xref: /freebsd/sys/kern/imgact_binmisc.c (revision a0ee8cc636cd5c2374ec44ca71226564ea0bca95)
1 /*-
2  * Copyright (c) 2013-15, Stacey D. Son
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/ctype.h>
32 #include <sys/sbuf.h>
33 #include <sys/systm.h>
34 #include <sys/sysproto.h>
35 #include <sys/exec.h>
36 #include <sys/imgact.h>
37 #include <sys/imgact_binmisc.h>
38 #include <sys/kernel.h>
39 #include <sys/libkern.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mutex.h>
43 #include <sys/sysctl.h>
44 #include <sys/sx.h>
45 
46 #include <machine/atomic.h>
47 
48 /**
49  * Miscellaneous binary interpreter image activator.
50  *
51  * If the given target executable's header matches 'xbe_magic' field in the
52  * 'interpreter_list' then it will use the user-level interpreter specified in
53  * the 'xbe_interpreter' field to execute the binary. The 'xbe_magic' field may
54  * be adjusted to a given offset using the value in the 'xbe_moffset' field
55  * and bits of the header may be masked using the 'xbe_mask' field.  The
56  * 'interpreter_list' entries are managed using sysctl(3) as described in the
57  * <sys/imgact_binmisc.h> file.
58  */
59 
60 /*
61  * Node of the interpreter list.
62  */
63 typedef struct imgact_binmisc_entry {
64 	char				 *ibe_name;
65 	uint8_t				 *ibe_magic;
66 	uint32_t			  ibe_moffset;
67 	uint32_t			  ibe_msize;
68 	uint8_t				 *ibe_mask;
69 	uint8_t				 *ibe_interpreter;
70 	uint32_t			  ibe_interp_argcnt;
71 	uint32_t			  ibe_interp_length;
72 	uint32_t			  ibe_flags;
73 	SLIST_ENTRY(imgact_binmisc_entry) link;
74 } imgact_binmisc_entry_t;
75 
76 /*
77  * sysctl() commands.
78  */
79 #define IBC_ADD		1	/* Add given entry. */
80 #define IBC_REMOVE	2	/* Remove entry for a given name. */
81 #define IBC_DISABLE	3	/* Disable entry for a given name. */
82 #define IBC_ENABLE	4	/* Enable entry for a given name. */
83 #define IBC_LOOKUP	5	/* Lookup and return entry for given name. */
84 #define IBC_LIST	6	/* Get a snapshot of the interpretor list. */
85 
86 /*
87  * Interpreter string macros.
88  *
89  * They all start with '#' followed by a single letter:
90  */
91 #define	ISM_POUND	'#'	/* "##" is the escape sequence for single #. */
92 #define	ISM_OLD_ARGV0	'a'	/* "#a" is replaced with the old argv0. */
93 
94 MALLOC_DEFINE(M_BINMISC, KMOD_NAME, "misc binary image activator");
95 
96 /* The interpreter list. */
97 static SLIST_HEAD(, imgact_binmisc_entry) interpreter_list =
98 	SLIST_HEAD_INITIALIZER(interpreter_list);
99 
100 static int interp_list_entry_count = 0;
101 
102 static struct sx interp_list_sx;
103 
104 /*
105  * Populate the entry with the information about the interpreter.
106  */
107 static void
108 imgact_binmisc_populate_interp(char *str, imgact_binmisc_entry_t *ibe)
109 {
110 	uint32_t len = 0, argc = 1;
111 	char t[IBE_INTERP_LEN_MAX];
112 	char *sp, *tp;
113 
114 	memset(t, 0, sizeof(t));
115 
116 	/*
117 	 * Normalize interpreter string. Replace white space between args with
118 	 * single space.
119 	 */
120 	sp = str; tp = t;
121 	while (*sp != '\0') {
122 		if (*sp == ' ' || *sp == '\t') {
123 			if (++len > IBE_INTERP_LEN_MAX)
124 				break;
125 			*tp++ = ' ';
126 			argc++;
127 			while (*sp == ' ' || *sp == '\t')
128 				sp++;
129 			continue;
130 		} else {
131 			*tp++ = *sp++;
132 			len++;
133 		}
134 	}
135 	*tp = '\0';
136 	len++;
137 
138 	ibe->ibe_interpreter = malloc(len, M_BINMISC, M_WAITOK|M_ZERO);
139 
140 	/* Populate all the ibe fields for the interpreter. */
141 	memcpy(ibe->ibe_interpreter, t, len);
142 	ibe->ibe_interp_argcnt = argc;
143 	ibe->ibe_interp_length = len;
144 }
145 
146 /*
147  * Allocate memory and populate a new entry for the interpreter table.
