126f9a767SRodney W. Grimes /* 226f9a767SRodney W. Grimes * Copyright (c) 1993, David Greenman 326f9a767SRodney W. Grimes * All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 1426f9a767SRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1726f9a767SRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24df8bae1dSRodney W. Grimes * SUCH DAMAGE. 25df8bae1dSRodney W. Grimes * 26c3aac50fSPeter Wemm * $FreeBSD$ 27df8bae1dSRodney W. Grimes */ 28df8bae1dSRodney W. Grimes 291e9b3d91SPeter Wemm #include "opt_ktrace.h" 30339b79b9SRobert Watson #include "opt_mac.h" 311e9b3d91SPeter Wemm 32df8bae1dSRodney W. Grimes #include <sys/param.h> 3326f9a767SRodney W. Grimes #include <sys/systm.h> 34fb919e4dSMark Murray #include <sys/lock.h> 35fb919e4dSMark Murray #include <sys/mutex.h> 36d2d3e875SBruce Evans #include <sys/sysproto.h> 3726f9a767SRodney W. Grimes #include <sys/signalvar.h> 3826f9a767SRodney W. Grimes #include <sys/kernel.h> 39339b79b9SRobert Watson #include <sys/mac.h> 4026f9a767SRodney W. Grimes #include <sys/mount.h> 41797f2d22SPoul-Henning Kamp #include <sys/filedesc.h> 42079cc25bSDavid Greenman #include <sys/fcntl.h> 4326f9a767SRodney W. Grimes #include <sys/acct.h> 4426f9a767SRodney W. Grimes #include <sys/exec.h> 4526f9a767SRodney W. Grimes #include <sys/imgact.h> 46e1743d02SSøren Schmidt #include <sys/imgact_elf.h> 4726f9a767SRodney W. Grimes #include <sys/wait.h> 48333ea485SGuido van Rooij #include <sys/malloc.h> 49a794e791SBruce Evans #include <sys/proc.h> 502a024a2bSSean Eric Fagan #include <sys/pioctl.h> 51a794e791SBruce Evans #include <sys/namei.h> 521e1e0b44SSøren Schmidt #include <sys/sysent.h> 53797f2d22SPoul-Henning Kamp #include <sys/shm.h> 5499ac3bc8SPeter Wemm #include <sys/sysctl.h> 55333ea485SGuido van Rooij #include <sys/user.h> 56a794e791SBruce Evans #include <sys/vnode.h> 57c781aea8SPeter Wemm #ifdef KTRACE 58c781aea8SPeter Wemm #include <sys/ktrace.h> 59c781aea8SPeter Wemm #endif 6026f9a767SRodney W. Grimes 6126f9a767SRodney W. Grimes #include <vm/vm.h> 62efeaf95aSDavid Greenman #include <vm/vm_param.h> 63efeaf95aSDavid Greenman #include <vm/pmap.h> 641616db3cSJohn Dyson #include <vm/vm_page.h> 65efeaf95aSDavid Greenman #include <vm/vm_map.h> 6626f9a767SRodney W. Grimes #include <vm/vm_kern.h> 67efeaf95aSDavid Greenman #include <vm/vm_extern.h> 681ebd0c59SDavid Greenman #include <vm/vm_object.h> 691616db3cSJohn Dyson #include <vm/vm_pager.h> 7026f9a767SRodney W. Grimes 7126f9a767SRodney W. Grimes #include <machine/reg.h> 7226f9a767SRodney W. Grimes 73b9df5231SPoul-Henning Kamp MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments"); 74b9df5231SPoul-Henning Kamp 7521d56e9cSAlfred Perlstein static MALLOC_DEFINE(M_ATEXEC, "atexec", "atexec callback"); 7621d56e9cSAlfred Perlstein 7721d56e9cSAlfred Perlstein /* 7821d56e9cSAlfred Perlstein * callout list for things to do at exec time 7921d56e9cSAlfred Perlstein */ 8021d56e9cSAlfred Perlstein struct execlist { 8121d56e9cSAlfred Perlstein execlist_fn function; 8221d56e9cSAlfred Perlstein TAILQ_ENTRY(execlist) next; 8321d56e9cSAlfred Perlstein }; 8421d56e9cSAlfred Perlstein 8521d56e9cSAlfred Perlstein TAILQ_HEAD(exec_list_head, execlist); 8621d56e9cSAlfred Perlstein static struct exec_list_head exec_list = TAILQ_HEAD_INITIALIZER(exec_list); 8721d56e9cSAlfred Perlstein 889701cd40SJohn Baldwin /* XXX This should be vm_size_t. */ 899701cd40SJohn Baldwin static u_long ps_strings = PS_STRINGS; 90ca0387efSJake Burkholder SYSCTL_ULONG(_kern, KERN_PS_STRINGS, ps_strings, CTLFLAG_RD, &ps_strings, 91ca0387efSJake Burkholder 0, ""); 92486bddb0SDoug Rabson 939701cd40SJohn Baldwin /* XXX This should be vm_size_t. */ 949701cd40SJohn Baldwin static u_long usrstack = USRSTACK; 959701cd40SJohn Baldwin SYSCTL_ULONG(_kern, KERN_USRSTACK, usrstack, CTLFLAG_RD, &usrstack, 0, ""); 9699ac3bc8SPeter Wemm 97b9df5231SPoul-Henning Kamp u_long ps_arg_cache_limit = PAGE_SIZE / 16; 98c3699b5fSPeter Wemm SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, 999701cd40SJohn Baldwin &ps_arg_cache_limit, 0, ""); 100b9df5231SPoul-Henning Kamp 101a8704f89SPoul-Henning Kamp int ps_argsopen = 1; 102a8704f89SPoul-Henning Kamp SYSCTL_INT(_kern, OID_AUTO, ps_argsopen, CTLFLAG_RW, &ps_argsopen, 0, ""); 103a8704f89SPoul-Henning Kamp 104911fc923SPeter Wemm #ifdef __ia64__ 105911fc923SPeter Wemm /* XXX HACK */ 106911fc923SPeter Wemm static int regstkpages = 256; 107911fc923SPeter Wemm SYSCTL_INT(_machdep, OID_AUTO, regstkpages, CTLFLAG_RW, ®stkpages, 0, ""); 108911fc923SPeter Wemm #endif 109911fc923SPeter Wemm 11099ac3bc8SPeter Wemm /* 111aa855a59SPeter Wemm * Each of the items is a pointer to a `const struct execsw', hence the 112aa855a59SPeter Wemm * double pointer here. 113df8bae1dSRodney W. Grimes */ 114aa855a59SPeter Wemm static const struct execsw **execsw; 11526f9a767SRodney W. Grimes 116d2d3e875SBruce Evans #ifndef _SYS_SYSPROTO_H_ 117ad7507e2SSteven Wallace struct execve_args { 118ad7507e2SSteven Wallace char *fname; 119ad7507e2SSteven Wallace char **argv; 120ad7507e2SSteven Wallace char **envv; 121ad7507e2SSteven Wallace }; 122d2d3e875SBruce Evans #endif 123ad7507e2SSteven Wallace 12426f9a767SRodney W. Grimes /* 12526f9a767SRodney W. Grimes * execve() system call. 126116734c4SMatthew Dillon * 127116734c4SMatthew Dillon * MPSAFE 12826f9a767SRodney W. Grimes */ 12926f9a767SRodney W. Grimes int 130b40ce416SJulian Elischer execve(td, uap) 131b40ce416SJulian Elischer struct thread *td; 13226f9a767SRodney W. Grimes register struct execve_args *uap; 133df8bae1dSRodney W. Grimes { 134b40ce416SJulian Elischer struct proc *p = td->td_proc; 13526f9a767SRodney W. Grimes struct nameidata nd, *ndp; 1369b3b1c5fSJohn Baldwin struct ucred *newcred = NULL, *oldcred; 1371419eacbSAlfred Perlstein struct uidinfo *euip; 138654f6be1SBruce Evans register_t *stack_base; 139bb56ec4aSPoul-Henning Kamp int error, len, i; 140c52007c2SDavid Greenman struct image_params image_params, *imgp; 14126f9a767SRodney W. Grimes struct vattr attr; 1424d77a549SAlfred Perlstein int (*img_first)(struct image_params *); 14369be5db9SAlfred Perlstein struct pargs *oldargs = NULL, *newargs = NULL; 1449b3b1c5fSJohn Baldwin struct procsig *oldprocsig, *newprocsig; 1456c84de02SJohn Baldwin #ifdef KTRACE 1466c84de02SJohn Baldwin struct vnode *tracevp = NULL; 1476c84de02SJohn Baldwin #endif 1486c84de02SJohn Baldwin struct vnode *textvp = NULL; 149d06c0d4dSRobert Watson int credential_changing; 150619eb6e5SJeff Roberson int textset; 15126f9a767SRodney W. Grimes 152c52007c2SDavid Greenman imgp = &image_params; 153df8bae1dSRodney W. Grimes 1549ca45e81SDag-Erling Smørgrav /* 1559ca45e81SDag-Erling Smørgrav * Lock the process and set the P_INEXEC flag to indicate that 1569ca45e81SDag-Erling Smørgrav * it should be left alone until we're done here. This is 1579ca45e81SDag-Erling Smørgrav * necessary to avoid race conditions - e.g. in ptrace() - 1589ca45e81SDag-Erling Smørgrav * that might allow a local user to illicitly obtain elevated 1599ca45e81SDag-Erling Smørgrav * privileges. 