1 /*-
2 * Copyright (c) 2013-16, Stacey D. Son
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <sys/param.h>
28 #include <sys/ctype.h>
29 #include <sys/exec.h>
30 #include <sys/fcntl.h>
31 #include <sys/imgact.h>
32 #include <sys/imgact_binmisc.h>
33 #include <sys/kernel.h>
34 #include <sys/lock.h>
35 #include <sys/malloc.h>
36 #include <sys/mutex.h>
37 #include <sys/namei.h>
38 #include <sys/sbuf.h>
39 #include <sys/sysctl.h>
40 #include <sys/sx.h>
41 #include <sys/vnode.h>
42
43 #include <machine/atomic.h>
44
45 /**
46 * Miscellaneous binary interpreter image activator.
47 *
48 * If the given target executable's header matches 'xbe_magic' field in the
49 * 'interpreter_list' then it will use the user-level interpreter specified in
50 * the 'xbe_interpreter' field to execute the binary. The 'xbe_magic' field may
51 * be adjusted to a given offset using the value in the 'xbe_moffset' field
52 * and bits of the header may be masked using the 'xbe_mask' field. The
53 * 'interpreter_list' entries are managed using sysctl(3) as described in the
54 * <sys/imgact_binmisc.h> file.
55 */
56
57 /*
58 * Node of the interpreter list.
59 */
60 typedef struct imgact_binmisc_entry {
61 SLIST_ENTRY(imgact_binmisc_entry) link;
62 char *ibe_name;
63 uint8_t *ibe_magic;
64 uint8_t *ibe_mask;
65 uint8_t *ibe_interpreter;
66 struct vnode *ibe_interpreter_vnode;
67 ssize_t ibe_interp_offset;
68 uint32_t ibe_interp_argcnt;
69 uint32_t ibe_interp_length;
70 uint32_t ibe_argv0_cnt;
71 uint32_t ibe_flags;
72 uint32_t ibe_moffset;
73 uint32_t ibe_msize;
74 } imgact_binmisc_entry_t;
75
76 /*
77 * sysctl() commands.
78 */
79 #define IBC_ADD 1 /* Add given entry. */
80 #define IBC_REMOVE 2 /* Remove entry for a given name. */
81 #define IBC_DISABLE 3 /* Disable entry for a given name. */
82 #define IBC_ENABLE 4 /* Enable entry for a given name. */
83 #define IBC_LOOKUP 5 /* Lookup and return entry for given name. */
84 #define IBC_LIST 6 /* Get a snapshot of the interpretor list. */
85
86 /*
87 * Interpreter string macros.
88 *
89 * They all start with '#' followed by a single letter:
90 */
91 #define ISM_POUND '#' /* "##" is the escape sequence for single #. */
92 #define ISM_OLD_ARGV0 'a' /* "#a" is replaced with the old argv0. */
93
94 MALLOC_DEFINE(M_BINMISC, KMOD_NAME, "misc binary image activator");
95
96 /* The interpreter list. */
97 static SLIST_HEAD(, imgact_binmisc_entry) interpreter_list =
98 SLIST_HEAD_INITIALIZER(interpreter_list);
99
100 static int interp_list_entry_count;
101
102 static struct sx interp_list_sx;
103
104 #define INTERP_LIST_WLOCK() sx_xlock(&interp_list_sx)
105 #define INTERP_LIST_RLOCK() sx_slock(&interp_list_sx)
106 #define INTERP_LIST_WUNLOCK() sx_xunlock(&interp_list_sx)
107 #define INTERP_LIST_RUNLOCK() sx_sunlock(&interp_list_sx)
108
109 #define INTERP_LIST_LOCK_INIT() sx_init(&interp_list_sx, KMOD_NAME)
110 #define INTERP_LIST_LOCK_DESTROY() sx_destroy(&interp_list_sx)
111
112 #define INTERP_LIST_ASSERT_LOCKED() sx_assert(&interp_list_sx, SA_LOCKED)
113
114 /*
115 * Populate the entry with the information about the interpreter.