148  */
149 static imgact_binmisc_entry_t *
150 imgact_binmisc_new_entry(ximgact_binmisc_entry_t *xbe)
151 {
152 	imgact_binmisc_entry_t *ibe = NULL;
153 	size_t namesz = min(strlen(xbe->xbe_name) + 1, IBE_NAME_MAX);
154 
155 	ibe = malloc(sizeof(*ibe), M_BINMISC, M_WAITOK|M_ZERO);
156 
157 	ibe->ibe_name = malloc(namesz, M_BINMISC, M_WAITOK|M_ZERO);
158 	strlcpy(ibe->ibe_name, xbe->xbe_name, namesz);
159 
160 	imgact_binmisc_populate_interp(xbe->xbe_interpreter, ibe);
161 
162 	ibe->ibe_magic = malloc(xbe->xbe_msize, M_BINMISC, M_WAITOK|M_ZERO);
163 	memcpy(ibe->ibe_magic, xbe->xbe_magic, xbe->xbe_msize);
164 
165 	ibe->ibe_mask = malloc(xbe->xbe_msize, M_BINMISC, M_WAITOK|M_ZERO);
166 	memcpy(ibe->ibe_mask, xbe->xbe_mask, xbe->xbe_msize);
167 
168 	ibe->ibe_moffset = xbe->xbe_moffset;
169 	ibe->ibe_msize = xbe->xbe_msize;
170 	ibe->ibe_flags = xbe->xbe_flags;
171 
172 	return (ibe);
173 }
174 
175 /*
176  * Free the allocated memory for a given list item.
177  */
178 static void
179 imgact_binmisc_destroy_entry(imgact_binmisc_entry_t *ibe)
180 {
181 	if (!ibe)
182 		return;
183 	if (ibe->ibe_magic)
184 		free(ibe->ibe_magic, M_BINMISC);
185 	if (ibe->ibe_mask)
186 		free(ibe->ibe_mask, M_BINMISC);
187 	if (ibe->ibe_interpreter)
188 		free(ibe->ibe_interpreter, M_BINMISC);
189 	if (ibe->ibe_name)
190 		free(ibe->ibe_name, M_BINMISC);
191 	if (ibe)
192 		free(ibe, M_BINMISC);
193 }
194 
195 /*
196  * Find the interpreter in the list by the given name.  Return NULL if not
197  * found.
198  */
199 static imgact_binmisc_entry_t *
200 imgact_binmisc_find_entry(char *name)
201 {
202 	imgact_binmisc_entry_t *ibe;
203 
204 	sx_assert(&interp_list_sx, SA_LOCKED);
205 
206 	SLIST_FOREACH(ibe, &interpreter_list, link) {
207 		if (strncmp(name, ibe->ibe_name, IBE_NAME_MAX) == 0)
208 			return (ibe);
209 	}
210 
211 	return (NULL);
212 }
213 
214 /*
215  * Add the given interpreter if it doesn't already exist.  Return EEXIST
216  * if the name already exist in the interpreter list.
217  */
218 static int
219 imgact_binmisc_add_entry(ximgact_binmisc_entry_t *xbe)
220 {
221 	imgact_binmisc_entry_t *ibe;
222 	char *p;
223 
224 	if (xbe->xbe_msize > IBE_MAGIC_MAX)
225 		return (EINVAL);
226 
227 	for(p = xbe->xbe_name; *p != 0; p++)
228 		if (!isascii((int)*p))
229 			return (EINVAL);
230 
231 	for(p = xbe->xbe_interpreter; *p != 0; p++)
232 		if (!isascii((int)*p))
233 			return (EINVAL);
234 
235 	/* Make sure we don't have any invalid #'s. */
236 	p = xbe->xbe_interpreter;
237 	while (1) {
238 		p = strchr(p, '#');
239 		if (!p)
240 			break;
241 
242 		p++;
243 		switch(*p) {
244 		case ISM_POUND:
245 			/* "##" */
246 			p++;
247 			break;
248 
249 		case ISM_OLD_ARGV0:
250 			/* "#a" */
251 			p++;
252 			break;
253 
254 		case 0:
255 		default:
256 			/* Anything besides the above is invalid. */
257 			return (EINVAL);
258 		}
259 	}
260 
261 	sx_xlock(&interp_list_sx);
262 	if (imgact_binmisc_find_entry(xbe->xbe_name) != NULL) {
263 		sx_xunlock(&interp_list_sx);
264 		return (EEXIST);
265 	}
266 
267 	/* Preallocate a new entry. */
268 	ibe = imgact_binmisc_new_entry(xbe);
269 	if (!ibe)
270 		return (ENOMEM);
271 
272 	SLIST_INSERT_HEAD(&interpreter_list, ibe, link);
273 	interp_list_entry_count++;
274 	sx_xunlock(&interp_list_sx);
275 
276 	return (0);
277 }
278 
279 /*
280  * Remove the interpreter in the list with the given name. Return ENOENT
281  * if not found.