1609ca45e81SDag-Erling Smørgrav */ 1619ca45e81SDag-Erling Smørgrav PROC_LOCK(p); 1629ca45e81SDag-Erling Smørgrav KASSERT((p->p_flag & P_INEXEC) == 0, 16391f91617SDavid E. O'Brien ("%s(): process already has P_INEXEC flag", __func__)); 16449539972SJulian Elischer if (p->p_flag & P_KSES) { 1651279572aSDavid Xu if (thread_single(SINGLE_EXIT)) { 166e602ba25SJulian Elischer PROC_UNLOCK(p); 167e602ba25SJulian Elischer return (ERESTART); /* Try again later. */ 168e602ba25SJulian Elischer } 16949539972SJulian Elischer /* 17049539972SJulian Elischer * If we get here all other threads are dead, 17149539972SJulian Elischer * so unset the associated flags and lose KSE mode. 17249539972SJulian Elischer */ 17349539972SJulian Elischer p->p_flag &= ~P_KSES; 17449539972SJulian Elischer td->td_flags &= ~TDF_UNBOUND; 17549539972SJulian Elischer thread_single_end(); 17649539972SJulian Elischer } 1779ca45e81SDag-Erling Smørgrav p->p_flag |= P_INEXEC; 1789ca45e81SDag-Erling Smørgrav PROC_UNLOCK(p); 1799ca45e81SDag-Erling Smørgrav 180df8bae1dSRodney W. Grimes /* 181c52007c2SDavid Greenman * Initialize part of the common data 182df8bae1dSRodney W. Grimes */ 183c52007c2SDavid Greenman imgp->proc = p; 184c52007c2SDavid Greenman imgp->uap = uap; 185c52007c2SDavid Greenman imgp->attr = &attr; 186c52007c2SDavid Greenman imgp->argc = imgp->envc = 0; 1875cf3d12cSAndrey A. Chernov imgp->argv0 = NULL; 188c52007c2SDavid Greenman imgp->entry_addr = 0; 189c52007c2SDavid Greenman imgp->vmspace_destroyed = 0; 190c52007c2SDavid Greenman imgp->interpreted = 0; 191c52007c2SDavid Greenman imgp->interpreter_name[0] = '\0'; 192e1743d02SSøren Schmidt imgp->auxargs = NULL; 1931616db3cSJohn Dyson imgp->vp = NULL; 1940b2ed1aeSJeff Roberson imgp->object = NULL; 1951616db3cSJohn Dyson imgp->firstpage = NULL; 1964fe88fe6SJohn Polstra imgp->ps_strings = 0; 197b9a22da4STakanori Watanabe imgp->auxarg_size = 0; 19826f9a767SRodney W. Grimes 19926f9a767SRodney W. Grimes /* 20026f9a767SRodney W. Grimes * Allocate temporary demand zeroed space for argument and 20126f9a767SRodney W. Grimes * environment strings 20226f9a767SRodney W. Grimes */ 203ca0387efSJake Burkholder imgp->stringbase = (char *)kmem_alloc_wait(exec_map, ARG_MAX + 204ca0387efSJake Burkholder PAGE_SIZE); 205c2f9f36bSDavid Greenman if (imgp->stringbase == NULL) { 20626f9a767SRodney W. Grimes error = ENOMEM; 207b3afd20dSAlan Cox mtx_lock(&Giant); 20826f9a767SRodney W. Grimes goto exec_fail; 20926f9a767SRodney W. Grimes } 210c52007c2SDavid Greenman imgp->stringp = imgp->stringbase; 211c52007c2SDavid Greenman imgp->stringspace = ARG_MAX; 2121616db3cSJohn Dyson imgp->image_header = imgp->stringbase + ARG_MAX; 21326f9a767SRodney W. Grimes 21426f9a767SRodney W. Grimes /* 21526f9a767SRodney W. Grimes * Translate the file name. namei() returns a vnode pointer 21626f9a767SRodney W. Grimes * in ni_vp amoung other things. 21726f9a767SRodney W. Grimes */ 21826f9a767SRodney W. Grimes ndp = &nd; 219b35ba931SDavid Greenman NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME, 220b40ce416SJulian Elischer UIO_USERSPACE, uap->fname, td); 22126f9a767SRodney W. Grimes 222b3afd20dSAlan Cox mtx_lock(&Giant); 22326f9a767SRodney W. Grimes interpret: 22426f9a767SRodney W. Grimes 22526f9a767SRodney W. Grimes error = namei(ndp); 22626f9a767SRodney W. Grimes if (error) { 2271616db3cSJohn Dyson kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, 2281616db3cSJohn Dyson ARG_MAX + PAGE_SIZE); 22926f9a767SRodney W. Grimes goto exec_fail; 23026f9a767SRodney W. Grimes } 23126f9a767SRodney W. Grimes 232c52007c2SDavid Greenman imgp->vp = ndp->ni_vp; 2339c0fed3dSDoug Rabson imgp->fname = uap->fname; 23426f9a767SRodney W. Grimes 23526f9a767SRodney W. Grimes /* 2369022e4adSDavid Greenman * Check file permissions (also 'opens' file) 2379022e4adSDavid Greenman */ 238c52007c2SDavid Greenman error = exec_check_permissions(imgp); 239619eb6e5SJeff Roberson if (error) 24026f9a767SRodney W. Grimes goto exec_fail_dealloc; 241619eb6e5SJeff Roberson 242619eb6e5SJeff Roberson if (VOP_GETVOBJECT(imgp->vp, &imgp->object) == 0) 2430b2ed1aeSJeff Roberson vm_object_reference(imgp->object); 24426f9a767SRodney W. Grimes 245619eb6e5SJeff Roberson /* 246619eb6e5SJeff Roberson * Set VV_TEXT now so no one can write to the executable while we're 247619eb6e5SJeff Roberson * activating it. 248619eb6e5SJeff Roberson * 249619eb6e5SJeff Roberson * Remember if this was set before and unset it in case this is not 250619eb6e5SJeff Roberson * actually an executable image. 251619eb6e5SJeff Roberson */ 252619eb6e5SJeff Roberson textset = imgp->vp->v_vflag & VV_TEXT; 253619eb6e5SJeff Roberson imgp->vp->v_vflag |= VV_TEXT; 254619eb6e5SJeff Roberson 2551616db3cSJohn Dyson error = exec_map_first_page(imgp); 2566d5a0a8cSDavid Greenman if (error) 25726f9a767SRodney W. Grimes goto exec_fail_dealloc; 25826f9a767SRodney W. Grimes 25926f9a767SRodney W. Grimes /* 260d323ddf3SMatthew Dillon * If the current process has a special image activator it 261d323ddf3SMatthew Dillon * wants to try first, call it. For example, emulating shell 262d323ddf3SMatthew Dillon * scripts differently. 26326f9a767SRodney W. Grimes */ 264d323ddf3SMatthew Dillon error = -1; 265d323ddf3SMatthew Dillon if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL) 266d323ddf3SMatthew Dillon error = img_first(imgp); 267d323ddf3SMatthew Dillon 268d323ddf3SMatthew Dillon /* 269d323ddf3SMatthew Dillon * Loop through the list of image activators, calling each one. 270d323ddf3SMatthew Dillon * An activator returns -1 if there is no match, 0 on success, 271d323ddf3SMatthew Dillon * and an error otherwise. 272d323ddf3SMatthew Dillon */ 273d323ddf3SMatthew Dillon for (i = 0; error == -1 && execsw[i]; ++i) { 274d323ddf3SMatthew Dillon if (execsw[i]->ex_imgact == NULL || 275d323ddf3SMatthew Dillon execsw[i]->ex_imgact == img_first) { 276d323ddf3SMatthew Dillon continue; 277d323ddf3SMatthew Dillon } 278c52007c2SDavid Greenman error = (*execsw[i]->ex_imgact)(imgp); 279d323ddf3SMatthew Dillon } 280d323ddf3SMatthew Dillon 281d323ddf3SMatthew Dillon if (error) { 282619eb6e5SJeff Roberson if (error == -1) { 283619eb6e5SJeff Roberson if (textset == 0) 284619eb6e5SJeff Roberson imgp->vp->v_vflag &= ~VV_TEXT; 285d323ddf3SMatthew Dillon error = ENOEXEC; 286619eb6e5SJeff Roberson } 28726f9a767SRodney W. Grimes goto exec_fail_dealloc; 288d323ddf3SMatthew Dillon } 289d323ddf3SMatthew Dillon 290d323ddf3SMatthew Dillon /* 291d323ddf3SMatthew Dillon * Special interpreter operation, cleanup and loop up to try to 292d323ddf3SMatthew Dillon * activate the interpreter. 