116 */
117 static void
imgact_binmisc_populate_interp(char * str,imgact_binmisc_entry_t * ibe,int flags)118 imgact_binmisc_populate_interp(char *str, imgact_binmisc_entry_t *ibe, int flags)
119 {
120 uint32_t len = 0, argc = 1;
121 char t[IBE_INTERP_LEN_MAX];
122 char *sp, *tp;
123
124 memset(t, 0, sizeof(t));
125
126 /*
127 * Normalize interpreter string. Replace white space between args with
128 * single space.
129 */
130 sp = str; tp = t;
131 while (*sp != '\0') {
132 if (*sp == ' ' || *sp == '\t') {
133 if (++len >= IBE_INTERP_LEN_MAX)
134 break;
135 *tp++ = ' ';
136 argc++;
137 while (*sp == ' ' || *sp == '\t')
138 sp++;
139 continue;
140 } else {
141 *tp++ = *sp++;
142 len++;
143 }
144 }
145 *tp = '\0';
146 len++;
147
148 ibe->ibe_interpreter = malloc(len, M_BINMISC, M_WAITOK|M_ZERO);
149
150 /* Populate all the ibe fields for the interpreter. */
151 memcpy(ibe->ibe_interpreter, t, len);
152 ibe->ibe_interp_argcnt = argc;
153 ibe->ibe_interp_length = len;
154
155 ibe->ibe_interpreter_vnode = NULL;
156 if (flags & IBF_PRE_OPEN) {
157 struct nameidata nd;
158 int error;
159
160 tp = t;
161 while (*tp != '\0' && *tp != ' ') {
162 tp++;
163 }
164 *tp = '\0';
165 NDINIT(&nd, LOOKUP, FOLLOW | ISOPEN, UIO_SYSSPACE, t);
166
167 /*
168 * If there is an error, just stop now and fall back
169 * to the non pre-open case where we lookup during
170 * exec.
171 */
172 error = namei(&nd);
173 if (error)
174 return;
175
176 ibe->ibe_interpreter_vnode = nd.ni_vp;
177 }
178 }
179
180 /*
181 * Allocate memory and populate a new entry for the interpreter table.
182 */
183 static imgact_binmisc_entry_t *
imgact_binmisc_new_entry(ximgact_binmisc_entry_t * xbe,ssize_t interp_offset,int argv0_cnt)184 imgact_binmisc_new_entry(ximgact_binmisc_entry_t *xbe, ssize_t interp_offset,
185 int argv0_cnt)
186 {
187 imgact_binmisc_entry_t *ibe = NULL;
188 size_t namesz = min(strlen(xbe->xbe_name) + 1, IBE_NAME_MAX);
189
190 ibe = malloc(sizeof(*ibe), M_BINMISC, M_WAITOK|M_ZERO);
191
192 ibe->ibe_name = malloc(namesz, M_BINMISC, M_WAITOK|M_ZERO);
193 strlcpy(ibe->ibe_name, xbe->xbe_name, namesz);
194
195 imgact_binmisc_populate_interp(xbe->xbe_interpreter, ibe, xbe->xbe_flags);
196
197 ibe->ibe_magic = malloc(xbe->xbe_msize, M_BINMISC, M_WAITOK|M_ZERO);
198 memcpy(ibe->ibe_magic, xbe->xbe_magic, xbe->xbe_msize);
199
200 ibe->ibe_mask = malloc(xbe->xbe_msize, M_BINMISC, M_WAITOK|M_ZERO);
201 memcpy(ibe->ibe_mask, xbe->xbe_mask, xbe->xbe_msize);
202
203 ibe->ibe_moffset = xbe->xbe_moffset;
204 ibe->ibe_msize = xbe->xbe_msize;
205 ibe->ibe_flags = xbe->xbe_flags;
206 ibe->ibe_interp_offset = interp_offset;
207 ibe->ibe_argv0_cnt = argv0_cnt;
208 return (ibe);
209 }
210
211 /*
212 * Free the allocated memory for a given list item.