282  */
283 static int
284 imgact_binmisc_remove_entry(char *name)
285 {
286 	imgact_binmisc_entry_t *ibe;
287 
288 	sx_xlock(&interp_list_sx);
289 	if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
290 		sx_xunlock(&interp_list_sx);
291 		return (ENOENT);
292 	}
293 	SLIST_REMOVE(&interpreter_list, ibe, imgact_binmisc_entry, link);
294 	interp_list_entry_count--;
295 	sx_xunlock(&interp_list_sx);
296 
297 	imgact_binmisc_destroy_entry(ibe);
298 
299 	return (0);
300 }
301 
302 /*
303  * Disable the interpreter in the list with the given name. Return ENOENT
304  * if not found.
305  */
306 static int
307 imgact_binmisc_disable_entry(char *name)
308 {
309 	imgact_binmisc_entry_t *ibe;
310 
311 	sx_xlock(&interp_list_sx);
312 	if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
313 		sx_xunlock(&interp_list_sx);
314 		return (ENOENT);
315 	}
316 
317 	ibe->ibe_flags &= ~IBF_ENABLED;
318 	sx_xunlock(&interp_list_sx);
319 
320 	return (0);
321 }
322 
323 /*
324  * Enable the interpreter in the list with the given name. Return ENOENT
325  * if not found.
326  */
327 static int
328 imgact_binmisc_enable_entry(char *name)
329 {
330 	imgact_binmisc_entry_t *ibe;
331 
332 	sx_xlock(&interp_list_sx);
333 	if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
334 		sx_xunlock(&interp_list_sx);
335 		return (ENOENT);
336 	}
337 
338 	ibe->ibe_flags |= IBF_ENABLED;
339 	sx_xunlock(&interp_list_sx);
340 
341 	return (0);
342 }
343 
344 static int
345 imgact_binmisc_populate_xbe(ximgact_binmisc_entry_t *xbe,
346     imgact_binmisc_entry_t *ibe)
347 {
348 	uint32_t i;
349 
350 	sx_assert(&interp_list_sx, SA_LOCKED);
351 
352 	memset(xbe, 0, sizeof(*xbe));
353 	strlcpy(xbe->xbe_name, ibe->ibe_name, IBE_NAME_MAX);
354 
355 	/* Copy interpreter string.  Replace NULL breaks with space. */
356 	memcpy(xbe->xbe_interpreter, ibe->ibe_interpreter,
357 	    ibe->ibe_interp_length);
358 	for(i = 0; i < (ibe->ibe_interp_length - 1); i++)
359 		if (xbe->xbe_interpreter[i] == '\0')
360 			xbe->xbe_interpreter[i] = ' ';
361 
362 	memcpy(xbe->xbe_magic, ibe->ibe_magic, ibe->ibe_msize);
363 	memcpy(xbe->xbe_mask, ibe->ibe_mask, ibe->ibe_msize);
364 	xbe->xbe_version = IBE_VERSION;
365 	xbe->xbe_flags = ibe->ibe_flags;
366 	xbe->xbe_moffset = ibe->ibe_moffset;
367 	xbe->xbe_msize = ibe->ibe_msize;
368 
369 	return (0);
370 }
371 
372 /*
373  * Retrieve the interpreter with the give name and populate the
374  * ximgact_binmisc_entry structure.  Return ENOENT if not found.
375  */
376 static int
377 imgact_binmisc_lookup_entry(char *name, ximgact_binmisc_entry_t *xbe)
378 {
379 	imgact_binmisc_entry_t *ibe;
380 	int error = 0;
381 
382 	sx_slock(&interp_list_sx);
383 	if ((ibe = imgact_binmisc_find_entry(name)) == NULL) {
384 		sx_sunlock(&interp_list_sx);
385 		return (ENOENT);
386 	}
387 
388 	error = imgact_binmisc_populate_xbe(xbe, ibe);
389 	sx_sunlock(&interp_list_sx);
390 
391 	return (error);
392 }
393 
394 /*
395  * Get a snapshot of all the interpreter entries in the list.