293d323ddf3SMatthew Dillon */ 294c52007c2SDavid Greenman if (imgp->interpreted) { 2951616db3cSJohn Dyson exec_unmap_first_page(imgp); 296619eb6e5SJeff Roberson /* 297619eb6e5SJeff Roberson * VV_TEXT needs to be unset for scripts. There is a short 298619eb6e5SJeff Roberson * period before we determine that something is a script where 299619eb6e5SJeff Roberson * VV_TEXT will be set. The vnode lock is held over this 300619eb6e5SJeff Roberson * entire period so nothing should illegitimately be blocked. 301619eb6e5SJeff Roberson */ 302619eb6e5SJeff Roberson imgp->vp->v_vflag &= ~VV_TEXT; 303762e6b85SEivind Eklund /* free name buffer and old vnode */ 304762e6b85SEivind Eklund NDFREE(ndp, NDF_ONLY_PNBUF); 305619eb6e5SJeff Roberson vput(ndp->ni_vp); 3060b2ed1aeSJeff Roberson vm_object_deallocate(imgp->object); 3070b2ed1aeSJeff Roberson imgp->object = NULL; 30826f9a767SRodney W. Grimes /* set new name to that of the interpreter */ 309b35ba931SDavid Greenman NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME, 310b40ce416SJulian Elischer UIO_SYSSPACE, imgp->interpreter_name, td); 31126f9a767SRodney W. Grimes goto interpret; 31226f9a767SRodney W. Grimes } 31326f9a767SRodney W. Grimes 31426f9a767SRodney W. Grimes /* 31526f9a767SRodney W. Grimes * Copy out strings (args and env) and initialize stack base 31626f9a767SRodney W. Grimes */ 3173ebc1248SPeter Wemm if (p->p_sysent->sv_copyout_strings) 3183ebc1248SPeter Wemm stack_base = (*p->p_sysent->sv_copyout_strings)(imgp); 3193ebc1248SPeter Wemm else 320c52007c2SDavid Greenman stack_base = exec_copyout_strings(imgp); 32126f9a767SRodney W. Grimes 32226f9a767SRodney W. Grimes /* 3231e1e0b44SSøren Schmidt * If custom stack fixup routine present for this process 3241e1e0b44SSøren Schmidt * let it do the stack setup. 3251e1e0b44SSøren Schmidt * Else stuff argument count as first item on stack 32626f9a767SRodney W. Grimes */ 3271e1e0b44SSøren Schmidt if (p->p_sysent->sv_fixup) 328c52007c2SDavid Greenman (*p->p_sysent->sv_fixup)(&stack_base, imgp); 3291e1e0b44SSøren Schmidt else 330c52007c2SDavid Greenman suword(--stack_base, imgp->argc); 33126f9a767SRodney W. Grimes 332a78e8d2aSDavid Greenman /* 333a78e8d2aSDavid Greenman * For security and other reasons, the file descriptor table cannot 334a78e8d2aSDavid Greenman * be shared after an exec. 335a78e8d2aSDavid Greenman */ 336426da3bcSAlfred Perlstein FILEDESC_LOCK(p->p_fd); 337a78e8d2aSDavid Greenman if (p->p_fd->fd_refcnt > 1) { 338a78e8d2aSDavid Greenman struct filedesc *tmp; 339a78e8d2aSDavid Greenman 340b40ce416SJulian Elischer tmp = fdcopy(td); 341426da3bcSAlfred Perlstein FILEDESC_UNLOCK(p->p_fd); 342b40ce416SJulian Elischer fdfree(td); 343a78e8d2aSDavid Greenman p->p_fd = tmp; 344426da3bcSAlfred Perlstein } else 345426da3bcSAlfred Perlstein FILEDESC_UNLOCK(p->p_fd); 346a78e8d2aSDavid Greenman 347333ea485SGuido van Rooij /* 3489b3b1c5fSJohn Baldwin * Malloc things before we need locks. 3499b3b1c5fSJohn Baldwin */ 3509b3b1c5fSJohn Baldwin newcred = crget(); 3511419eacbSAlfred Perlstein euip = uifind(attr.va_uid); 3529b3b1c5fSJohn Baldwin i = imgp->endargs - imgp->stringbase; 3539b3b1c5fSJohn Baldwin if (ps_arg_cache_limit >= i + sizeof(struct pargs)) 3549b3b1c5fSJohn Baldwin newargs = pargs_alloc(i); 3559b3b1c5fSJohn Baldwin 3569b3b1c5fSJohn Baldwin /* close files on exec */ 3579b3b1c5fSJohn Baldwin fdcloseexec(td); 3589b3b1c5fSJohn Baldwin 359619eb6e5SJeff Roberson /* Get a reference to the vnode prior to locking the proc */ 360619eb6e5SJeff Roberson VREF(ndp->ni_vp); 361619eb6e5SJeff Roberson 3629b3b1c5fSJohn Baldwin /* 363333ea485SGuido van Rooij * For security and other reasons, signal handlers cannot 3648688bb93SJohn Baldwin * be shared after an exec. The new process gets a copy of the old 365b2c3fa70SDima Dorfman * handlers. In execsigs(), the new process will have its signals 366333ea485SGuido van Rooij * reset. 367333ea485SGuido van Rooij */ 3689b3b1c5fSJohn Baldwin PROC_LOCK(p); 3699b3b1c5fSJohn Baldwin mp_fixme("procsig needs a lock"); 370333ea485SGuido van Rooij if (p->p_procsig->ps_refcnt > 1) { 3719b3b1c5fSJohn Baldwin oldprocsig = p->p_procsig; 3729b3b1c5fSJohn Baldwin PROC_UNLOCK(p); 373333ea485SGuido van Rooij MALLOC(newprocsig, struct procsig *, sizeof(struct procsig), 374333ea485SGuido van Rooij M_SUBPROC, M_WAITOK); 3759b3b1c5fSJohn Baldwin bcopy(oldprocsig, newprocsig, sizeof(*newprocsig)); 3769b3b1c5fSJohn Baldwin newprocsig->ps_refcnt = 1; 3779b3b1c5fSJohn Baldwin oldprocsig->ps_refcnt--; 3789b3b1c5fSJohn Baldwin PROC_LOCK(p); 379333ea485SGuido van Rooij p->p_procsig = newprocsig; 380b40ce416SJulian Elischer if (p->p_sigacts == &p->p_uarea->u_sigacts) 381b2c3fa70SDima Dorfman panic("shared procsig but private sigacts?"); 382333ea485SGuido van Rooij 383b40ce416SJulian Elischer p->p_uarea->u_sigacts = *p->p_sigacts; 384b40ce416SJulian Elischer p->p_sigacts = &p->p_uarea->u_sigacts; 385333ea485SGuido van Rooij } 386fdf4e8b3SWarner Losh /* Stop profiling */ 387fdf4e8b3SWarner Losh stopprofclock(p); 388fdf4e8b3SWarner Losh 38926f9a767SRodney W. Grimes /* reset caught signals */ 39026f9a767SRodney W. Grimes execsigs(p); 39126f9a767SRodney W. Grimes 39226f9a767SRodney W. Grimes /* name this process - nameiexec(p, ndp) */ 39326f9a767SRodney W. Grimes len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN); 39426f9a767SRodney W. Grimes bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len); 39526f9a767SRodney W. Grimes p->p_comm[len] = 0; 39626f9a767SRodney W. Grimes 39726f9a767SRodney W. Grimes /* 39824b34f09SSujal Patel * mark as execed, wakeup the process that vforked (if any) and tell 399dc733423SDag-Erling Smørgrav * it that it now has its own resources back 40026f9a767SRodney W. Grimes */ 40126f9a767SRodney W. Grimes p->p_flag |= P_EXEC; 40226f9a767SRodney W. Grimes if (p->p_pptr && (p->p_flag & P_PPWAIT)) { 40326f9a767SRodney W. Grimes p->p_flag &= ~P_PPWAIT; 4047f05b035SAlfred Perlstein wakeup(p->p_pptr); 40526f9a767SRodney W. Grimes } 40626f9a767SRodney W. Grimes 40726f9a767SRodney W. Grimes /* 408a78e8d2aSDavid Greenman * Implement image setuid/setgid. 409a78e8d2aSDavid Greenman * 410a78e8d2aSDavid Greenman * Don't honor setuid/setgid if the filesystem prohibits it or if 411a78e8d2aSDavid Greenman * the process is being traced. 