xref: /freebsd/sys/kern/kern_exec.c (revision af3b2549c4ba2ef00a7cbb4cb6836598bf0aefbe)
19454b2d8SWarner Losh /*-
226f9a767SRodney W. Grimes  * Copyright (c) 1993, David Greenman
326f9a767SRodney W. Grimes  * All rights reserved.
4df8bae1dSRodney W. Grimes  *
5df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
6df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
7df8bae1dSRodney W. Grimes  * are met:
8df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
9df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
10df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
12df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
13df8bae1dSRodney W. Grimes  *
1426f9a767SRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1726f9a767SRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
25df8bae1dSRodney W. Grimes  */
26df8bae1dSRodney W. Grimes 
27677b542eSDavid E. O'Brien #include <sys/cdefs.h>
28677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
29677b542eSDavid E. O'Brien 
3012bc222eSJonathan Anderson #include "opt_capsicum.h"
314da0d332SPeter Wemm #include "opt_hwpmc_hooks.h"
321e9b3d91SPeter Wemm #include "opt_ktrace.h"
33f8a47341SAlan Cox #include "opt_vm.h"
341e9b3d91SPeter Wemm 
35df8bae1dSRodney W. Grimes #include <sys/param.h>
364a144410SRobert Watson #include <sys/capsicum.h>
3726f9a767SRodney W. Grimes #include <sys/systm.h>
3875b8b3b2SJohn Baldwin #include <sys/eventhandler.h>
39fb919e4dSMark Murray #include <sys/lock.h>
40fb919e4dSMark Murray #include <sys/mutex.h>
41d2d3e875SBruce Evans #include <sys/sysproto.h>
4226f9a767SRodney W. Grimes #include <sys/signalvar.h>
4326f9a767SRodney W. Grimes #include <sys/kernel.h>
4426f9a767SRodney W. Grimes #include <sys/mount.h>
45797f2d22SPoul-Henning Kamp #include <sys/filedesc.h>
46079cc25bSDavid Greenman #include <sys/fcntl.h>
4726f9a767SRodney W. Grimes #include <sys/acct.h>
4826f9a767SRodney W. Grimes #include <sys/exec.h>
4926f9a767SRodney W. Grimes #include <sys/imgact.h>
50e1743d02SSøren Schmidt #include <sys/imgact_elf.h>
5126f9a767SRodney W. Grimes #include <sys/wait.h>
52333ea485SGuido van Rooij #include <sys/malloc.h>
53acd3428bSRobert Watson #include <sys/priv.h>
54a794e791SBruce Evans #include <sys/proc.h>
552a024a2bSSean Eric Fagan #include <sys/pioctl.h>
56a794e791SBruce Evans #include <sys/namei.h>
576004362eSDavid Schultz #include <sys/resourcevar.h>
5889f6b863SAttilio Rao #include <sys/rwlock.h>
5944ad5475SJohn Baldwin #include <sys/sched.h>
605d217f17SJohn Birrell #include <sys/sdt.h>
6159c8bc40SAlan Cox #include <sys/sf_buf.h>
6284e0b075SDavid Xu #include <sys/syscallsubr.h>
631e1e0b44SSøren Schmidt #include <sys/sysent.h>
64797f2d22SPoul-Henning Kamp #include <sys/shm.h>
6599ac3bc8SPeter Wemm #include <sys/sysctl.h>
66a794e791SBruce Evans #include <sys/vnode.h>
67dfa7fd1dSEdward Tomasz Napierala #include <sys/stat.h>
68c781aea8SPeter Wemm #ifdef KTRACE
69c781aea8SPeter Wemm #include <sys/ktrace.h>
70c781aea8SPeter Wemm #endif
7126f9a767SRodney W. Grimes 
7226f9a767SRodney W. Grimes #include <vm/vm.h>
73efeaf95aSDavid Greenman #include <vm/vm_param.h>
74efeaf95aSDavid Greenman #include <vm/pmap.h>
751616db3cSJohn Dyson #include <vm/vm_page.h>
76efeaf95aSDavid Greenman #include <vm/vm_map.h>
7726f9a767SRodney W. Grimes #include <vm/vm_kern.h>
78efeaf95aSDavid Greenman #include <vm/vm_extern.h>
791ebd0c59SDavid Greenman #include <vm/vm_object.h>
801616db3cSJohn Dyson #include <vm/vm_pager.h>
8126f9a767SRodney W. Grimes 
82ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
83ebccf1e3SJoseph Koshy #include <sys/pmckern.h>
84ebccf1e3SJoseph Koshy #endif
85ebccf1e3SJoseph Koshy 
8626f9a767SRodney W. Grimes #include <machine/reg.h>
8726f9a767SRodney W. Grimes 
88ae1078d6SWayne Salamon #include <security/audit/audit.h>
89aed55708SRobert Watson #include <security/mac/mac_framework.h>
90ae1078d6SWayne Salamon 
915d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
925d217f17SJohn Birrell #include <sys/dtrace_bsd.h>
935d217f17SJohn Birrell dtrace_execexit_func_t	dtrace_fasttrap_exec;
945d217f17SJohn Birrell #endif
955d217f17SJohn Birrell 
965d217f17SJohn Birrell SDT_PROVIDER_DECLARE(proc);
97d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec, "char *");
98d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec__failure, "int");
99d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec__success, "char *");
1005d217f17SJohn Birrell 
101b9df5231SPoul-Henning Kamp MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
102b9df5231SPoul-Henning Kamp 
10305ba50f5SJake Burkholder static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS);
10405ba50f5SJake Burkholder static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS);
1055dadd17bSJake Burkholder static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS);
106610ecfe0SMaxim Sobolev static int do_execve(struct thread *td, struct image_args *args,
107610ecfe0SMaxim Sobolev     struct mac *mac_p);
10805ba50f5SJake Burkholder 
1099701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
11005ba50f5SJake Burkholder SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD,
11105ba50f5SJake Burkholder     NULL, 0, sysctl_kern_ps_strings, "LU", "");
112486bddb0SDoug Rabson 