213 */
214 static void
imgact_binmisc_destroy_entry(imgact_binmisc_entry_t * ibe)215 imgact_binmisc_destroy_entry(imgact_binmisc_entry_t *ibe)
216 {
217 if (!ibe)
218 return;
219 if (ibe->ibe_magic)
220 free(ibe->ibe_magic, M_BINMISC);
221 if (ibe->ibe_mask)
222 free(ibe->ibe_mask, M_BINMISC);
223 if (ibe->ibe_interpreter)
224 free(ibe->ibe_interpreter, M_BINMISC);
225 if (ibe->ibe_name)
226 free(ibe->ibe_name, M_BINMISC);
227 if (ibe->ibe_interpreter_vnode)
228 vrele(ibe->ibe_interpreter_vnode);
229 if (ibe)
230 free(ibe, M_BINMISC);
231 }
232
233 /*
234 * Find the interpreter in the list by the given name. Return NULL if not
235 * found.
236 */
237 static imgact_binmisc_entry_t *
imgact_binmisc_find_entry(char * name)238 imgact_binmisc_find_entry(char *name)
239 {
240 imgact_binmisc_entry_t *ibe;
241
242 INTERP_LIST_ASSERT_LOCKED();
243
244 SLIST_FOREACH(ibe, &interpreter_list, link) {
245 if (strncmp(name, ibe->ibe_name, IBE_NAME_MAX) == 0)
246 return (ibe);
247 }
248
249 return (NULL);
250 }
251
252 /*
253 * Add the given interpreter if it doesn't already exist. Return EEXIST
254 * if the name already exist in the interpreter list.
255 */
256 static int
imgact_binmisc_add_entry(ximgact_binmisc_entry_t * xbe)257 imgact_binmisc_add_entry(ximgact_binmisc_entry_t *xbe)
258 {
259 imgact_binmisc_entry_t *ibe;
260 char *p;
261 ssize_t interp_offset;
262 int argv0_cnt, cnt;
263
264 if (xbe->xbe_msize > IBE_MAGIC_MAX)
265 return (EINVAL);
266 if (xbe->xbe_moffset + xbe->xbe_msize > IBE_MATCH_MAX)
267 return (EINVAL);
268
269 for(cnt = 0, p = xbe->xbe_name; *p != 0; cnt++, p++)
270 if (cnt >= IBE_NAME_MAX || !isascii((int)*p))
271 return (EINVAL);
272
273 for(cnt = 0, p = xbe->xbe_interpreter; *p != 0; cnt++, p++)
274 if (cnt >= IBE_INTERP_LEN_MAX || !isascii((int)*p))
275 return (EINVAL);
276
277 /* Make sure we don't have any invalid #'s. */
278 p = xbe->xbe_interpreter;
279 interp_offset = 0;
280 argv0_cnt = 0;
281 while ((p = strchr(p, '#')) != NULL) {
282 p++;
283 switch(*p) {
284 case ISM_POUND:
285 /* "##" */
286 p++;
287 interp_offset--;
288 break;
289 case ISM_OLD_ARGV0:
290 /* "#a" */
291 p++;
292 argv0_cnt++;
293 break;
294 case 0:
295 default:
296 /* Anything besides the above is invalid. */
297 return (EINVAL);
298 }
299 }
300
301 /*
302 * Preallocate a new entry. We do this without holding the
303 * lock to avoid lock-order problems if IBF_PRE_OPEN is
304 * set.
305 */
306 ibe = imgact_binmisc_new_entry(xbe, interp_offset, argv0_cnt);
307
308 INTERP_LIST_WLOCK();
309 if (imgact_binmisc_find_entry(xbe->xbe_name) != NULL) {
310 INTERP_LIST_WUNLOCK();
311 imgact_binmisc_destroy_entry(ibe);
312 return (EEXIST);
313 }
314
315 SLIST_INSERT_HEAD(&interpreter_list, ibe, link);
316 interp_list_entry_count++;
317 INTERP_LIST_WUNLOCK();
318
319 return (0);
320 }
321
322 /*
323 * Remove the interpreter in the list with the given name. Return ENOENT
324 * if not found.