412c52007c2SDavid Greenman */ 413b1fc0ec1SRobert Watson oldcred = p->p_ucred; 414d06c0d4dSRobert Watson credential_changing = 0; 415d06c0d4dSRobert Watson credential_changing |= (attr.va_mode & VSUID) && oldcred->cr_uid != 416d06c0d4dSRobert Watson attr.va_uid; 417d06c0d4dSRobert Watson credential_changing |= (attr.va_mode & VSGID) && oldcred->cr_gid != 418d06c0d4dSRobert Watson attr.va_gid; 419d06c0d4dSRobert Watson 420d06c0d4dSRobert Watson if (credential_changing && 421a78e8d2aSDavid Greenman (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 && 422c52007c2SDavid Greenman (p->p_flag & P_TRACED) == 0) { 423c52007c2SDavid Greenman /* 424c52007c2SDavid Greenman * Turn off syscall tracing for set-id programs, except for 425b85db196SPeter Wemm * root. Record any set-id flags first to make sure that 426b85db196SPeter Wemm * we do not regain any tracing during a possible block. 42726f9a767SRodney W. Grimes */ 428b85db196SPeter Wemm setsugid(p); 4296c84de02SJohn Baldwin #ifdef KTRACE 43044731cabSJohn Baldwin if (p->p_tracep && suser_cred(oldcred, PRISON_ROOT)) { 4316c84de02SJohn Baldwin mtx_lock(&ktrace_mtx); 43279deba82SMatthew Dillon p->p_traceflag = 0; 4339b3b1c5fSJohn Baldwin tracevp = p->p_tracep; 4349b3b1c5fSJohn Baldwin p->p_tracep = NULL; 4356c84de02SJohn Baldwin mtx_unlock(&ktrace_mtx); 43626f9a767SRodney W. Grimes } 4376c84de02SJohn Baldwin #endif 43889ab9307SJacques Vidrine /* Close any file descriptors 0..2 that reference procfs */ 43989ab9307SJacques Vidrine setugidsafety(td); 44028b325aaSDon Lewis /* 44128b325aaSDon Lewis * Make sure file descriptors 0..2 are in use. 44228b325aaSDon Lewis * 44328b325aaSDon Lewis * fdcheckstd() may call falloc() which may block to 44428b325aaSDon Lewis * allocate memory, so temporarily drop the process lock. 44528b325aaSDon Lewis */ 44628b325aaSDon Lewis PROC_UNLOCK(p); 447e983a376SJacques Vidrine error = fdcheckstd(td); 44828b325aaSDon Lewis PROC_LOCK(p); 44963c9e754SJohn Baldwin if (error != 0) 45069be5db9SAlfred Perlstein goto done1; 451c52007c2SDavid Greenman /* 452c52007c2SDavid Greenman * Set the new credentials. 453c52007c2SDavid Greenman */ 4549b3b1c5fSJohn Baldwin crcopy(newcred, oldcred); 455c52007c2SDavid Greenman if (attr.va_mode & VSUID) 4561419eacbSAlfred Perlstein change_euid(newcred, euip); 457c52007c2SDavid Greenman if (attr.va_mode & VSGID) 458b1fc0ec1SRobert Watson change_egid(newcred, attr.va_gid); 4599b3b1c5fSJohn Baldwin /* 4609b3b1c5fSJohn Baldwin * Implement correct POSIX saved-id behavior. 4619b3b1c5fSJohn Baldwin */ 4629b3b1c5fSJohn Baldwin change_svuid(newcred, newcred->cr_uid); 4639b3b1c5fSJohn Baldwin change_svgid(newcred, newcred->cr_gid); 4649b3b1c5fSJohn Baldwin p->p_ucred = newcred; 4659b3b1c5fSJohn Baldwin newcred = NULL; 466c52007c2SDavid Greenman } else { 467b1fc0ec1SRobert Watson if (oldcred->cr_uid == oldcred->cr_ruid && 468b1fc0ec1SRobert Watson oldcred->cr_gid == oldcred->cr_rgid) 469c52007c2SDavid Greenman p->p_flag &= ~P_SUGID; 47026f9a767SRodney W. Grimes /* 471c52007c2SDavid Greenman * Implement correct POSIX saved-id behavior. 472b1fc0ec1SRobert Watson * 473b1fc0ec1SRobert Watson * XXX: It's not clear that the existing behavior is 4749b3b1c5fSJohn Baldwin * POSIX-compliant. A number of sources indicate that the 4759b3b1c5fSJohn Baldwin * saved uid/gid should only be updated if the new ruid is 4769b3b1c5fSJohn Baldwin * not equal to the old ruid, or the new euid is not equal 4779b3b1c5fSJohn Baldwin * to the old euid and the new euid is not equal to the old 4789b3b1c5fSJohn Baldwin * ruid. The FreeBSD code always updates the saved uid/gid. 4799b3b1c5fSJohn Baldwin * Also, this code uses the new (replaced) euid and egid as 4809b3b1c5fSJohn Baldwin * the source, which may or may not be the right ones to use. 48126f9a767SRodney W. Grimes */ 482b1fc0ec1SRobert Watson if (oldcred->cr_svuid != oldcred->cr_uid || 483b1fc0ec1SRobert Watson oldcred->cr_svgid != oldcred->cr_gid) { 4849b3b1c5fSJohn Baldwin crcopy(newcred, oldcred); 485b1fc0ec1SRobert Watson change_svuid(newcred, newcred->cr_uid); 486b1fc0ec1SRobert Watson change_svgid(newcred, newcred->cr_gid); 487b1fc0ec1SRobert Watson p->p_ucred = newcred; 4889b3b1c5fSJohn Baldwin newcred = NULL; 4899b3b1c5fSJohn Baldwin } 490b1fc0ec1SRobert Watson } 49126f9a767SRodney W. Grimes 49226f9a767SRodney W. Grimes /* 493619eb6e5SJeff Roberson * Store the vp for use in procfs. This vnode was referenced prior 494619eb6e5SJeff Roberson * to locking the proc lock. 4952a531c80SDavid Greenman */ 4969b3b1c5fSJohn Baldwin textvp = p->p_textvp; 4972a531c80SDavid Greenman p->p_textvp = ndp->ni_vp; 4982a531c80SDavid Greenman 4992a531c80SDavid Greenman /* 5009ca45e81SDag-Erling Smørgrav * Notify others that we exec'd, and clear the P_INEXEC flag 5019ca45e81SDag-Erling Smørgrav * as we're now a bona fide freshly-execed process. 502cb679c38SJonathan Lemon */ 503cb679c38SJonathan Lemon KNOTE(&p->p_klist, NOTE_EXEC); 5049ca45e81SDag-Erling Smørgrav p->p_flag &= ~P_INEXEC; 505cb679c38SJonathan Lemon 506cb679c38SJonathan Lemon /* 50726f9a767SRodney W. Grimes * If tracing the process, trap to debugger so breakpoints 50826f9a767SRodney W. Grimes * can be set before the program executes. 50926f9a767SRodney W. Grimes */ 510e65897c3SJohn Baldwin _STOPEVENT(p, S_EXEC, 0); 5112a024a2bSSean Eric Fagan 51226f9a767SRodney W. Grimes if (p->p_flag & P_TRACED) 51326f9a767SRodney W. Grimes psignal(p, SIGTRAP); 51426f9a767SRodney W. Grimes 51526f9a767SRodney W. Grimes /* clear "fork but no exec" flag, as we _are_ execing */ 51626f9a767SRodney W. Grimes p->p_acflag &= ~AFORK; 51726f9a767SRodney W. Grimes 518b9df5231SPoul-Henning Kamp /* Free any previous argument cache */ 5199b3b1c5fSJohn Baldwin oldargs = p->p_args; 520b9df5231SPoul-Henning Kamp p->p_args = NULL; 521b9df5231SPoul-Henning Kamp 522e913ca22SDoug Rabson /* Set values passed into the program in registers. */ 5233ebc1248SPeter Wemm if (p->p_sysent->sv_setregs) 5243ebc1248SPeter Wemm (*p->p_sysent->sv_setregs)(td, imgp->entry_addr, 5253ebc1248SPeter Wemm (u_long)(uintptr_t)stack_base, imgp->ps_strings); 5263ebc1248SPeter Wemm else 527bafbd492SJake Burkholder exec_setregs(td, imgp->entry_addr, 528bafbd492SJake Burkholder (u_long)(uintptr_t)stack_base, imgp->ps_strings); 529e913ca22SDoug Rabson 530b9df5231SPoul-Henning Kamp /* Cache arguments if they fit inside our allowance */ 531b9df5231SPoul-Henning Kamp if (ps_arg_cache_limit >= i + sizeof(struct pargs)) { 5329b3b1c5fSJohn Baldwin bcopy(imgp->stringbase, newargs->ar_args, i); 5339b3b1c5fSJohn Baldwin p->p_args = newargs; 5349b3b1c5fSJohn Baldwin newargs = NULL; 535fbd26f75SJohn Baldwin } 53669be5db9SAlfred Perlstein done1: 5379b3b1c5fSJohn Baldwin PROC_UNLOCK(p); 5389b3b1c5fSJohn Baldwin 539619eb6e5SJeff Roberson 5409b3b1c5fSJohn Baldwin /* 5419b3b1c5fSJohn Baldwin * Free any resources malloc'd earlier that we didn't use. 5429b3b1c5fSJohn Baldwin */ 5431419eacbSAlfred Perlstein uifree(euip); 5449b3b1c5fSJohn Baldwin if (newcred == NULL) 5459b3b1c5fSJohn Baldwin crfree(oldcred); 5469b3b1c5fSJohn Baldwin else 5479b3b1c5fSJohn Baldwin crfree(newcred); 5489b3b1c5fSJohn Baldwin /* 5499b3b1c5fSJohn Baldwin * Handle deferred decrement of ref counts. 