1139701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
114ff66f6a4SRobert Watson SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD|
115ff66f6a4SRobert Watson     CTLFLAG_CAPRD, NULL, 0, sysctl_kern_usrstack, "LU", "");
11699ac3bc8SPeter Wemm 
1175dadd17bSJake Burkholder SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD,
1185dadd17bSJake Burkholder     NULL, 0, sysctl_kern_stackprot, "I", "");
1195dadd17bSJake Burkholder 
120b9df5231SPoul-Henning Kamp u_long ps_arg_cache_limit = PAGE_SIZE / 16;
121c3699b5fSPeter Wemm SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
1229701cd40SJohn Baldwin     &ps_arg_cache_limit, 0, "");
123b9df5231SPoul-Henning Kamp 
124eda6009cSKonstantin Belousov static int disallow_high_osrel;
125eda6009cSKonstantin Belousov SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW,
126eda6009cSKonstantin Belousov     &disallow_high_osrel, 0,
127eda6009cSKonstantin Belousov     "Disallow execution of binaries built for higher version of the world");
128eda6009cSKonstantin Belousov 
129878adb85SBjoern A. Zeeb static int map_at_zero = 0;
130*af3b2549SHans Petter Selasky SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RWTUN, &map_at_zero, 0,
131878adb85SBjoern A. Zeeb     "Permit processes to map an object at virtual address 0.");
132878adb85SBjoern A. Zeeb 
13305ba50f5SJake Burkholder static int
13405ba50f5SJake Burkholder sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
13505ba50f5SJake Burkholder {
13605ba50f5SJake Burkholder 	struct proc *p;
137df7c361eSPeter Wemm 	int error;
13805ba50f5SJake Burkholder 
13905ba50f5SJake Burkholder 	p = curproc;
140a7bc3102SPeter Wemm #ifdef SCTL_MASK32
141a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
142df7c361eSPeter Wemm 		unsigned int val;
143df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_psstrings;
144df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
145df7c361eSPeter Wemm 	} else
146df7c361eSPeter Wemm #endif
147df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings,
148df7c361eSPeter Wemm 		   sizeof(p->p_sysent->sv_psstrings));
149df7c361eSPeter Wemm 	return error;
15005ba50f5SJake Burkholder }
15105ba50f5SJake Burkholder 
15205ba50f5SJake Burkholder static int
15305ba50f5SJake Burkholder sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS)
15405ba50f5SJake Burkholder {
15505ba50f5SJake Burkholder 	struct proc *p;
156df7c361eSPeter Wemm 	int error;
15705ba50f5SJake Burkholder 
15805ba50f5SJake Burkholder 	p = curproc;
159a7bc3102SPeter Wemm #ifdef SCTL_MASK32
160a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
161df7c361eSPeter Wemm 		unsigned int val;
162df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_usrstack;
163df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
164df7c361eSPeter Wemm 	} else
165df7c361eSPeter Wemm #endif
166df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack,
167df7c361eSPeter Wemm 		    sizeof(p->p_sysent->sv_usrstack));
168df7c361eSPeter Wemm 	return error;
16905ba50f5SJake Burkholder }
17005ba50f5SJake Burkholder 
1715dadd17bSJake Burkholder static int
1725dadd17bSJake Burkholder sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS)
1735dadd17bSJake Burkholder {
1745dadd17bSJake Burkholder 	struct proc *p;
1755dadd17bSJake Burkholder 
1765dadd17bSJake Burkholder 	p = curproc;
1775dadd17bSJake Burkholder 	return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot,
1785dadd17bSJake Burkholder 	    sizeof(p->p_sysent->sv_stackprot)));
1795dadd17bSJake Burkholder }
1805dadd17bSJake Burkholder 
18199ac3bc8SPeter Wemm /*
182aa855a59SPeter Wemm  * Each of the items is a pointer to a `const struct execsw', hence the
183aa855a59SPeter Wemm  * double pointer here.
184df8bae1dSRodney W. Grimes  */
185aa855a59SPeter Wemm static const struct execsw **execsw;
18626f9a767SRodney W. Grimes 
187ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
188ca46e90eSBruce Evans struct execve_args {
189ca46e90eSBruce Evans 	char    *fname;
190ca46e90eSBruce Evans 	char    **argv;
191ca46e90eSBruce Evans 	char    **envv;
192ca46e90eSBruce Evans };
193ca46e90eSBruce Evans #endif
194ca46e90eSBruce Evans 
195ca46e90eSBruce Evans int
1968451d0ddSKip Macy sys_execve(td, uap)
197ca46e90eSBruce Evans 	struct thread *td;
198ca46e90eSBruce Evans 	struct execve_args /* {
199ca46e90eSBruce Evans 		char *fname;
200ca46e90eSBruce Evans 		char **argv;
201ca46e90eSBruce Evans 		char **envv;
202ca46e90eSBruce Evans 	} */ *uap;
203ca46e90eSBruce Evans {
204610ecfe0SMaxim Sobolev 	int error;
205610ecfe0SMaxim Sobolev 	struct image_args args;
206ca46e90eSBruce Evans 
207610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
208610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
209610ecfe0SMaxim Sobolev 	if (error == 0)
210610ecfe0SMaxim Sobolev 		error = kern_execve(td, &args, NULL);
211610ecfe0SMaxim Sobolev 	return (error);
212ca46e90eSBruce Evans }
213ca46e90eSBruce Evans 
214ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
215632dbc19SKonstantin Belousov struct fexecve_args {
216632dbc19SKonstantin Belousov 	int	fd;
217632dbc19SKonstantin Belousov 	char	**argv;
218632dbc19SKonstantin Belousov 	char	**envv;
219632dbc19SKonstantin Belousov }