396  */
397 static int
398 imgact_binmisc_get_all_entries(struct sysctl_req *req)
399 {
400 	ximgact_binmisc_entry_t *xbe, *xbep;
401 	imgact_binmisc_entry_t *ibe;
402 	int error = 0, count;
403 
404 	sx_slock(&interp_list_sx);
405 	count = interp_list_entry_count;
406 	xbe = malloc(sizeof(*xbe) * count, M_BINMISC, M_WAITOK|M_ZERO);
407 
408 	xbep = xbe;
409 	SLIST_FOREACH(ibe, &interpreter_list, link) {
410 		error = imgact_binmisc_populate_xbe(xbep++, ibe);
411 		if (error)
412 			break;
413 	}
414 	sx_sunlock(&interp_list_sx);
415 
416 	if (!error)
417 		error = SYSCTL_OUT(req, xbe, sizeof(*xbe) * count);
418 
419 	free(xbe, M_BINMISC);
420 	return (error);
421 }
422 
423 /*
424  * sysctl() handler for munipulating interpretor table.
425  * Not MP safe (locked by sysctl).
426  */
427 static int
428 sysctl_kern_binmisc(SYSCTL_HANDLER_ARGS)
429 {
430 	ximgact_binmisc_entry_t xbe;
431 	int error = 0;
432 
433 	switch(arg2) {
434 	case IBC_ADD:
435 		/* Add an entry. Limited to IBE_MAX_ENTRIES. */
436 		error = SYSCTL_IN(req, &xbe, sizeof(xbe));
437 		if (error)
438 			return (error);
439 		if (IBE_VERSION != xbe.xbe_version)
440 			return (EINVAL);
441 		if (interp_list_entry_count == IBE_MAX_ENTRIES)
442 			return (ENOSPC);
443 		error = imgact_binmisc_add_entry(&xbe);
444 		break;
445 
446 	case IBC_REMOVE:
447 		/* Remove an entry. */
448 		error = SYSCTL_IN(req, &xbe, sizeof(xbe));
449 		if (error)
450 			return (error);
451 		if (IBE_VERSION != xbe.xbe_version)
452 			return (EINVAL);
453 		error = imgact_binmisc_remove_entry(xbe.xbe_name);
454 		break;
455 
456 	case IBC_DISABLE:
457 		/* Disable an entry. */
458 		error = SYSCTL_IN(req, &xbe, sizeof(xbe));
459 		if (error)
460 			return (error);
461 		if (IBE_VERSION != xbe.xbe_version)
462 			return (EINVAL);
463 		error = imgact_binmisc_disable_entry(xbe.xbe_name);
464 		break;
465 
466 	case IBC_ENABLE:
467 		/* Enable an entry. */
468 		error = SYSCTL_IN(req, &xbe, sizeof(xbe));
469 		if (error)
470 			return (error);
471 		if (IBE_VERSION != xbe.xbe_version)
472 			return (EINVAL);
473 		error = imgact_binmisc_enable_entry(xbe.xbe_name);
474 		break;
475 
476 	case IBC_LOOKUP:
477 		/* Lookup an entry. */
478 		error = SYSCTL_IN(req, &xbe, sizeof(xbe));
479 		if (error)
480 			return (error);
481 		if (IBE_VERSION != xbe.xbe_version)
482 			return (EINVAL);
483 		error = imgact_binmisc_lookup_entry(xbe.xbe_name, &xbe);
484 		if (!error)
485 			error = SYSCTL_OUT(req, &xbe, sizeof(xbe));
486 		break;
487 
488 	case IBC_LIST:
489 		/* Return a snapshot of the interpretor list. */
490 
491 		if (!req->oldptr) {
492 			/* No pointer then just return the list size. */
493 			error = SYSCTL_OUT(req, 0, interp_list_entry_count *
494 			    sizeof(ximgact_binmisc_entry_t));
495 			return (error);
496 		} else
497 			if (!req->oldlen)
498 				return (EINVAL);
499 
500 		error = imgact_binmisc_get_all_entries(req);
501 		break;
502 
503 	default:
504 		return (EINVAL);
505 	}
506 
507 	return (error);
508 }
509 
510 SYSCTL_NODE(_kern, OID_AUTO, binmisc, CTLFLAG_RW, 0,
511     "Image activator for miscellaneous binaries");
512 
513 SYSCTL_PROC(_kern_binmisc, OID_AUTO, add,
514     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_ADD,
515     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
516     "Add an activator entry");
517 