5509b3b1c5fSJohn Baldwin */ 5519b3b1c5fSJohn Baldwin if (textvp != NULL) 5529b3b1c5fSJohn Baldwin vrele(textvp); 553619eb6e5SJeff Roberson if (ndp->ni_vp && error != 0) 554619eb6e5SJeff Roberson vrele(ndp->ni_vp); 5556c84de02SJohn Baldwin #ifdef KTRACE 5569b3b1c5fSJohn Baldwin if (tracevp != NULL) 5579b3b1c5fSJohn Baldwin vrele(tracevp); 5586c84de02SJohn Baldwin #endif 55969be5db9SAlfred Perlstein if (oldargs != NULL) 5609b3b1c5fSJohn Baldwin pargs_drop(oldargs); 56169be5db9SAlfred Perlstein if (newargs != NULL) 56269be5db9SAlfred Perlstein pargs_drop(newargs); 563b9df5231SPoul-Henning Kamp 5641616db3cSJohn Dyson exec_fail_dealloc: 5651616db3cSJohn Dyson 56626f9a767SRodney W. Grimes /* 56726f9a767SRodney W. Grimes * free various allocated resources 56826f9a767SRodney W. Grimes */ 5691616db3cSJohn Dyson if (imgp->firstpage) 5701616db3cSJohn Dyson exec_unmap_first_page(imgp); 57126f9a767SRodney W. Grimes 572c2f9f36bSDavid Greenman if (imgp->stringbase != NULL) 5731616db3cSJohn Dyson kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, 5741616db3cSJohn Dyson ARG_MAX + PAGE_SIZE); 5751616db3cSJohn Dyson 5769c0fed3dSDoug Rabson if (imgp->vp) { 577762e6b85SEivind Eklund NDFREE(ndp, NDF_ONLY_PNBUF); 578619eb6e5SJeff Roberson vput(imgp->vp); 579a3cf6ebaSDavid Greenman } 58026f9a767SRodney W. Grimes 5810b2ed1aeSJeff Roberson if (imgp->object) 5820b2ed1aeSJeff Roberson vm_object_deallocate(imgp->object); 5830b2ed1aeSJeff Roberson 5841616db3cSJohn Dyson if (error == 0) 585116734c4SMatthew Dillon goto done2; 5861616db3cSJohn Dyson 58726f9a767SRodney W. Grimes exec_fail: 5889ca45e81SDag-Erling Smørgrav /* we're done here, clear P_INEXEC */ 5899ca45e81SDag-Erling Smørgrav PROC_LOCK(p); 5909ca45e81SDag-Erling Smørgrav p->p_flag &= ~P_INEXEC; 5919ca45e81SDag-Erling Smørgrav PROC_UNLOCK(p); 5929ca45e81SDag-Erling Smørgrav 593c52007c2SDavid Greenman if (imgp->vmspace_destroyed) { 59426f9a767SRodney W. Grimes /* sorry, no more process anymore. exit gracefully */ 595b40ce416SJulian Elischer exit1(td, W_EXITCODE(0, SIGABRT)); 59626f9a767SRodney W. Grimes /* NOT REACHED */ 597116734c4SMatthew Dillon error = 0; 59826f9a767SRodney W. Grimes } 599116734c4SMatthew Dillon done2: 600116734c4SMatthew Dillon mtx_unlock(&Giant); 601116734c4SMatthew Dillon return (error); 60226f9a767SRodney W. Grimes } 60326f9a767SRodney W. Grimes 6041616db3cSJohn Dyson int 6051616db3cSJohn Dyson exec_map_first_page(imgp) 6061616db3cSJohn Dyson struct image_params *imgp; 6071616db3cSJohn Dyson { 608d8aad40cSJohn Baldwin int rv, i; 60995461b45SJohn Dyson int initial_pagein; 61095461b45SJohn Dyson vm_page_t ma[VM_INITIAL_PAGEIN]; 6111616db3cSJohn Dyson vm_object_t object; 6121616db3cSJohn Dyson 6130cddd8f0SMatthew Dillon GIANT_REQUIRED; 6141616db3cSJohn Dyson 6151616db3cSJohn Dyson if (imgp->firstpage) { 6161616db3cSJohn Dyson exec_unmap_first_page(imgp); 6171616db3cSJohn Dyson } 6181616db3cSJohn Dyson 6199ff5ce6bSBoris Popov VOP_GETVOBJECT(imgp->vp, &object); 6201616db3cSJohn Dyson 62195461b45SJohn Dyson ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL | VM_ALLOC_RETRY); 6221616db3cSJohn Dyson 62395461b45SJohn Dyson if ((ma[0]->valid & VM_PAGE_BITS_ALL) != VM_PAGE_BITS_ALL) { 62495461b45SJohn Dyson initial_pagein = VM_INITIAL_PAGEIN; 62595461b45SJohn Dyson if (initial_pagein > object->size) 62695461b45SJohn Dyson initial_pagein = object->size; 62795461b45SJohn Dyson for (i = 1; i < initial_pagein; i++) { 628d254af07SMatthew Dillon if ((ma[i] = vm_page_lookup(object, i)) != NULL) { 62995461b45SJohn Dyson if ((ma[i]->flags & PG_BUSY) || ma[i]->busy) 63095461b45SJohn Dyson break; 63195461b45SJohn Dyson if (ma[i]->valid) 63295461b45SJohn Dyson break; 633e69763a3SDoug Rabson vm_page_busy(ma[i]); 63495461b45SJohn Dyson } else { 635ca0387efSJake Burkholder ma[i] = vm_page_alloc(object, i, 636ca0387efSJake Burkholder VM_ALLOC_NORMAL); 63795461b45SJohn Dyson if (ma[i] == NULL) 63895461b45SJohn Dyson break; 63995461b45SJohn Dyson } 64095461b45SJohn Dyson } 64195461b45SJohn Dyson initial_pagein = i; 6421616db3cSJohn Dyson 64395461b45SJohn Dyson rv = vm_pager_get_pages(object, ma, initial_pagein, 0); 64495461b45SJohn Dyson ma[0] = vm_page_lookup(object, 0); 64595461b45SJohn Dyson 646ca0387efSJake Burkholder if ((rv != VM_PAGER_OK) || (ma[0] == NULL) || 647ca0387efSJake Burkholder (ma[0]->valid == 0)) { 648ecbb00a2SDoug Rabson if (ma[0]) { 64997646f56SAlan Cox vm_page_lock_queues(); 65095461b45SJohn Dyson vm_page_protect(ma[0], VM_PROT_NONE); 6518f9110f6SJohn Dyson vm_page_free(ma[0]); 65297646f56SAlan Cox vm_page_unlock_queues(); 653ecbb00a2SDoug Rabson } 654a7cddfedSJake Burkholder return (EIO); 6551616db3cSJohn Dyson } 6561616db3cSJohn Dyson } 65797646f56SAlan Cox vm_page_lock_queues(); 65895461b45SJohn Dyson vm_page_wire(ma[0]); 659e69763a3SDoug Rabson vm_page_wakeup(ma[0]); 66097646f56SAlan Cox vm_page_unlock_queues(); 6611616db3cSJohn Dyson 662ac59490bSJake Burkholder pmap_qenter((vm_offset_t)imgp->image_header, ma, 1); 66395461b45SJohn Dyson imgp->firstpage = ma[0]; 6641616db3cSJohn Dyson 665a7cddfedSJake Burkholder return (0); 6661616db3cSJohn Dyson } 6671616db3cSJohn Dyson 6681616db3cSJohn Dyson void 6691616db3cSJohn Dyson exec_unmap_first_page(imgp) 6701616db3cSJohn Dyson struct image_params *imgp; 6711616db3cSJohn Dyson { 6720cddd8f0SMatthew Dillon GIANT_REQUIRED; 67323955314SAlfred Perlstein 6741616db3cSJohn Dyson if (imgp->firstpage) { 675ac59490bSJake Burkholder pmap_qremove((vm_offset_t)imgp->image_header, 1); 67697646f56SAlan Cox vm_page_lock_queues(); 67773007561SDavid Greenman vm_page_unwire(imgp->firstpage, 1); 67897646f56SAlan Cox vm_page_unlock_queues(); 6791616db3cSJohn Dyson imgp->firstpage = NULL; 6801616db3cSJohn Dyson } 6811616db3cSJohn Dyson } 6821616db3cSJohn Dyson 68326f9a767SRodney W. Grimes /* 68426f9a767SRodney W. Grimes * Destroy old address space, and allocate a new stack 68526f9a767SRodney W. Grimes * The new stack is only SGROWSIZ large because it is grown 68626f9a767SRodney W. Grimes * automatically in trap.c. 68726f9a767SRodney W. Grimes */ 68826f9a767SRodney W. Grimes int 6893ebc1248SPeter Wemm exec_new_vmspace(imgp, minuser, maxuser, stack_addr) 690c52007c2SDavid Greenman struct image_params *imgp; 6913ebc1248SPeter Wemm vm_offset_t minuser, maxuser, stack_addr; 69226f9a767SRodney W. Grimes { 69326f9a767SRodney W. Grimes int error; 6946f5dafeaSAlan Cox struct execlist *ep; 6955e20c11fSAlan Cox struct proc *p = imgp->proc; 6965e20c11fSAlan Cox struct vmspace *vmspace = p->p_vmspace; 69726f9a767SRodney W. Grimes 6980cddd8f0SMatthew Dillon GIANT_REQUIRED; 6990cddd8f0SMatthew Dillon 7003ebc1248SPeter Wemm stack_addr = stack_addr - maxssiz; 7013ebc1248SPeter Wemm 702c52007c2SDavid Greenman imgp->vmspace_destroyed = 1; 70326f9a767SRodney W. Grimes 704af9ec885SJohn Dyson /* 7056f5dafeaSAlan Cox * Perform functions registered with at_exec(). 