220632dbc19SKonstantin Belousov #endif
221632dbc19SKonstantin Belousov int
2228451d0ddSKip Macy sys_fexecve(struct thread *td, struct fexecve_args *uap)
223632dbc19SKonstantin Belousov {
224632dbc19SKonstantin Belousov 	int error;
225632dbc19SKonstantin Belousov 	struct image_args args;
226632dbc19SKonstantin Belousov 
227632dbc19SKonstantin Belousov 	error = exec_copyin_args(&args, NULL, UIO_SYSSPACE,
228632dbc19SKonstantin Belousov 	    uap->argv, uap->envv);
229632dbc19SKonstantin Belousov 	if (error == 0) {
230632dbc19SKonstantin Belousov 		args.fd = uap->fd;
231632dbc19SKonstantin Belousov 		error = kern_execve(td, &args, NULL);
232632dbc19SKonstantin Belousov 	}
233632dbc19SKonstantin Belousov 	return (error);
234632dbc19SKonstantin Belousov }
235632dbc19SKonstantin Belousov 
236632dbc19SKonstantin Belousov #ifndef _SYS_SYSPROTO_H_
237ca46e90eSBruce Evans struct __mac_execve_args {
238ca46e90eSBruce Evans 	char	*fname;
239ca46e90eSBruce Evans 	char	**argv;
240ca46e90eSBruce Evans 	char	**envv;
241ca46e90eSBruce Evans 	struct mac	*mac_p;
242ca46e90eSBruce Evans };
243ca46e90eSBruce Evans #endif
244ca46e90eSBruce Evans 
245ca46e90eSBruce Evans int
2468451d0ddSKip Macy sys___mac_execve(td, uap)
247ca46e90eSBruce Evans 	struct thread *td;
248ca46e90eSBruce Evans 	struct __mac_execve_args /* {
249ca46e90eSBruce Evans 		char *fname;
250ca46e90eSBruce Evans 		char **argv;
251ca46e90eSBruce Evans 		char **envv;
252ca46e90eSBruce Evans 		struct mac *mac_p;
253ca46e90eSBruce Evans 	} */ *uap;
254ca46e90eSBruce Evans {
255ca46e90eSBruce Evans #ifdef MAC
256610ecfe0SMaxim Sobolev 	int error;
257610ecfe0SMaxim Sobolev 	struct image_args args;
258610ecfe0SMaxim Sobolev 
259610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
260610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
261610ecfe0SMaxim Sobolev 	if (error == 0)
262610ecfe0SMaxim Sobolev 		error = kern_execve(td, &args, uap->mac_p);
263610ecfe0SMaxim Sobolev 	return (error);
264ca46e90eSBruce Evans #else
265ca46e90eSBruce Evans 	return (ENOSYS);
266ca46e90eSBruce Evans #endif
267ca46e90eSBruce Evans }
268ca46e90eSBruce Evans 
26933812c06SColin Percival /*
270873fbcd7SRobert Watson  * XXX: kern_execve has the astonishing property of not always returning to
271873fbcd7SRobert Watson  * the caller.  If sufficiently bad things happen during the call to
272873fbcd7SRobert Watson  * do_execve(), it can end up calling exit1(); as a result, callers must
273873fbcd7SRobert Watson  * avoid doing anything which they might need to undo (e.g., allocating
274873fbcd7SRobert Watson  * memory).
27533812c06SColin Percival  */
27684e0b075SDavid Xu int
277610ecfe0SMaxim Sobolev kern_execve(td, args, mac_p)
278906ac69dSDavid Xu 	struct thread *td;
279610ecfe0SMaxim Sobolev 	struct image_args *args;
280906ac69dSDavid Xu 	struct mac *mac_p;
281906ac69dSDavid Xu {
282906ac69dSDavid Xu 	struct proc *p = td->td_proc;
2837032434eSKonstantin Belousov 	struct vmspace *oldvmspace;
284906ac69dSDavid Xu 	int error;
285906ac69dSDavid Xu 
28614961ba7SRobert Watson 	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
287ae1078d6SWayne Salamon 	    args->begin_envv - args->begin_argv);
28814961ba7SRobert Watson 	AUDIT_ARG_ENVV(args->begin_envv, args->envc,
289ae1078d6SWayne Salamon 	    args->endp - args->begin_envv);
290906ac69dSDavid Xu 	if (p->p_flag & P_HADTHREADS) {
291906ac69dSDavid Xu 		PROC_LOCK(p);
292906ac69dSDavid Xu 		if (thread_single(SINGLE_BOUNDARY)) {
293906ac69dSDavid Xu 			PROC_UNLOCK(p);
29468ff3c24SStephan Uphoff 	       		exec_free_args(args);
295906ac69dSDavid Xu 			return (ERESTART);	/* Try again later. */
296906ac69dSDavid Xu 		}
297906ac69dSDavid Xu 		PROC_UNLOCK(p);
298906ac69dSDavid Xu 	}
299906ac69dSDavid Xu 
3007032434eSKonstantin Belousov 	KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve"));
3017032434eSKonstantin Belousov 	oldvmspace = td->td_proc->p_vmspace;
302610ecfe0SMaxim Sobolev 	error = do_execve(td, args, mac_p);
303906ac69dSDavid Xu 
304906ac69dSDavid Xu 	if (p->p_flag & P_HADTHREADS) {
305906ac69dSDavid Xu 		PROC_LOCK(p);
306906ac69dSDavid Xu 		/*
307906ac69dSDavid Xu 		 * If success, we upgrade to SINGLE_EXIT state to
308906ac69dSDavid Xu 		 * force other threads to suicide.
309906ac69dSDavid Xu 		 */
310906ac69dSDavid Xu 		if (error == 0)
311906ac69dSDavid Xu 			thread_single(SINGLE_EXIT);
312906ac69dSDavid Xu 		else
313906ac69dSDavid Xu 			thread_single_end();
314906ac69dSDavid Xu 		PROC_UNLOCK(p);
315906ac69dSDavid Xu 	}
3167032434eSKonstantin Belousov 	if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
3177032434eSKonstantin Belousov 		KASSERT(td->td_proc->p_vmspace != oldvmspace,
3187032434eSKonstantin Belousov 		    ("oldvmspace still used"));
3197032434eSKonstantin Belousov 		vmspace_free(oldvmspace);
3207032434eSKonstantin Belousov 		td->td_pflags &= ~TDP_EXECVMSPC;
3217032434eSKonstantin Belousov 	}
322906ac69dSDavid Xu 
323906ac69dSDavid Xu 	return (error);
324906ac69dSDavid Xu }
325906ac69dSDavid Xu 
32626f9a767SRodney W. Grimes /*
327450ffb44SRobert Watson  * In-kernel implementation of execve().  All arguments are assumed to be
328450ffb44SRobert Watson  * userspace pointers from the passed thread.