325 */
326 static int
imgact_binmisc_remove_entry(char * name)327 imgact_binmisc_remove_entry(char *name)
328 {
329 imgact_binmisc_entry_t *ibe;
330
331 INTERP_LIST_WLOCK();
332 if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
333 INTERP_LIST_WUNLOCK();
334 return (ENOENT);
335 }
336 SLIST_REMOVE(&interpreter_list, ibe, imgact_binmisc_entry, link);
337 interp_list_entry_count--;
338 INTERP_LIST_WUNLOCK();
339
340 imgact_binmisc_destroy_entry(ibe);
341
342 return (0);
343 }
344
345 /*
346 * Disable the interpreter in the list with the given name. Return ENOENT
347 * if not found.
348 */
349 static int
imgact_binmisc_disable_entry(char * name)350 imgact_binmisc_disable_entry(char *name)
351 {
352 imgact_binmisc_entry_t *ibe;
353
354 INTERP_LIST_WLOCK();
355 if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
356 INTERP_LIST_WUNLOCK();
357 return (ENOENT);
358 }
359
360 ibe->ibe_flags &= ~IBF_ENABLED;
361 INTERP_LIST_WUNLOCK();
362
363 return (0);
364 }
365
366 /*
367 * Enable the interpreter in the list with the given name. Return ENOENT
368 * if not found.
369 */
370 static int
imgact_binmisc_enable_entry(char * name)371 imgact_binmisc_enable_entry(char *name)
372 {
373 imgact_binmisc_entry_t *ibe;
374
375 INTERP_LIST_WLOCK();
376 if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
377 INTERP_LIST_WUNLOCK();
378 return (ENOENT);
379 }
380
381 ibe->ibe_flags |= IBF_ENABLED;
382 INTERP_LIST_WUNLOCK();
383
384 return (0);
385 }
386
387 static int
imgact_binmisc_populate_xbe(ximgact_binmisc_entry_t * xbe,imgact_binmisc_entry_t * ibe)388 imgact_binmisc_populate_xbe(ximgact_binmisc_entry_t *xbe,
389 imgact_binmisc_entry_t *ibe)
390 {
391 uint32_t i;
392
393 INTERP_LIST_ASSERT_LOCKED();
394 memset(xbe, 0, sizeof(*xbe));
395 strlcpy(xbe->xbe_name, ibe->ibe_name, IBE_NAME_MAX);
396
397 /* Copy interpreter string. Replace NULL breaks with space. */
398 memcpy(xbe->xbe_interpreter, ibe->ibe_interpreter,
399 ibe->ibe_interp_length);
400 for(i = 0; i < (ibe->ibe_interp_length - 1); i++)
401 if (xbe->xbe_interpreter[i] == '\0')
402 xbe->xbe_interpreter[i] = ' ';
403
404 memcpy(xbe->xbe_magic, ibe->ibe_magic, ibe->ibe_msize);
405 memcpy(xbe->xbe_mask, ibe->ibe_mask, ibe->ibe_msize);
406 xbe->xbe_version = IBE_VERSION;
407 xbe->xbe_flags = ibe->ibe_flags;
408 xbe->xbe_moffset = ibe->ibe_moffset;
409 xbe->xbe_msize = ibe->ibe_msize;
410
411 return (0);
412 }
413
414 /*
415 * Retrieve the interpreter with the give name and populate the
416 * ximgact_binmisc_entry structure. Return ENOENT if not found.
417 */
418 static int
imgact_binmisc_lookup_entry(char * name,ximgact_binmisc_entry_t * xbe)419 imgact_binmisc_lookup_entry(char *name, ximgact_binmisc_entry_t *xbe)
420 {
421 imgact_binmisc_entry_t *ibe;
422 int error = 0;
423
424 INTERP_LIST_RLOCK();
425 if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
426 INTERP_LIST_RUNLOCK();
427 return (ENOENT);
428 }
429
430 error = imgact_binmisc_populate_xbe(xbe, ibe);
431 INTERP_LIST_RUNLOCK();
432
433 return (error);
434 }
435
436 /*
437 * Get a snapshot of all the interpreter entries in the list.
