1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 */
26
27 /* Copyright (c) 1988 AT&T */
28 /* All Rights Reserved */
29
30
31 /* from S5R4 1.6 */
32
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/sysmacros.h>
36 #include <sys/signal.h>
37 #include <sys/cred.h>
38 #include <sys/user.h>
39 #include <sys/errno.h>
40 #include <sys/vnode.h>
41 #include <sys/proc.h>
42 #include <sys/cmn_err.h>
43 #include <sys/debug.h>
44 #include <sys/pathname.h>
45 #include <sys/disp.h>
46 #include <sys/exec.h>
47 #include <sys/kmem.h>
48 #include <sys/note.h>
49
50 /*
51 * This is the loadable module wrapper.
52 */
53 #include <sys/modctl.h>
54
55 extern int intpexec(struct vnode *, struct execa *, struct uarg *,
56 struct intpdata *, int, long *, int, caddr_t, struct cred *, int);
57
58 static struct execsw esw = {
59 intpmagicstr,
60 0,
61 2,
62 intpexec,
63 NULL
64 };
65
66 /*
67 * Module linkage information for the kernel.
68 */
69 extern struct mod_ops mod_execops;
70
71 static struct modlexec modlexec = {
72 &mod_execops, "exec mod for interp", &esw
73 };
74
75 static struct modlinkage modlinkage = {
76 MODREV_1, (void *)&modlexec, NULL
77 };
78
79 int
_init()80 _init()
81 {
82 return (mod_install(&modlinkage));
83 }
84
85 int
_fini()86 _fini()
87 {
88 return (mod_remove(&modlinkage));
89 }
90
91 int
_info(struct modinfo * modinfop)92 _info(struct modinfo *modinfop)
93 {
94 return (mod_info(&modlinkage, modinfop));
95 }
96
97
98 /*
99 * Crack open a '#!' line.
100 */
101 static int
getintphead(struct vnode * vp,struct intpdata * idatap)102 getintphead(struct vnode *vp, struct intpdata *idatap)
103 {
104 int error;
105 char *cp, *linep = idatap->intp;
106 ssize_t resid;
107
108 /*
109 * Read the entire line and confirm that it starts with '#!'.
110 */
111 if (error = vn_rdwr(UIO_READ, vp, linep, INTPSZ, (offset_t)0,
112 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))
113 return (error);
114 if (resid > INTPSZ-2 || linep[0] != '#' || linep[1] != '!')
115 return (ENOEXEC);
116 /*
117 * Blank all white space and find the newline.
118 */
119 for (cp = &linep[2]; cp < &linep[INTPSZ] && *cp != '\n'; cp++)
120 if (*cp == '\t')
121 *cp = ' ';
122 if (cp >= &linep[INTPSZ])
123 return (ENOEXEC);
124 ASSERT(*cp == '\n');
125 *cp = '\0';
126
127 /*
128 * Locate the beginning and end of the interpreter name.
129 * In addition to the name, one additional argument may
130 * optionally be included here, to be prepended to the
131 * arguments provided on the command line. Thus, for
132 * example, you can say
133 *
134 * #! /usr/bin/awk -f
135 */
136 for (cp = &linep[2]; *cp == ' '; cp++)
137 ;
138 if (*cp == '\0')
139 return (ENOEXEC);
140 idatap->intp_name = cp;
141 while (*cp && *cp != ' ')
142 cp++;
143 if (*cp == '\0')
144 idatap->intp_arg = NULL;
145 else {
146 *cp++ = '\0';
147 while (*cp == ' ')
148 cp++;
149 if (*cp == '\0')
150 idatap->intp_arg = NULL;
151 else {
152 idatap->intp_arg = cp;
153 while (*cp && *cp != ' ')
154 cp++;
155 *cp = '\0';
156 }
157 }
158 return (0);
159 }
160
161 int
intpexec(struct vnode * vp,struct execa * uap,struct uarg * args,struct intpdata * idatap,int level,long * execsz,int setid,caddr_t exec_file,struct cred * cred,int brand_action)162 intpexec(
163 struct vnode *vp,
164 struct execa *uap,
165 struct uarg *args,
166 struct intpdata *idatap,
167 int level,
168 long *execsz,
169 int setid,
170 caddr_t exec_file,
171 struct cred *cred,
172 int brand_action)
173 {
174 _NOTE(ARGUNUSED(brand_action))
175 vnode_t *nvp;
176 int error = 0;
177 struct intpdata idata;
178 struct pathname intppn;
179 struct pathname resolvepn;
180 char *opath;
181 char devfd[19]; /* 32-bit int fits in 10 digits + 8 for "/dev/fd/" */
182 int fd = -1;
183
184 if (level) { /* Can't recurse */
185 error = ENOEXEC;
186 goto bad;
187 }
188
189 ASSERT(idatap == (struct intpdata *)NULL);
190
191 /*
192 * Allocate a buffer to read in the interpreter pathname.
193 */
194 idata.intp = kmem_alloc(INTPSZ, KM_SLEEP);
195 if (error = getintphead(vp, &idata))
196 goto fail;
197
198 /*
199 * Look the new vnode up.
200 */
201 if (error = pn_get(idata.intp_name, UIO_SYSSPACE, &intppn))
202 goto fail;
203 pn_alloc(&resolvepn);
204 if (error = lookuppn(&intppn, &resolvepn, FOLLOW, NULLVPP, &nvp)) {
205 pn_free(&resolvepn);
206 pn_free(&intppn);
207 goto fail;
208 }
209 opath = args->pathname;
210 args->pathname = resolvepn.pn_path;
211 /* don't free resolvepn until we are done with args */
212 pn_free(&intppn);
213
214 /*
215 * When we're executing a set-uid script resulting in uids
216 * mismatching or when we execute with additional privileges,
217 * we close the "replace script between exec and open by shell"
218 * hole by passing the script as /dev/fd parameter.
219 */
220 if ((setid & EXECSETID_PRIVS) != 0 ||
221 (setid & (EXECSETID_UGIDS|EXECSETID_SETID)) ==
222 (EXECSETID_UGIDS|EXECSETID_SETID)) {
223 (void) strcpy(devfd, "/dev/fd/");
224 if (error = execopen(&vp, &fd))
225 goto done;
226 numtos(fd, &devfd[8]);
227 args->fname = devfd;
228 }
229
230 error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred,
231 EBA_NONE);
232
233 if (!error) {
234 /*
235 * Close this executable as the interpreter
236 * will open and close it later on.
237 */
238 (void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL);
239 }
240 done:
241 VN_RELE(nvp);
242 args->pathname = opath;
243 pn_free(&resolvepn);
244 fail:
245 kmem_free(idata.intp, INTPSZ);
246 if (error && fd != -1)
247 (void) execclose(fd);
248 bad:
249 return (error);
250 }
251