7066f5dafeaSAlan Cox */ 7076f5dafeaSAlan Cox TAILQ_FOREACH(ep, &exec_list, next) 7085e20c11fSAlan Cox (*ep->function)(p); 7096f5dafeaSAlan Cox 7106f5dafeaSAlan Cox /* 711af9ec885SJohn Dyson * Blow away entire process VM, if address space not shared, 712af9ec885SJohn Dyson * otherwise, create a new VM space so that other threads are 713af9ec885SJohn Dyson * not disrupted 714af9ec885SJohn Dyson */ 715ca0387efSJake Burkholder if (vmspace->vm_refcnt == 1 && 716ca0387efSJake Burkholder vm_map_min(&vmspace->vm_map) == minuser && 717ca0387efSJake Burkholder vm_map_max(&vmspace->vm_map) == maxuser) { 7183d903220SDoug Rabson if (vmspace->vm_shm) 7195e20c11fSAlan Cox shmexit(p); 7203ebc1248SPeter Wemm pmap_remove_pages(vmspace_pmap(vmspace), minuser, maxuser); 7213ebc1248SPeter Wemm vm_map_remove(&vmspace->vm_map, minuser, maxuser); 722af9ec885SJohn Dyson } else { 7233ebc1248SPeter Wemm vmspace_exec(p, minuser, maxuser); 7245e20c11fSAlan Cox vmspace = p->p_vmspace; 725af9ec885SJohn Dyson } 72626f9a767SRodney W. Grimes 72726f9a767SRodney W. Grimes /* Allocate a new stack */ 7289a024fc5SRobert Drehmel error = vm_map_stack(&vmspace->vm_map, stack_addr, (vm_size_t)maxssiz, 7299a024fc5SRobert Drehmel VM_PROT_ALL, VM_PROT_ALL, 0); 7302267af78SJulian Elischer if (error) 7312267af78SJulian Elischer return (error); 7322267af78SJulian Elischer 73363c47a5cSDoug Rabson #ifdef __ia64__ 73463c47a5cSDoug Rabson { 73563c47a5cSDoug Rabson /* 73663c47a5cSDoug Rabson * Allocate backing store. We really need something 73763c47a5cSDoug Rabson * similar to vm_map_stack which can allow the backing 73863c47a5cSDoug Rabson * store to grow upwards. This will do for now. 73963c47a5cSDoug Rabson */ 74063c47a5cSDoug Rabson vm_offset_t bsaddr; 741cbc89bfbSPaul Saab bsaddr = USRSTACK - 2 * maxssiz; 74263c47a5cSDoug Rabson error = vm_map_find(&vmspace->vm_map, 0, 0, &bsaddr, 74381f223caSJake Burkholder regstkpages * PAGE_SIZE, 0, VM_PROT_ALL, VM_PROT_ALL, 0); 7445e20c11fSAlan Cox FIRST_THREAD_IN_PROC(p)->td_md.md_bspstore = bsaddr; 74563c47a5cSDoug Rabson } 74663c47a5cSDoug Rabson #endif 74763c47a5cSDoug Rabson 7482267af78SJulian Elischer /* vm_ssize and vm_maxsaddr are somewhat antiquated concepts in the 7492267af78SJulian Elischer * VM_STACK case, but they are still used to monitor the size of the 7502267af78SJulian Elischer * process stack so we can check the stack rlimit. 7512267af78SJulian Elischer */ 752cbc89bfbSPaul Saab vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT; 753cbc89bfbSPaul Saab vmspace->vm_maxsaddr = (char *)USRSTACK - maxssiz; 75426f9a767SRodney W. Grimes 75526f9a767SRodney W. Grimes return (0); 75626f9a767SRodney W. Grimes } 75726f9a767SRodney W. Grimes 75826f9a767SRodney W. Grimes /* 75926f9a767SRodney W. Grimes * Copy out argument and environment strings from the old process 76026f9a767SRodney W. Grimes * address space into the temporary string buffer. 76126f9a767SRodney W. Grimes */ 76226f9a767SRodney W. Grimes int 763c52007c2SDavid Greenman exec_extract_strings(imgp) 764c52007c2SDavid Greenman struct image_params *imgp; 76526f9a767SRodney W. Grimes { 76626f9a767SRodney W. Grimes char **argv, **envv; 76726f9a767SRodney W. Grimes char *argp, *envp; 768ecbb00a2SDoug Rabson int error; 769ecbb00a2SDoug Rabson size_t length; 77026f9a767SRodney W. Grimes 77126f9a767SRodney W. Grimes /* 77226f9a767SRodney W. Grimes * extract arguments first 77326f9a767SRodney W. Grimes */ 77426f9a767SRodney W. Grimes 775c52007c2SDavid Greenman argv = imgp->uap->argv; 77626f9a767SRodney W. Grimes 7770fd1a014SDavid Greenman if (argv) { 778aae0aa45SBruce Evans argp = (caddr_t)(intptr_t)fuword(argv); 7795cf3d12cSAndrey A. Chernov if (argp == (caddr_t)-1) 7805cf3d12cSAndrey A. Chernov return (EFAULT); 7815cf3d12cSAndrey A. Chernov if (argp) 7825cf3d12cSAndrey A. Chernov argv++; 7835cf3d12cSAndrey A. Chernov if (imgp->argv0) 7845cf3d12cSAndrey A. Chernov argp = imgp->argv0; 7855cf3d12cSAndrey A. Chernov if (argp) { 7865cf3d12cSAndrey A. Chernov do { 78726f9a767SRodney W. Grimes if (argp == (caddr_t)-1) 78826f9a767SRodney W. Grimes return (EFAULT); 789c52007c2SDavid Greenman if ((error = copyinstr(argp, imgp->stringp, 790c52007c2SDavid Greenman imgp->stringspace, &length))) { 7910fd1a014SDavid Greenman if (error == ENAMETOOLONG) 79226f9a767SRodney W. Grimes return (E2BIG); 7930fd1a014SDavid Greenman return (error); 7940fd1a014SDavid Greenman } 795c52007c2SDavid Greenman imgp->stringspace -= length; 796c52007c2SDavid Greenman imgp->stringp += length; 797c52007c2SDavid Greenman imgp->argc++; 798aae0aa45SBruce Evans } while ((argp = (caddr_t)(intptr_t)fuword(argv++))); 79926f9a767SRodney W. Grimes } 8000fd1a014SDavid Greenman } 80126f9a767SRodney W. Grimes 802b9df5231SPoul-Henning Kamp imgp->endargs = imgp->stringp; 803b9df5231SPoul-Henning Kamp 80426f9a767SRodney W. Grimes /* 80526f9a767SRodney W. Grimes * extract environment strings 80626f9a767SRodney W. Grimes */ 80726f9a767SRodney W. Grimes 808c52007c2SDavid Greenman envv = imgp->uap->envv; 80926f9a767SRodney W. Grimes 8100fd1a014SDavid Greenman if (envv) { 811aae0aa45SBruce Evans while ((envp = (caddr_t)(intptr_t)fuword(envv++))) { 81226f9a767SRodney W. Grimes if (envp == (caddr_t)-1) 81326f9a767SRodney W. Grimes return (EFAULT); 814c52007c2SDavid Greenman if ((error = copyinstr(envp, imgp->stringp, 815c52007c2SDavid Greenman imgp->stringspace, &length))) { 8160fd1a014SDavid Greenman if (error == ENAMETOOLONG) 81726f9a767SRodney W. Grimes return (E2BIG); 8180fd1a014SDavid Greenman return (error); 8190fd1a014SDavid Greenman } 820c52007c2SDavid Greenman imgp->stringspace -= length; 821c52007c2SDavid Greenman imgp->stringp += length; 822c52007c2SDavid Greenman imgp->envc++; 82326f9a767SRodney W. Grimes } 8240fd1a014SDavid Greenman } 82526f9a767SRodney W. Grimes 82626f9a767SRodney W. Grimes return (0); 82726f9a767SRodney W. Grimes } 82826f9a767SRodney W. Grimes 82926f9a767SRodney W. Grimes /* 83026f9a767SRodney W. Grimes * Copy strings out to the new process address space, constructing 83126f9a767SRodney W. Grimes * new arg and env vector tables. Return a pointer to the base 83226f9a767SRodney W. Grimes * so that it can be used as the initial stack pointer. 