438 */
439 static int
imgact_binmisc_get_all_entries(struct sysctl_req * req)440 imgact_binmisc_get_all_entries(struct sysctl_req *req)
441 {
442 ximgact_binmisc_entry_t *xbe, *xbep;
443 imgact_binmisc_entry_t *ibe;
444 int error = 0, count;
445
446 INTERP_LIST_RLOCK();
447 count = interp_list_entry_count;
448 xbe = malloc(sizeof(*xbe) * count, M_BINMISC, M_WAITOK|M_ZERO);
449
450 xbep = xbe;
451 SLIST_FOREACH(ibe, &interpreter_list, link) {
452 error = imgact_binmisc_populate_xbe(xbep++, ibe);
453 if (error)
454 break;
455 }
456 INTERP_LIST_RUNLOCK();
457
458 if (!error)
459 error = SYSCTL_OUT(req, xbe, sizeof(*xbe) * count);
460
461 free(xbe, M_BINMISC);
462 return (error);
463 }
464
465 /*
466 * sysctl() handler for munipulating interpretor table.
467 * Not MP safe (locked by sysctl).
468 */
469 static int
sysctl_kern_binmisc(SYSCTL_HANDLER_ARGS)470 sysctl_kern_binmisc(SYSCTL_HANDLER_ARGS)
471 {
472 ximgact_binmisc_entry_t xbe;
473 int error = 0;
474
475 switch(arg2) {
476 case IBC_ADD:
477 /* Add an entry. Limited to IBE_MAX_ENTRIES. */
478 error = SYSCTL_IN(req, &xbe, sizeof(xbe));
479 if (error)
480 return (error);
481 if (IBE_VERSION != xbe.xbe_version)
482 return (EINVAL);
483 if ((xbe.xbe_flags & ~IBF_VALID_UFLAGS) != 0)
484 return (EINVAL);
485 if (interp_list_entry_count == IBE_MAX_ENTRIES)
486 return (ENOSPC);
487 error = imgact_binmisc_add_entry(&xbe);
488 break;
489
490 case IBC_REMOVE:
491 /* Remove an entry. */
492 error = SYSCTL_IN(req, &xbe, sizeof(xbe));
493 if (error)
494 return (error);
495 if (IBE_VERSION != xbe.xbe_version)
496 return (EINVAL);
497 error = imgact_binmisc_remove_entry(xbe.xbe_name);
498 break;
499
500 case IBC_DISABLE:
501 /* Disable an entry. */
502 error = SYSCTL_IN(req, &xbe, sizeof(xbe));
503 if (error)
504 return (error);
505 if (IBE_VERSION != xbe.xbe_version)
506 return (EINVAL);
507 error = imgact_binmisc_disable_entry(xbe.xbe_name);
508 break;
509
510 case IBC_ENABLE:
511 /* Enable an entry. */
512 error = SYSCTL_IN(req, &xbe, sizeof(xbe));
513 if (error)
514 return (error);
515 if (IBE_VERSION != xbe.xbe_version)
516 return (EINVAL);
517 error = imgact_binmisc_enable_entry(xbe.xbe_name);
518 break;
519
520 case IBC_LOOKUP:
521 /* Lookup an entry. */
522 error = SYSCTL_IN(req, &xbe, sizeof(xbe));
523 if (error)
524 return (error);
525 if (IBE_VERSION != xbe.xbe_version)
526 return (EINVAL);
527 error = imgact_binmisc_lookup_entry(xbe.xbe_name, &xbe);
528 if (!error)
529 error = SYSCTL_OUT(req, &xbe, sizeof(xbe));
530 break;
531
532 case IBC_LIST:
533 /* Return a snapshot of the interpretor list. */
534
535 if (!req->oldptr) {
536 /* No pointer then just return the list size. */
537 error = SYSCTL_OUT(req, 0, interp_list_entry_count *
538 sizeof(ximgact_binmisc_entry_t));
539 return (error);
540 } else
541 if (!req->oldlen)
542 return (EINVAL);
543
544 error = imgact_binmisc_get_all_entries(req);
545 break;
546
547 default:
548 return (EINVAL);
549 }
550
551 return (error);
552 }
553
554 SYSCTL_NODE(_kern, OID_AUTO, binmisc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
555 "Image activator for miscellaneous binaries");
556
557 SYSCTL_PROC(_kern_binmisc, OID_AUTO, add,
558 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_ADD,
559 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
560 "Add an activator entry");
561
562 SYSCTL_PROC(_kern_binmisc, OID_AUTO, remove,
563 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_REMOVE,