32926f9a767SRodney W. Grimes  */
330450ffb44SRobert Watson static int
331610ecfe0SMaxim Sobolev do_execve(td, args, mac_p)
332b40ce416SJulian Elischer 	struct thread *td;
333610ecfe0SMaxim Sobolev 	struct image_args *args;
334670cb89bSRobert Watson 	struct mac *mac_p;
335df8bae1dSRodney W. Grimes {
336b40ce416SJulian Elischer 	struct proc *p = td->td_proc;
33769c9eff8SEd Schouten 	struct nameidata nd;
3389b3b1c5fSJohn Baldwin 	struct ucred *newcred = NULL, *oldcred;
3391419eacbSAlfred Perlstein 	struct uidinfo *euip;
340654f6be1SBruce Evans 	register_t *stack_base;
3415ca4819dSJohn Baldwin 	int error, i;
342c52007c2SDavid Greenman 	struct image_params image_params, *imgp;
3439f5c1d19SDiomidis Spinellis 	struct vattr attr;
3444d77a549SAlfred Perlstein 	int (*img_first)(struct image_params *);
34569be5db9SAlfred Perlstein 	struct pargs *oldargs = NULL, *newargs = NULL;
34690af4afaSJohn Baldwin 	struct sigacts *oldsigacts, *newsigacts;
3476c84de02SJohn Baldwin #ifdef KTRACE
3486c84de02SJohn Baldwin 	struct vnode *tracevp = NULL;
349a5881ea5SJohn Baldwin 	struct ucred *tracecred = NULL;
3506c84de02SJohn Baldwin #endif
351632dbc19SKonstantin Belousov 	struct vnode *textvp = NULL, *binvp = NULL;
3527008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
353d06c0d4dSRobert Watson 	int credential_changing;
354619eb6e5SJeff Roberson 	int textset;
355ccafe7ebSRobert Watson #ifdef MAC
3566356dba0SRobert Watson 	struct label *interpvplabel = NULL;
357eca8a663SRobert Watson 	int will_transition;
358ccafe7ebSRobert Watson #endif
35915139246SJoseph Koshy #ifdef HWPMC_HOOKS
36015139246SJoseph Koshy 	struct pmckern_procexec pe;
36115139246SJoseph Koshy #endif
362632dbc19SKonstantin Belousov 	static const char fexecv_proc_title[] = "(fexecv)";
36326f9a767SRodney W. Grimes 
364c52007c2SDavid Greenman 	imgp = &image_params;
365df8bae1dSRodney W. Grimes 
3669ca45e81SDag-Erling Smørgrav 	/*
3679ca45e81SDag-Erling Smørgrav 	 * Lock the process and set the P_INEXEC flag to indicate that
3689ca45e81SDag-Erling Smørgrav 	 * it should be left alone until we're done here.  This is
3699ca45e81SDag-Erling Smørgrav 	 * necessary to avoid race conditions - e.g. in ptrace() -
3709ca45e81SDag-Erling Smørgrav 	 * that might allow a local user to illicitly obtain elevated
3719ca45e81SDag-Erling Smørgrav 	 * privileges.
3729ca45e81SDag-Erling Smørgrav 	 */
3739ca45e81SDag-Erling Smørgrav 	PROC_LOCK(p);
3749ca45e81SDag-Erling Smørgrav 	KASSERT((p->p_flag & P_INEXEC) == 0,
37591f91617SDavid E. O'Brien 	    ("%s(): process already has P_INEXEC flag", __func__));
3769ca45e81SDag-Erling Smørgrav 	p->p_flag |= P_INEXEC;
3779ca45e81SDag-Erling Smørgrav 	PROC_UNLOCK(p);
3789ca45e81SDag-Erling Smørgrav 
379df8bae1dSRodney W. Grimes 	/*
380c52007c2SDavid Greenman 	 * Initialize part of the common data
381df8bae1dSRodney W. Grimes 	 */
382c52007c2SDavid Greenman 	imgp->proc = p;
383670cb89bSRobert Watson 	imgp->execlabel = NULL;
384c52007c2SDavid Greenman 	imgp->attr = &attr;
385c52007c2SDavid Greenman 	imgp->entry_addr = 0;
386a0ea661fSNathan Whitehorn 	imgp->reloc_base = 0;
387c52007c2SDavid Greenman 	imgp->vmspace_destroyed = 0;
388c52007c2SDavid Greenman 	imgp->interpreted = 0;
3899a75ea23SKonstantin Belousov 	imgp->opened = 0;
3902af6e14dSAlan Cox 	imgp->interpreter_name = NULL;
391e1743d02SSøren Schmidt 	imgp->auxargs = NULL;
3921616db3cSJohn Dyson 	imgp->vp = NULL;
3930b2ed1aeSJeff Roberson 	imgp->object = NULL;
3941616db3cSJohn Dyson 	imgp->firstpage = NULL;
3954fe88fe6SJohn Polstra 	imgp->ps_strings = 0;
396b9a22da4STakanori Watanabe 	imgp->auxarg_size = 0;
397610ecfe0SMaxim Sobolev 	imgp->args = args;
3983ff06357SKonstantin Belousov 	imgp->execpath = imgp->freepath = NULL;
3993ff06357SKonstantin Belousov 	imgp->execpathp = 0;
400ee235befSKonstantin Belousov 	imgp->canary = 0;
401ee235befSKonstantin Belousov 	imgp->canarylen = 0;
402ee235befSKonstantin Belousov 	imgp->pagesizes = 0;
403ee235befSKonstantin Belousov 	imgp->pagesizeslen = 0;
4046297a3d8SKonstantin Belousov 	imgp->stack_prot = 0;
40526f9a767SRodney W. Grimes 
406670cb89bSRobert Watson #ifdef MAC
407eca8a663SRobert Watson 	error = mac_execve_enter(imgp, mac_p);
408532c491bSJeff Roberson 	if (error)
409670cb89bSRobert Watson 		goto exec_fail;
410670cb89bSRobert Watson #endif
411670cb89bSRobert Watson 
41259c8bc40SAlan Cox 	imgp->image_header = NULL;
41326f9a767SRodney W. Grimes 
41426f9a767SRodney W. Grimes 	/*
41526f9a767SRodney W. Grimes 	 * Translate the file name. namei() returns a vnode pointer
41626f9a767SRodney W. Grimes 	 *	in ni_vp amoung other things.
