.lock();
    let proc = match table.find_mut(pid) {
        Some(p) => p,
        None => return NEG_EPERM,
    };
    let mut cred = kernel_core::cred::Credentials {
        uid: proc.uid,
        gid: proc.gid,
        euid: proc.euid,
        egid: proc.egid,
    };
    if cred.set_uid(new_uid).is_err() {
        return NEG_EPERM;

View on GitHub

iteration using the username as salt. The image ships with hardcoded root and. Why it matters: Passwords are currently hashed with a single SHA-256. Focus on `hash_password` and `populate_ext2_files` in `userspace/syscall-lib/src/sha256.rs` while you trace the snippet.

/// Hash a password with salt: SHA-256(salt || password).
pub fn hash_password(password: &[u8], salt: &[u8]) -> [u8; 32] {
    // Concatenate salt + password into a buffer.
    let total = salt.len() + password.len();
    let mut buf = [0u8; 512];
    if total > buf.len() {
        // Truncate if too long (shouldn't happen in practice).
        return sha256(password);
    }
    buf[..salt.len()].copy_from_slice(salt);
    buf[salt.len()..total].copy_from_slice(password);
    sha256(&buf[..total])
}

View on GitHub

auto-starts on every boot with restart=always. A plaintext remote shell in. Why it matters: Telnet is currently in the default service list and. Focus on `KNOWN_CONFIGS` and `restart=always` in `userspace/init/src/main.rs` while you trace the snippet.

/// Known service config files to try opening (no readdir available).
const KNOWN_CONFIGS: &[&[u8]] = &[
    b"/etc/services.d/sshd.conf\0",
    b"/etc/services.d/telnetd.conf\0",
    b"/etc/services.d/syslogd.conf\0",
    b"/etc/services.d/crond.conf\0",
    b"/etc/services.d/httpd.conf\0",
    b"/etc/services.d/dhcpd.conf\0",
    b"/etc/services.d/ntpd.conf\0",
    b"/etc/services.d/ftpd.conf\0",
];

View on GitHub