564 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
565 "Remove an activator entry");
566
567 SYSCTL_PROC(_kern_binmisc, OID_AUTO, disable,
568 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_DISABLE,
569 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
570 "Disable an activator entry");
571
572 SYSCTL_PROC(_kern_binmisc, OID_AUTO, enable,
573 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_ENABLE,
574 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
575 "Enable an activator entry");
576
577 SYSCTL_PROC(_kern_binmisc, OID_AUTO, lookup,
578 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_RW|CTLFLAG_ANYBODY, NULL, IBC_LOOKUP,
579 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
580 "Lookup an activator entry");
581
582 SYSCTL_PROC(_kern_binmisc, OID_AUTO, list,
583 CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_RD|CTLFLAG_ANYBODY, NULL, IBC_LIST,
584 sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
585 "Get snapshot of all the activator entries");
586
587 static imgact_binmisc_entry_t *
imgact_binmisc_find_interpreter(const char * image_header)588 imgact_binmisc_find_interpreter(const char *image_header)
589 {
590 imgact_binmisc_entry_t *ibe;
591 const char *p;
592 int i;
593 size_t sz;
594
595 INTERP_LIST_ASSERT_LOCKED();
596
597 SLIST_FOREACH(ibe, &interpreter_list, link) {
598 if (!(IBF_ENABLED & ibe->ibe_flags))
599 continue;
600
601 p = image_header + ibe->ibe_moffset;
602 sz = ibe->ibe_msize;
603 if (IBF_USE_MASK & ibe->ibe_flags) {
604 /* Compare using mask. */
605 for (i = 0; i < sz; i++)
606 if ((*p++ ^ ibe->ibe_magic[i]) &
607 ibe->ibe_mask[i])
608 break;
609 } else {
610 for (i = 0; i < sz; i++)
611 if (*p++ ^ ibe->ibe_magic[i])
612 break;
613 }
614 if (i == ibe->ibe_msize)
615 return (ibe);
616 }
617 return (NULL);
618 }
619
620 static int
imgact_binmisc_exec(struct image_params * imgp)621 imgact_binmisc_exec(struct image_params *imgp)
622 {
623 const char *image_header = imgp->image_header;
624 const char *fname = NULL;
625 int error = 0;
626 #ifdef INVARIANTS
627 int argv0_cnt = 0;
628 #endif
629 size_t namelen, offset;
630 imgact_binmisc_entry_t *ibe;
631 struct sbuf *sname;
632 char *s, *d;
633
634 sname = NULL;
635 namelen = 0;
636 /* Do we have an interpreter for the given image header? */
637 INTERP_LIST_RLOCK();
638 if ((ibe = imgact_binmisc_find_interpreter(image_header)) == NULL) {
639 error = -1;
640 goto done;
641 }
642
643 /* No interpreter nesting allowed. */
644 if (imgp->interpreted & IMGACT_BINMISC) {
645 error = ENOEXEC;
646 goto done;
647 }
648
649 imgp->interpreted |= IMGACT_BINMISC;
650
651 /*
652 * Don't bother with the overhead of putting fname together if we're not
653 * using #a.
654 */
655 if (ibe->ibe_argv0_cnt != 0) {
656 if (imgp->args->fname != NULL) {
657 fname = imgp->args->fname;
658 } else {
659 /* Use the fdescfs(4) path for fexecve(2). */
660 sname = sbuf_new_auto();
661 sbuf_printf(sname, "/dev/fd/%d", imgp->args->fd);
662 sbuf_finish(sname);
663 fname = sbuf_data(sname);
664 }
665
666 namelen = strlen(fname);
667 }
668
669 /*
670 * We need to "push" the interpreter in the arg[] list. To do this,
671 * we first shift all the other values in the `begin_argv' area to
672 * provide the exact amount of room for the values added. Set up
673 * `offset' as the number of bytes to be added to the `begin_argv'
674 * area. ibe_interp_offset is the fixed offset from macros present in
675 * the interpreter string.