83326f9a767SRodney W. Grimes */ 834654f6be1SBruce Evans register_t * 835c52007c2SDavid Greenman exec_copyout_strings(imgp) 836c52007c2SDavid Greenman struct image_params *imgp; 83726f9a767SRodney W. Grimes { 83826f9a767SRodney W. Grimes int argc, envc; 83926f9a767SRodney W. Grimes char **vectp; 84026f9a767SRodney W. Grimes char *stringp, *destp; 841654f6be1SBruce Evans register_t *stack_base; 84293f6448cSDavid Greenman struct ps_strings *arginfo; 843f3bec5d7SJake Burkholder struct proc *p; 844d66a5066SPeter Wemm int szsigcode; 84526f9a767SRodney W. Grimes 84626f9a767SRodney W. Grimes /* 84726f9a767SRodney W. Grimes * Calculate string base and vector table pointers. 848d66a5066SPeter Wemm * Also deal with signal trampoline code for this exec type. 84926f9a767SRodney W. Grimes */ 850f3bec5d7SJake Burkholder p = imgp->proc; 851f3bec5d7SJake Burkholder szsigcode = 0; 8524c56fcdeSBruce Evans arginfo = (struct ps_strings *)PS_STRINGS; 853f3bec5d7SJake Burkholder if (p->p_sysent->sv_szsigcode != NULL) 854f3bec5d7SJake Burkholder szsigcode = *(p->p_sysent->sv_szsigcode); 855d66a5066SPeter Wemm destp = (caddr_t)arginfo - szsigcode - SPARE_USRSPACE - 8561ed012f9SPeter Wemm roundup((ARG_MAX - imgp->stringspace), sizeof(char *)); 8571ed012f9SPeter Wemm 85826f9a767SRodney W. Grimes /* 859d66a5066SPeter Wemm * install sigcode 860d66a5066SPeter Wemm */ 861d66a5066SPeter Wemm if (szsigcode) 862f3bec5d7SJake Burkholder copyout(p->p_sysent->sv_sigcode, ((caddr_t)arginfo - 863f3bec5d7SJake Burkholder szsigcode), szsigcode); 864d66a5066SPeter Wemm 865d66a5066SPeter Wemm /* 866e1743d02SSøren Schmidt * If we have a valid auxargs ptr, prepare some room 867e1743d02SSøren Schmidt * on the stack. 868e1743d02SSøren Schmidt */ 869b9a22da4STakanori Watanabe if (imgp->auxargs) { 870e1743d02SSøren Schmidt /* 871b9a22da4STakanori Watanabe * 'AT_COUNT*2' is size for the ELF Auxargs data. This is for 872b9a22da4STakanori Watanabe * lower compatibility. 873b9a22da4STakanori Watanabe */ 874ca0387efSJake Burkholder imgp->auxarg_size = (imgp->auxarg_size) ? imgp->auxarg_size : 875ca0387efSJake Burkholder (AT_COUNT * 2); 876b9a22da4STakanori Watanabe /* 877b9a22da4STakanori Watanabe * The '+ 2' is for the null pointers at the end of each of 878b9a22da4STakanori Watanabe * the arg and env vector sets,and imgp->auxarg_size is room 879b9a22da4STakanori Watanabe * for argument of Runtime loader. 880e1743d02SSøren Schmidt */ 881e1743d02SSøren Schmidt vectp = (char **)(destp - (imgp->argc + imgp->envc + 2 + 882b9a22da4STakanori Watanabe imgp->auxarg_size) * sizeof(char *)); 883b9a22da4STakanori Watanabe 884b9a22da4STakanori Watanabe } else 885e1743d02SSøren Schmidt /* 886b9a22da4STakanori Watanabe * The '+ 2' is for the null pointers at the end of each of 887b9a22da4STakanori Watanabe * the arg and env vector sets 88826f9a767SRodney W. Grimes */ 889ca0387efSJake Burkholder vectp = (char **)(destp - (imgp->argc + imgp->envc + 2) * 890ca0387efSJake Burkholder sizeof(char *)); 89126f9a767SRodney W. Grimes 89226f9a767SRodney W. Grimes /* 89326f9a767SRodney W. Grimes * vectp also becomes our initial stack base 89426f9a767SRodney W. Grimes */ 895654f6be1SBruce Evans stack_base = (register_t *)vectp; 89626f9a767SRodney W. Grimes 897c52007c2SDavid Greenman stringp = imgp->stringbase; 898c52007c2SDavid Greenman argc = imgp->argc; 899c52007c2SDavid Greenman envc = imgp->envc; 90026f9a767SRodney W. Grimes 90193f6448cSDavid Greenman /* 9023aed948bSDavid Greenman * Copy out strings - arguments and environment. 90393f6448cSDavid Greenman */ 904c52007c2SDavid Greenman copyout(stringp, destp, ARG_MAX - imgp->stringspace); 90593f6448cSDavid Greenman 90693f6448cSDavid Greenman /* 9073aed948bSDavid Greenman * Fill in "ps_strings" struct for ps, w, etc. 9083aed948bSDavid Greenman */ 909aae0aa45SBruce Evans suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp); 9103aed948bSDavid Greenman suword(&arginfo->ps_nargvstr, argc); 9113aed948bSDavid Greenman 9123aed948bSDavid Greenman /* 9133aed948bSDavid Greenman * Fill in argument portion of vector table. 91493f6448cSDavid Greenman */ 91526f9a767SRodney W. Grimes for (; argc > 0; --argc) { 916aae0aa45SBruce Evans suword(vectp++, (long)(intptr_t)destp); 9173aed948bSDavid Greenman while (*stringp++ != 0) 9183aed948bSDavid Greenman destp++; 9193aed948bSDavid Greenman destp++; 92026f9a767SRodney W. Grimes } 92126f9a767SRodney W. Grimes 9221a6e52d0SJeroen Ruigrok van der Werven /* a null vector table pointer separates the argp's from the envp's */ 9236ab46d52SBruce Evans suword(vectp++, 0); 92426f9a767SRodney W. Grimes 925aae0aa45SBruce Evans suword(&arginfo->ps_envstr, (long)(intptr_t)vectp); 9263aed948bSDavid Greenman suword(&arginfo->ps_nenvstr, envc); 92793f6448cSDavid Greenman 92893f6448cSDavid Greenman /* 9293aed948bSDavid Greenman * Fill in environment portion of vector table. 93093f6448cSDavid Greenman */ 93126f9a767SRodney W. Grimes for (; envc > 0; --envc) { 932aae0aa45SBruce Evans suword(vectp++, (long)(intptr_t)destp); 9333aed948bSDavid Greenman while (*stringp++ != 0) 9343aed948bSDavid Greenman destp++; 9353aed948bSDavid Greenman destp++; 93626f9a767SRodney W. Grimes } 93726f9a767SRodney W. Grimes 93826f9a767SRodney W. Grimes /* end of vector table is a null pointer */ 9396ab46d52SBruce Evans suword(vectp, 0); 94026f9a767SRodney W. Grimes 94126f9a767SRodney W. Grimes return (stack_base); 94226f9a767SRodney W. Grimes } 94326f9a767SRodney W. Grimes 94426f9a767SRodney W. Grimes /* 94526f9a767SRodney W. Grimes * Check permissions of file to execute. 946cf64863aSRobert Watson * Called with imgp->vp locked. 94726f9a767SRodney W. Grimes * Return 0 for success or error code on failure. 94826f9a767SRodney W. Grimes */ 949c8a79999SPeter Wemm int 950c52007c2SDavid Greenman exec_check_permissions(imgp) 951c52007c2SDavid Greenman struct image_params *imgp; 95226f9a767SRodney W. Grimes { 953c52007c2SDavid Greenman struct vnode *vp = imgp->vp; 954c52007c2SDavid Greenman struct vattr *attr = imgp->attr; 955a854ed98SJohn Baldwin struct thread *td; 95626f9a767SRodney W. Grimes int error; 95726f9a767SRodney W. Grimes 958a854ed98SJohn Baldwin td = curthread; /* XXXKSE */ 959339b79b9SRobert Watson 960339b79b9SRobert Watson #ifdef MAC 961339b79b9SRobert Watson error = mac_check_vnode_exec(td->td_ucred, imgp->vp); 962339b79b9SRobert Watson if (error) 963339b79b9SRobert Watson return (error); 964339b79b9SRobert Watson #endif 965339b79b9SRobert Watson 96626f9a767SRodney W. Grimes /* Get file attributes */ 967a854ed98SJohn Baldwin error = VOP_GETATTR(vp, attr, td->td_ucred, td); 96826f9a767SRodney W. Grimes if (error) 96926f9a767SRodney W. Grimes return (error); 97026f9a767SRodney W. Grimes 97126f9a767SRodney W. Grimes /* 97226f9a767SRodney W. Grimes * 1) Check if file execution is disabled for the filesystem that this 97326f9a767SRodney W. Grimes * file resides on. 97426f9a767SRodney W. Grimes * 2) Insure that at least one execute bit is on - otherwise root 97526f9a767SRodney W. Grimes * will always succeed, and we don't want to happen unless the 97626f9a767SRodney W. Grimes * file really is executable. 