417ae1078d6SWayne Salamon 	 *
418ae1078d6SWayne Salamon 	 * XXXAUDIT: It would be desirable to also audit the name of the
419ae1078d6SWayne Salamon 	 * interpreter if this is an interpreted binary.
42026f9a767SRodney W. Grimes 	 */
421632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
42269c9eff8SEd Schouten 		NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME
4235050aa86SKonstantin Belousov 		    | AUDITVNODE1, UIO_SYSSPACE, args->fname, td);
424632dbc19SKonstantin Belousov 	}
42526f9a767SRodney W. Grimes 
426e506f34bSCraig Rodrigues 	SDT_PROBE(proc, kernel, , exec, args->fname, 0, 0, 0, 0 );
427e506f34bSCraig Rodrigues 
42826f9a767SRodney W. Grimes interpret:
429632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
43012bc222eSJonathan Anderson #ifdef CAPABILITY_MODE
43112bc222eSJonathan Anderson 		/*
43212bc222eSJonathan Anderson 		 * While capability mode can't reach this point via direct
43312bc222eSJonathan Anderson 		 * path arguments to execve(), we also don't allow
43412bc222eSJonathan Anderson 		 * interpreters to be used in capability mode (for now).
43512bc222eSJonathan Anderson 		 * Catch indirect lookups and return a permissions error.
43612bc222eSJonathan Anderson 		 */
43712bc222eSJonathan Anderson 		if (IN_CAPABILITY_MODE(td)) {
43812bc222eSJonathan Anderson 			error = ECAPMODE;
43912bc222eSJonathan Anderson 			goto exec_fail;
44012bc222eSJonathan Anderson 		}
44112bc222eSJonathan Anderson #endif
44269c9eff8SEd Schouten 		error = namei(&nd);
443610ecfe0SMaxim Sobolev 		if (error)
44426f9a767SRodney W. Grimes 			goto exec_fail;
44526f9a767SRodney W. Grimes 
44669c9eff8SEd Schouten 		binvp  = nd.ni_vp;
447632dbc19SKonstantin Belousov 		imgp->vp = binvp;
448632dbc19SKonstantin Belousov 	} else {
44914961ba7SRobert Watson 		AUDIT_ARG_FD(args->fd);
450a9d2f8d8SRobert Watson 		/*
451c8e781f6SPawel Jakub Dawidek 		 * Descriptors opened only with O_EXEC or O_RDONLY are allowed.
452a9d2f8d8SRobert Watson 		 */
4537008be5bSPawel Jakub Dawidek 		error = fgetvp_exec(td, args->fd,
4547008be5bSPawel Jakub Dawidek 		    cap_rights_init(&rights, CAP_FEXECVE), &binvp);
455632dbc19SKonstantin Belousov 		if (error)
456632dbc19SKonstantin Belousov 			goto exec_fail;
457632dbc19SKonstantin Belousov 		vn_lock(binvp, LK_EXCLUSIVE | LK_RETRY);
458b146fc1bSRobert Watson 		AUDIT_ARG_VNODE1(binvp);
459632dbc19SKonstantin Belousov 		imgp->vp = binvp;
460632dbc19SKonstantin Belousov 	}
46126f9a767SRodney W. Grimes 
46226f9a767SRodney W. Grimes 	/*
4639022e4adSDavid Greenman 	 * Check file permissions (also 'opens' file)
4649022e4adSDavid Greenman 	 */
465c52007c2SDavid Greenman 	error = exec_check_permissions(imgp);
466619eb6e5SJeff Roberson 	if (error)
46726f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
468619eb6e5SJeff Roberson 
4698516dd18SPoul-Henning Kamp 	imgp->object = imgp->vp->v_object;
4708516dd18SPoul-Henning Kamp 	if (imgp->object != NULL)
4710b2ed1aeSJeff Roberson 		vm_object_reference(imgp->object);
47226f9a767SRodney W. Grimes 
473619eb6e5SJeff Roberson 	/*
474619eb6e5SJeff Roberson 	 * Set VV_TEXT now so no one can write to the executable while we're
475619eb6e5SJeff Roberson 	 * activating it.
476619eb6e5SJeff Roberson 	 *
477619eb6e5SJeff Roberson 	 * Remember if this was set before and unset it in case this is not
478619eb6e5SJeff Roberson 	 * actually an executable image.
479619eb6e5SJeff Roberson 	 */
480877d24acSKonstantin Belousov 	textset = VOP_IS_TEXT(imgp->vp);
481877d24acSKonstantin Belousov 	VOP_SET_TEXT(imgp->vp);
482619eb6e5SJeff Roberson 
4831616db3cSJohn Dyson 	error = exec_map_first_page(imgp);
4846d5a0a8cSDavid Greenman 	if (error)
48526f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
48626f9a767SRodney W. Grimes 
487f231de47SKonstantin Belousov 	imgp->proc->p_osrel = 0;
48826f9a767SRodney W. Grimes 	/*
489d323ddf3SMatthew Dillon 	 *	If the current process has a special image activator it
490d323ddf3SMatthew Dillon 	 *	wants to try first, call it.   For example, emulating shell
491d323ddf3SMatthew Dillon 	 *	scripts differently.
49226f9a767SRodney W. Grimes 	 */
493d323ddf3SMatthew Dillon 	error = -1;
494d323ddf3SMatthew Dillon 	if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
495d323ddf3SMatthew Dillon 		error = img_first(imgp);
496d323ddf3SMatthew Dillon 
497d323ddf3SMatthew Dillon 	/*
498d323ddf3SMatthew Dillon 	 *	Loop through the list of image activators, calling each one.