676 */
677 offset = ibe->ibe_interp_length + ibe->ibe_interp_offset;
678
679 /* Variable offset to be added from macros to the interpreter string. */
680 MPASS(ibe->ibe_argv0_cnt == 0 || namelen > 0);
681 offset += ibe->ibe_argv0_cnt * (namelen - 2);
682
683 /* Make room for the interpreter */
684 error = exec_args_adjust_args(imgp->args, 0, offset);
685 if (error != 0) {
686 goto done;
687 }
688
689 /* Add the new argument(s) in the count. */
690 imgp->args->argc += ibe->ibe_interp_argcnt;
691
692 /*
693 * The original arg[] list has been shifted appropriately. Copy in
694 * the interpreter path.
695 */
696 s = ibe->ibe_interpreter;
697 d = imgp->args->begin_argv;
698 while(*s != '\0') {
699 switch (*s) {
700 case '#':
701 /* Handle "#" in interpreter string. */
702 s++;
703 switch(*s) {
704 case ISM_POUND:
705 /* "##": Replace with a single '#' */
706 *d++ = '#';
707 break;
708 case ISM_OLD_ARGV0:
709 /* "#a": Replace with old arg0 (fname). */
710 MPASS(ibe->ibe_argv0_cnt >= ++argv0_cnt);
711 memcpy(d, fname, namelen);
712 d += namelen;
713 break;
714 default:
715 __assert_unreachable();
716 }
717 break;
718 case ' ':
719 /* Replace space with NUL to separate arguments. */
720 *d++ = '\0';
721 break;
722 default:
723 *d++ = *s;
724 break;
725 }
726 s++;
727 }
728 *d = '\0';
729
730 /* Catch ibe->ibe_argv0_cnt counting more #a than we did. */
731 MPASS(ibe->ibe_argv0_cnt == argv0_cnt);
732 imgp->interpreter_name = imgp->args->begin_argv;
733 if (ibe->ibe_interpreter_vnode) {
734 imgp->interpreter_vp = ibe->ibe_interpreter_vnode;
735 vref(imgp->interpreter_vp);
736 }
737
738 done:
739 INTERP_LIST_RUNLOCK();
740 if (sname)
741 sbuf_delete(sname);
742 return (error);
743 }
744
745 static void
imgact_binmisc_init(void * arg)746 imgact_binmisc_init(void *arg)
747 {
748
749 INTERP_LIST_LOCK_INIT();
750 }
751
752 static void
imgact_binmisc_fini(void * arg)753 imgact_binmisc_fini(void *arg)
754 {
755 imgact_binmisc_entry_t *ibe, *ibe_tmp;
756
757 /* Free all the interpreters. */
758 INTERP_LIST_WLOCK();
759 SLIST_FOREACH_SAFE(ibe, &interpreter_list, link, ibe_tmp) {
760 SLIST_REMOVE(&interpreter_list, ibe, imgact_binmisc_entry,
761 link);
762 imgact_binmisc_destroy_entry(ibe);
763 }
764 INTERP_LIST_WUNLOCK();
765
766 INTERP_LIST_LOCK_DESTROY();
767 }
768
769 SYSINIT(imgact_binmisc, SI_SUB_EXEC, SI_ORDER_MIDDLE, imgact_binmisc_init,
770 NULL);
771 SYSUNINIT(imgact_binmisc, SI_SUB_EXEC, SI_ORDER_MIDDLE, imgact_binmisc_fini,
772 NULL);
773
774 /*
775 * Tell kern_execve.c about it, with a little help from the linker.
776 */
777 static struct execsw imgact_binmisc_execsw = {
778 .ex_imgact = imgact_binmisc_exec,
779 .ex_name = KMOD_NAME
780 };
781 EXEC_SET(imgact_binmisc, imgact_binmisc_execsw);
782