518 SYSCTL_PROC(_kern_binmisc, OID_AUTO, remove,
519     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_REMOVE,
520     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
521     "Remove an activator entry");
522 
523 SYSCTL_PROC(_kern_binmisc, OID_AUTO, disable,
524     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_DISABLE,
525     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
526     "Disable an activator entry");
527 
528 SYSCTL_PROC(_kern_binmisc, OID_AUTO, enable,
529     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_WR, NULL, IBC_ENABLE,
530     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
531     "Enable an activator entry");
532 
533 SYSCTL_PROC(_kern_binmisc, OID_AUTO, lookup,
534     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_RW|CTLFLAG_ANYBODY, NULL, IBC_LOOKUP,
535     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
536     "Lookup an activator entry");
537 
538 SYSCTL_PROC(_kern_binmisc, OID_AUTO, list,
539     CTLFLAG_MPSAFE|CTLTYPE_STRUCT|CTLFLAG_RD|CTLFLAG_ANYBODY, NULL, IBC_LIST,
540     sysctl_kern_binmisc, "S,ximgact_binmisc_entry",
541     "Get snapshot of all the activator entries");
542 
543 static imgact_binmisc_entry_t *
544 imgact_binmisc_find_interpreter(const char *image_header)
545 {
546 	imgact_binmisc_entry_t *ibe;
547 	const char *p;
548 	int i;
549 	size_t sz;
550 
551 	sx_assert(&interp_list_sx, SA_LOCKED);
552 
553 	SLIST_FOREACH(ibe, &interpreter_list, link) {
554 		if (!(IBF_ENABLED & ibe->ibe_flags))
555 			continue;
556 
557 		p = image_header + ibe->ibe_moffset;
558 		sz = ibe->ibe_msize;
559 		if (IBF_USE_MASK & ibe->ibe_flags) {
560 			/* Compare using mask. */
561 			for (i = 0; i < sz; i++)
562 				if ((*p++ ^ ibe->ibe_magic[i]) &
563 				    ibe->ibe_mask[i])
564 					break;
565 		} else {
566 			for (i = 0; i < sz; i++)
567 				if (*p++ ^ ibe->ibe_magic[i])
568 					break;
569 		}
570 		if (i == ibe->ibe_msize)
571 			return (ibe);
572 	}
573 	return (NULL);
574 }
575 
576 static int
577 imgact_binmisc_exec(struct image_params *imgp)
578 {
579 	const char *image_header = imgp->image_header;
580 	const char *fname = NULL;
581 	int error = 0;
582 	size_t offset, l;
583 	imgact_binmisc_entry_t *ibe;
584 	struct sbuf *sname;
585 	char *s, *d;
586 
587 	/* Do we have an interpreter for the given image header? */
588 	sx_slock(&interp_list_sx);
589 	if ((ibe = imgact_binmisc_find_interpreter(image_header)) == NULL) {
590 		sx_sunlock(&interp_list_sx);
591 		return (-1);
592 	}
593 
594 	/* No interpreter nesting allowed. */
595 	if (imgp->interpreted & IMGACT_BINMISC) {
596 		sx_sunlock(&interp_list_sx);
597 		return (ENOEXEC);
598 	}
599 
600 	imgp->interpreted |= IMGACT_BINMISC;
601 
602 	if (imgp->args->fname != NULL) {
603 		fname = imgp->args->fname;
604 		sname = NULL;
605 	} else {
606 		/* Use the fdescfs(5) path for fexecve(2). */
607 		sname = sbuf_new_auto();
608 		sbuf_printf(sname, "/dev/fd/%d", imgp->args->fd);
609 		sbuf_finish(sname);
610 		fname = sbuf_data(sname);
611 	}
612 
613 
614 	/*
615 	 * We need to "push" the interpreter in the arg[] list.  To do this,
616 	 * we first shift all the other values in the `begin_argv' area to
617 	 * provide the exact amount of room for the values added.  Set up
618 	 * `offset' as the number of bytes to be added to the `begin_argv'
619 	 * area.