499d323ddf3SMatthew Dillon 	 *	An activator returns -1 if there is no match, 0 on success,
500d323ddf3SMatthew Dillon 	 *	and an error otherwise.
501d323ddf3SMatthew Dillon 	 */
502d323ddf3SMatthew Dillon 	for (i = 0; error == -1 && execsw[i]; ++i) {
503d323ddf3SMatthew Dillon 		if (execsw[i]->ex_imgact == NULL ||
504d323ddf3SMatthew Dillon 		    execsw[i]->ex_imgact == img_first) {
505d323ddf3SMatthew Dillon 			continue;
506d323ddf3SMatthew Dillon 		}
507c52007c2SDavid Greenman 		error = (*execsw[i]->ex_imgact)(imgp);
508d323ddf3SMatthew Dillon 	}
509d323ddf3SMatthew Dillon 
510d323ddf3SMatthew Dillon 	if (error) {
511619eb6e5SJeff Roberson 		if (error == -1) {
512877d24acSKonstantin Belousov 			if (textset == 0)
513877d24acSKonstantin Belousov 				VOP_UNSET_TEXT(imgp->vp);
514d323ddf3SMatthew Dillon 			error = ENOEXEC;
515619eb6e5SJeff Roberson 		}
51626f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
517d323ddf3SMatthew Dillon 	}
518d323ddf3SMatthew Dillon 
519d323ddf3SMatthew Dillon 	/*
520d323ddf3SMatthew Dillon 	 * Special interpreter operation, cleanup and loop up to try to
521d323ddf3SMatthew Dillon 	 * activate the interpreter.
522d323ddf3SMatthew Dillon 	 */
523c52007c2SDavid Greenman 	if (imgp->interpreted) {
5241616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
525619eb6e5SJeff Roberson 		/*
526619eb6e5SJeff Roberson 		 * VV_TEXT needs to be unset for scripts.  There is a short
527619eb6e5SJeff Roberson 		 * period before we determine that something is a script where
528619eb6e5SJeff Roberson 		 * VV_TEXT will be set. The vnode lock is held over this
529619eb6e5SJeff Roberson 		 * entire period so nothing should illegitimately be blocked.
530619eb6e5SJeff Roberson 		 */
531877d24acSKonstantin Belousov 		VOP_UNSET_TEXT(imgp->vp);
532762e6b85SEivind Eklund 		/* free name buffer and old vnode */
533632dbc19SKonstantin Belousov 		if (args->fname != NULL)
53469c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
535670cb89bSRobert Watson #ifdef MAC
5366356dba0SRobert Watson 		mac_execve_interpreter_enter(binvp, &interpvplabel);
537670cb89bSRobert Watson #endif
5389a75ea23SKonstantin Belousov 		if (imgp->opened) {
5399a75ea23SKonstantin Belousov 			VOP_CLOSE(binvp, FREAD, td->td_ucred, td);
5409a75ea23SKonstantin Belousov 			imgp->opened = 0;
5419a75ea23SKonstantin Belousov 		}
542632dbc19SKonstantin Belousov 		vput(binvp);
5430b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
5440b2ed1aeSJeff Roberson 		imgp->object = NULL;
54526f9a767SRodney W. Grimes 		/* set new name to that of the interpreter */
5465050aa86SKonstantin Belousov 		NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
547b40ce416SJulian Elischer 		    UIO_SYSSPACE, imgp->interpreter_name, td);
548632dbc19SKonstantin Belousov 		args->fname = imgp->interpreter_name;
54926f9a767SRodney W. Grimes 		goto interpret;
55026f9a767SRodney W. Grimes 	}
55126f9a767SRodney W. Grimes 
55226f9a767SRodney W. Grimes 	/*
553ded7d39cSChristian S.J. Peron 	 * NB: We unlock the vnode here because it is believed that none
554ded7d39cSChristian S.J. Peron 	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
555ded7d39cSChristian S.J. Peron 	 */
556ded7d39cSChristian S.J. Peron 	VOP_UNLOCK(imgp->vp, 0);
5573ff06357SKonstantin Belousov 
5583ff06357SKonstantin Belousov 	/*
5593ff06357SKonstantin Belousov 	 * Do the best to calculate the full path to the image file.
5603ff06357SKonstantin Belousov 	 */
5613ff06357SKonstantin Belousov 	if (imgp->auxargs != NULL &&
5623ff06357SKonstantin Belousov 	    ((args->fname != NULL && args->fname[0] == '/') ||
5633ff06357SKonstantin Belousov 	     vn_fullpath(td, imgp->vp, &imgp->execpath, &imgp->freepath) != 0))
5643ff06357SKonstantin Belousov 		imgp->execpath = args->fname;
5653ff06357SKonstantin Belousov 
566eda6009cSKonstantin Belousov 	if (disallow_high_osrel &&
567eda6009cSKonstantin Belousov 	    P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) {
568eda6009cSKonstantin Belousov 		error = ENOEXEC;
569eda6009cSKonstantin Belousov 		uprintf("Osrel %d for image %s too high\n", p->p_osrel,
570eda6009cSKonstantin Belousov 		    imgp->execpath != NULL ? imgp->execpath : "<unresolved>");
571eda6009cSKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
572eda6009cSKonstantin Belousov 		goto exec_fail_dealloc;
573eda6009cSKonstantin Belousov 	}
574eda6009cSKonstantin Belousov 
575ded7d39cSChristian S.J. Peron 	/*
57626f9a767SRodney W. Grimes 	 * Copy out strings (args and env) and initialize stack base
57726f9a767SRodney W. Grimes 	 */
5783ebc1248SPeter Wemm 	if (p->p_sysent->sv_copyout_strings)
5793ebc1248SPeter Wemm 		stack_base = (*p->p_sysent->sv_copyout_strings)(imgp);
5803ebc1248SPeter Wemm 	else
581c52007c2SDavid Greenman 		stack_base = exec_copyout_strings(imgp);
58226f9a767SRodney W. Grimes 
58326f9a767SRodney W. Grimes 	/*
5841e1e0b44SSøren Schmidt 	 * If custom stack fixup routine present for this process
5851e1e0b44SSøren Schmidt 	 * let it do the stack setup.