97726f9a767SRodney W. Grimes * 3) Insure that the file is a regular file. 97826f9a767SRodney W. Grimes */ 979c52007c2SDavid Greenman if ((vp->v_mount->mnt_flag & MNT_NOEXEC) || 98026f9a767SRodney W. Grimes ((attr->va_mode & 0111) == 0) || 981a854ed98SJohn Baldwin (attr->va_type != VREG)) 98226f9a767SRodney W. Grimes return (EACCES); 98326f9a767SRodney W. Grimes 98426f9a767SRodney W. Grimes /* 98526f9a767SRodney W. Grimes * Zero length files can't be exec'd 98626f9a767SRodney W. Grimes */ 98726f9a767SRodney W. Grimes if (attr->va_size == 0) 98826f9a767SRodney W. Grimes return (ENOEXEC); 98926f9a767SRodney W. Grimes 99026f9a767SRodney W. Grimes /* 99126f9a767SRodney W. Grimes * Check for execute permission to file based on current credentials. 99226f9a767SRodney W. Grimes */ 993a854ed98SJohn Baldwin error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); 99426f9a767SRodney W. Grimes if (error) 99526f9a767SRodney W. Grimes return (error); 99626f9a767SRodney W. Grimes 9976d5a0a8cSDavid Greenman /* 9986d5a0a8cSDavid Greenman * Check number of open-for-writes on the file and deny execution 9996d5a0a8cSDavid Greenman * if there are any. 10006d5a0a8cSDavid Greenman */ 10016d5a0a8cSDavid Greenman if (vp->v_writecount) 10026d5a0a8cSDavid Greenman return (ETXTBSY); 10036d5a0a8cSDavid Greenman 10046d5a0a8cSDavid Greenman /* 10056d5a0a8cSDavid Greenman * Call filesystem specific open routine (which does nothing in the 10066d5a0a8cSDavid Greenman * general case). 10076d5a0a8cSDavid Greenman */ 1008a854ed98SJohn Baldwin error = VOP_OPEN(vp, FREAD, td->td_ucred, td); 100926f9a767SRodney W. Grimes return (error); 1010df8bae1dSRodney W. Grimes } 1011aa855a59SPeter Wemm 1012aa855a59SPeter Wemm /* 1013aa855a59SPeter Wemm * Exec handler registration 1014aa855a59SPeter Wemm */ 1015aa855a59SPeter Wemm int 1016aa855a59SPeter Wemm exec_register(execsw_arg) 1017aa855a59SPeter Wemm const struct execsw *execsw_arg; 1018aa855a59SPeter Wemm { 1019aa855a59SPeter Wemm const struct execsw **es, **xs, **newexecsw; 1020aa855a59SPeter Wemm int count = 2; /* New slot and trailing NULL */ 1021aa855a59SPeter Wemm 1022aa855a59SPeter Wemm if (execsw) 1023aa855a59SPeter Wemm for (es = execsw; *es; es++) 1024aa855a59SPeter Wemm count++; 1025aa855a59SPeter Wemm newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); 1026aa855a59SPeter Wemm if (newexecsw == NULL) 1027a7cddfedSJake Burkholder return (ENOMEM); 1028aa855a59SPeter Wemm xs = newexecsw; 1029aa855a59SPeter Wemm if (execsw) 1030aa855a59SPeter Wemm for (es = execsw; *es; es++) 1031aa855a59SPeter Wemm *xs++ = *es; 1032aa855a59SPeter Wemm *xs++ = execsw_arg; 1033aa855a59SPeter Wemm *xs = NULL; 1034aa855a59SPeter Wemm if (execsw) 1035aa855a59SPeter Wemm free(execsw, M_TEMP); 1036aa855a59SPeter Wemm execsw = newexecsw; 1037a7cddfedSJake Burkholder return (0); 1038aa855a59SPeter Wemm } 1039aa855a59SPeter Wemm 1040aa855a59SPeter Wemm int 1041aa855a59SPeter Wemm exec_unregister(execsw_arg) 1042aa855a59SPeter Wemm const struct execsw *execsw_arg; 1043aa855a59SPeter Wemm { 1044aa855a59SPeter Wemm const struct execsw **es, **xs, **newexecsw; 1045aa855a59SPeter Wemm int count = 1; 1046aa855a59SPeter Wemm 1047aa855a59SPeter Wemm if (execsw == NULL) 1048aa855a59SPeter Wemm panic("unregister with no handlers left?\n"); 1049aa855a59SPeter Wemm 1050aa855a59SPeter Wemm for (es = execsw; *es; es++) { 1051aa855a59SPeter Wemm if (*es == execsw_arg) 1052aa855a59SPeter Wemm break; 1053aa855a59SPeter Wemm } 1054aa855a59SPeter Wemm if (*es == NULL) 1055a7cddfedSJake Burkholder return (ENOENT); 1056aa855a59SPeter Wemm for (es = execsw; *es; es++) 1057aa855a59SPeter Wemm if (*es != execsw_arg) 1058aa855a59SPeter Wemm count++; 1059aa855a59SPeter Wemm newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); 1060aa855a59SPeter Wemm if (newexecsw == NULL) 1061a7cddfedSJake Burkholder return (ENOMEM); 1062aa855a59SPeter Wemm xs = newexecsw; 1063aa855a59SPeter Wemm for (es = execsw; *es; es++) 1064aa855a59SPeter Wemm if (*es != execsw_arg) 1065aa855a59SPeter Wemm *xs++ = *es; 1066aa855a59SPeter Wemm *xs = NULL; 1067aa855a59SPeter Wemm if (execsw) 1068aa855a59SPeter Wemm free(execsw, M_TEMP); 1069aa855a59SPeter Wemm execsw = newexecsw; 1070a7cddfedSJake Burkholder return (0); 1071aa855a59SPeter Wemm } 107221d56e9cSAlfred Perlstein 107321d56e9cSAlfred Perlstein int 107421d56e9cSAlfred Perlstein at_exec(function) 107521d56e9cSAlfred Perlstein execlist_fn function; 107621d56e9cSAlfred Perlstein { 107721d56e9cSAlfred Perlstein struct execlist *ep; 107821d56e9cSAlfred Perlstein 107921d56e9cSAlfred Perlstein #ifdef INVARIANTS 108021d56e9cSAlfred Perlstein /* Be noisy if the programmer has lost track of things */ 108121d56e9cSAlfred Perlstein if (rm_at_exec(function)) 108221d56e9cSAlfred Perlstein printf("WARNING: exec callout entry (%p) already present\n", 108321d56e9cSAlfred Perlstein function); 108421d56e9cSAlfred Perlstein #endif 108521d56e9cSAlfred Perlstein ep = malloc(sizeof(*ep), M_ATEXEC, M_NOWAIT); 108621d56e9cSAlfred Perlstein if (ep == NULL) 108721d56e9cSAlfred Perlstein return (ENOMEM); 108821d56e9cSAlfred Perlstein ep->function = function; 108921d56e9cSAlfred Perlstein TAILQ_INSERT_TAIL(&exec_list, ep, next); 109021d56e9cSAlfred Perlstein return (0); 109121d56e9cSAlfred Perlstein } 109221d56e9cSAlfred Perlstein 109321d56e9cSAlfred Perlstein /* 109421d56e9cSAlfred Perlstein * Scan the exec callout list for the given item and remove it. 109521d56e9cSAlfred Perlstein * Returns the number of items removed (0 or 1) 109621d56e9cSAlfred Perlstein */ 109721d56e9cSAlfred Perlstein int 109821d56e9cSAlfred Perlstein rm_at_exec(function) 109921d56e9cSAlfred Perlstein execlist_fn function; 110021d56e9cSAlfred Perlstein { 110121d56e9cSAlfred Perlstein struct execlist *ep; 110221d56e9cSAlfred Perlstein 110321d56e9cSAlfred Perlstein TAILQ_FOREACH(ep, &exec_list, next) { 110421d56e9cSAlfred Perlstein if (ep->function == function) { 110521d56e9cSAlfred Perlstein TAILQ_REMOVE(&exec_list, ep, next); 110621d56e9cSAlfred Perlstein free(ep, M_ATEXEC); 110721d56e9cSAlfred Perlstein return (1); 110821d56e9cSAlfred Perlstein } 110921d56e9cSAlfred Perlstein } 111021d56e9cSAlfred Perlstein return (0); 111121d56e9cSAlfred Perlstein } 1112