620 	 */
621 	offset = ibe->ibe_interp_length;
622 
623 	/* Adjust the offset for #'s. */
624 	s = ibe->ibe_interpreter;
625 	while (1) {
626 		s = strchr(s, '#');
627 		if (!s)
628 			break;
629 
630 		s++;
631 		switch(*s) {
632 		case ISM_POUND:
633 			/* "##" -> "#": reduce offset by one. */
634 			offset--;
635 			break;
636 
637 		case ISM_OLD_ARGV0:
638 			/* "#a" -> (old argv0): increase offset to fit fname */
639 			offset += strlen(fname) - 2;
640 			break;
641 
642 		default:
643 			/* Hmm... This shouldn't happen. */
644 			sx_sunlock(&interp_list_sx);
645 			printf("%s: Unknown macro #%c sequence in "
646 			    "interpreter string\n", KMOD_NAME, *(s + 1));
647 			error = EINVAL;
648 			goto done;
649 		}
650 		s++;
651 	}
652 
653 	/* Check to make sure we won't overrun the stringspace. */
654 	if (offset > imgp->args->stringspace) {
655 		sx_sunlock(&interp_list_sx);
656 		error = E2BIG;
657 		goto done;
658 	}
659 
660 	/* Make room for the interpreter */
661 	bcopy(imgp->args->begin_argv, imgp->args->begin_argv + offset,
662 	    imgp->args->endp - imgp->args->begin_argv);
663 
664 	/* Adjust everything by the offset. */
665 	imgp->args->begin_envv += offset;
666 	imgp->args->endp += offset;
667 	imgp->args->stringspace -= offset;
668 
669 	/* Add the new argument(s) in the count. */
670 	imgp->args->argc += ibe->ibe_interp_argcnt;
671 
672 	/*
673 	 * The original arg[] list has been shifted appropriately.  Copy in
674 	 * the interpreter path.
675 	 */
676 	s = ibe->ibe_interpreter;
677 	d = imgp->args->begin_argv;
678 	while(*s != '\0') {
679 		switch (*s) {
680 		case '#':
681 			/* Handle "#" in interpreter string. */
682 			s++;
683 			switch(*s) {
684 			case ISM_POUND:
685 				/* "##": Replace with a single '#' */
686 				*d++ = '#';
687 				break;
688 
689 			case ISM_OLD_ARGV0:
690 				/* "#a": Replace with old arg0 (fname). */
691 				if ((l = strlen(fname)) != 0) {
692 					memcpy(d, fname, l);
693 					d += l;
694 				}
695 				break;
696 
697 			default:
698 				/* Shouldn't happen but skip it if it does. */
699 				break;
700 			}
701 			break;
702 
703 		case ' ':
704 			/* Replace space with NUL to seperate arguments. */
705 			*d++ = '\0';
706 			break;
707 
708 		default:
709 			*d++ = *s;
710 			break;
711 		}
712 		s++;
713 	}
714 	*d = '\0';
715 	sx_sunlock(&interp_list_sx);
716 
717 	if (!error)
718 		imgp->interpreter_name = imgp->args->begin_argv;
719 
720 
721 done:
722 	if (sname)
723 		sbuf_delete(sname);
724 	return (error);
725 }
726 
727 static void
728 imgact_binmisc_init(void *arg)
729 {
730 
731 	sx_init(&interp_list_sx, KMOD_NAME);
732 }
733 
734 static void
735 imgact_binmisc_fini(void *arg)
736 {
737 	imgact_binmisc_entry_t *ibe, *ibe_tmp;
738 
739 	/* Free all the interpreters. */
740 	sx_xlock(&interp_list_sx);
741 	SLIST_FOREACH_SAFE(ibe, &interpreter_list, link, ibe_tmp) {
742 		SLIST_REMOVE(&interpreter_list, ibe, imgact_binmisc_entry,
743 		    link);
744 		imgact_binmisc_destroy_entry(ibe);
745 	}
746 	sx_xunlock(&interp_list_sx);
747 
748 	sx_destroy(&interp_list_sx);
749 }
750 
751 SYSINIT(imgact_binmisc, SI_SUB_EXEC, SI_ORDER_MIDDLE, imgact_binmisc_init, 0);
752 SYSUNINIT(imgact_binmisc, SI_SUB_EXEC, SI_ORDER_MIDDLE, imgact_binmisc_fini, 0);
753 
754 /*
755  * Tell kern_execve.c about it, with a little help from the linker.
756  */
757 static struct execsw imgact_binmisc_execsw = { imgact_binmisc_exec, KMOD_NAME };
758 EXEC_SET(imgact_binmisc, imgact_binmisc_execsw);
759