5861e1e0b44SSøren Schmidt 	 * Else stuff argument count as first item on stack
58726f9a767SRodney W. Grimes 	 */
588d6c847f3SBruce Evans 	if (p->p_sysent->sv_fixup != NULL)
589c52007c2SDavid Greenman 		(*p->p_sysent->sv_fixup)(&stack_base, imgp);
5901e1e0b44SSøren Schmidt 	else
591610ecfe0SMaxim Sobolev 		suword(--stack_base, imgp->args->argc);
59226f9a767SRodney W. Grimes 
593a78e8d2aSDavid Greenman 	/*
594a78e8d2aSDavid Greenman 	 * For security and other reasons, the file descriptor table cannot
595a78e8d2aSDavid Greenman 	 * be shared after an exec.
596a78e8d2aSDavid Greenman 	 */
597c113083cSPoul-Henning Kamp 	fdunshare(p, td);
598a78e8d2aSDavid Greenman 
599333ea485SGuido van Rooij 	/*
6009b3b1c5fSJohn Baldwin 	 * Malloc things before we need locks.
6019b3b1c5fSJohn Baldwin 	 */
6029b3b1c5fSJohn Baldwin 	newcred = crget();
6031419eacbSAlfred Perlstein 	euip = uifind(attr.va_uid);
604610ecfe0SMaxim Sobolev 	i = imgp->args->begin_envv - imgp->args->begin_argv;
6055997cae9SDon Lewis 	/* Cache arguments if they fit inside our allowance */
6065997cae9SDon Lewis 	if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
6079b3b1c5fSJohn Baldwin 		newargs = pargs_alloc(i);
6085997cae9SDon Lewis 		bcopy(imgp->args->begin_argv, newargs->ar_args, i);
6095997cae9SDon Lewis 	}
6109b3b1c5fSJohn Baldwin 
6119b3b1c5fSJohn Baldwin 	/* close files on exec */
6129b3b1c5fSJohn Baldwin 	fdcloseexec(td);
6132974cc36SKonstantin Belousov 	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
6149b3b1c5fSJohn Baldwin 
615619eb6e5SJeff Roberson 	/* Get a reference to the vnode prior to locking the proc */
616632dbc19SKonstantin Belousov 	VREF(binvp);
617619eb6e5SJeff Roberson 
6189b3b1c5fSJohn Baldwin 	/*
619333ea485SGuido van Rooij 	 * For security and other reasons, signal handlers cannot
6208688bb93SJohn Baldwin 	 * be shared after an exec. The new process gets a copy of the old
621b2c3fa70SDima Dorfman 	 * handlers. In execsigs(), the new process will have its signals
622333ea485SGuido van Rooij 	 * reset.
623333ea485SGuido van Rooij 	 */
6249b3b1c5fSJohn Baldwin 	PROC_LOCK(p);
625838d9858SBrooks Davis 	oldcred = crcopysafe(p, newcred);
62690af4afaSJohn Baldwin 	if (sigacts_shared(p->p_sigacts)) {
62790af4afaSJohn Baldwin 		oldsigacts = p->p_sigacts;
6289b3b1c5fSJohn Baldwin 		PROC_UNLOCK(p);
62990af4afaSJohn Baldwin 		newsigacts = sigacts_alloc();
63090af4afaSJohn Baldwin 		sigacts_copy(newsigacts, oldsigacts);
6319b3b1c5fSJohn Baldwin 		PROC_LOCK(p);
63290af4afaSJohn Baldwin 		p->p_sigacts = newsigacts;
63390af4afaSJohn Baldwin 	} else
63490af4afaSJohn Baldwin 		oldsigacts = NULL;
635333ea485SGuido van Rooij 
636fdf4e8b3SWarner Losh 	/* Stop profiling */
637fdf4e8b3SWarner Losh 	stopprofclock(p);
638fdf4e8b3SWarner Losh 
63926f9a767SRodney W. Grimes 	/* reset caught signals */
64026f9a767SRodney W. Grimes 	execsigs(p);
64126f9a767SRodney W. Grimes 
64226f9a767SRodney W. Grimes 	/* name this process - nameiexec(p, ndp) */
6435ca4819dSJohn Baldwin 	bzero(p->p_comm, sizeof(p->p_comm));
6445ca4819dSJohn Baldwin 	if (args->fname)
6455ca4819dSJohn Baldwin 		bcopy(nd.ni_cnd.cn_nameptr, p->p_comm,
6465ca4819dSJohn Baldwin 		    min(nd.ni_cnd.cn_namelen, MAXCOMLEN));
6475ca4819dSJohn Baldwin 	else if (vn_commname(binvp, p->p_comm, sizeof(p->p_comm)) != 0)
6485ca4819dSJohn Baldwin 		bcopy(fexecv_proc_title, p->p_comm, sizeof(fexecv_proc_title));
649ca081fdbSJulian Elischer 	bcopy(p->p_comm, td->td_name, sizeof(td->td_name));
65044ad5475SJohn Baldwin #ifdef KTR
65144ad5475SJohn Baldwin 	sched_clear_tdname(td);
65244ad5475SJohn Baldwin #endif
65326f9a767SRodney W. Grimes 
65426f9a767SRodney W. Grimes 	/*
65524b34f09SSujal Patel 	 * mark as execed, wakeup the process that vforked (if any) and tell
656dc733423SDag-Erling Smørgrav 	 * it that it now has its own resources back
65726f9a767SRodney W. Grimes 	 */
65826f9a767SRodney W. Grimes 	p->p_flag |= P_EXEC;
65926f9a767SRodney W. Grimes 	if (p->p_pptr && (p->p_flag & P_PPWAIT)) {
660888d4d4fSKonstantin Belousov 		p->p_flag &= ~(P_PPWAIT | P_PPTRACE);
661aeb32571SKonstantin Belousov 		cv_broadcast(&p->p_pwait);
66226f9a767SRodney W. Grimes 	}
66326f9a767SRodney W. Grimes 
66426f9a767SRodney W. Grimes 	/*
665a78e8d2aSDavid Greenman 	 * Implement image setuid/setgid.
666a78e8d2aSDavid Greenman 	 *
667a78e8d2aSDavid Greenman 	 * Don't honor setuid/setgid if the filesystem prohibits it or if
668a78e8d2aSDavid Greenman 	 * the process is being traced.
669670cb89bSRobert Watson 	 *
67012bc222eSJonathan Anderson 	 * We disable setuid/setgid/etc in compatibility mode on the basis
67112bc222eSJonathan Anderson 	 * that most setugid applications are not written with that
67212bc222eSJonathan Anderson 	 * environment in mind, and will therefore almost certainly operate
67312bc222eSJonathan Anderson 	 * incorrectly. In principle there's no reason that setugid
67412bc222eSJonathan Anderson 	 * applications might not be useful in capability mode, so we may want
67512bc222eSJonathan Anderson 	 * to reconsider this conservative design choice in the future.
67612bc222eSJonathan Anderson 	 *
677670cb89bSRobert Watson 	 * XXXMAC: For the time being, use NOSUID to also prohibit
678670cb89bSRobert Watson 	 * transitions on the file system.
679c52007c2SDavid Greenman 	 */
680d06c0d4dSRobert Watson 	credential_changing = 0;
681dfa7fd1dSEdward Tomasz Napierala 	credential_changing |= (attr.va_mode & S_ISUID) && oldcred->cr_uid !=
682d06c0d4dSRobert Watson 	    attr.va_uid;
683dfa7fd1dSEdward Tomasz Napierala 	credential_changing |= (attr.va_mode & S_ISGID) && oldcred->cr_gid !=
684d06c0d4dSRobert Watson 	    attr.va_gid;
685ccafe7ebSRobert Watson #ifdef MAC
68630d239bcSRobert Watson 	will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp,
6876356dba0SRobert Watson 	    interpvplabel, imgp);
688ccafe7ebSRobert Watson 	credential_changing |= will_transition;
689ccafe7ebSRobert Watson #endif
690d06c0d4dSRobert Watson 
691d06c0d4dSRobert Watson 	if (credential_changing &&
69212bc222eSJonathan Anderson #ifdef CAPABILITY_MODE
69312bc222eSJonathan Anderson 	    ((oldcred->cr_flags & CRED_FLAG_CAPMODE) == 0) &&
69412bc222eSJonathan Anderson #endif
695a78e8d2aSDavid Greenman 	    (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
696c52007c2SDavid Greenman 	    (p->p_flag & P_TRACED) == 0) {
697c52007c2SDavid Greenman 		/*
698c52007c2SDavid Greenman 		 * Turn off syscall tracing for set-id programs, except for
699b85db196SPeter Wemm 		 * root.  Record any set-id flags first to make sure that
700b85db196SPeter Wemm 		 * we do not regain any tracing during a possible block.
70126f9a767SRodney W. Grimes 		 */
702b85db196SPeter Wemm 		setsugid(p);
703acd3428bSRobert Watson 
7046c84de02SJohn Baldwin #ifdef KTRACE
705c331c970SAndriy Gapon 		if (p->p_tracecred != NULL &&
706c331c970SAndriy Gapon 		    priv_check_cred(p->p_tracecred, PRIV_DEBUG_DIFFCRED, 0))
707d680caabSJohn Baldwin 			ktrprocexec(p, &tracecred, &tracevp);
7086c84de02SJohn Baldwin #endif
70928b325aaSDon Lewis 		/*
710c1e2d386SNate Lawson 		 * Close any file descriptors 0..2 that reference procfs,
711c1e2d386SNate Lawson 		 * then make sure file descriptors 0..2 are in use.
71228b325aaSDon Lewis 		 *
713c1e2d386SNate Lawson 		 * setugidsafety() may call closef() and then pfind()
714c1e2d386SNate Lawson 		 * which may grab the process lock.
71528b325aaSDon Lewis 		 * fdcheckstd() may call falloc() which may block to
71628b325aaSDon Lewis 		 * allocate memory, so temporarily drop the process lock.
71728b325aaSDon Lewis 		 */
71828b325aaSDon Lewis 		PROC_UNLOCK(p);
71922db15c0SAttilio Rao 		VOP_UNLOCK(imgp->vp, 0);
72087eca70eSJohn Baldwin 		setugidsafety(td);
721e983a376SJacques Vidrine 		error = fdcheckstd(td);
7222974cc36SKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
72363c9e754SJohn Baldwin 		if (error != 0)
72469be5db9SAlfred Perlstein 			goto done1;
725e1b1aa3bSJohn Baldwin 		PROC_LOCK(p);
726c52007c2SDavid Greenman 		/*
727c52007c2SDavid Greenman 		 * Set the new credentials.
728c52007c2SDavid Greenman 		 */
729dfa7fd1dSEdward Tomasz Napierala 		if (attr.va_mode & S_ISUID)
7301419eacbSAlfred Perlstein 			change_euid(newcred, euip);
731dfa7fd1dSEdward Tomasz Napierala 		if (attr.va_mode & S_ISGID)
732b1fc0ec1SRobert Watson 			change_egid(newcred, attr.va_gid);
733ccafe7ebSRobert Watson #ifdef MAC
734670cb89bSRobert Watson 		if (will_transition) {
73530d239bcSRobert Watson 			mac_vnode_execve_transition(oldcred, newcred, imgp->vp,
7366356dba0SRobert Watson 			    interpvplabel, imgp);
737670cb89bSRobert Watson 		}
738ccafe7ebSRobert Watson #endif
7399b3b1c5fSJohn Baldwin 		/*
7409b3b1c5fSJohn Baldwin 		 * Implement correct POSIX saved-id behavior.
741ccafe7ebSRobert Watson 		 *
742ccafe7ebSRobert Watson 		 * XXXMAC: Note that the current logic will save the
743ccafe7ebSRobert Watson 		 * uid and gid if a MAC domain transition occurs, even
744ccafe7ebSRobert Watson 		 * though maybe it shouldn't.
7459b3b1c5fSJohn Baldwin 		 */
7469b3b1c5fSJohn Baldwin 		change_svuid(newcred, newcred->cr_uid);
7479b3b1c5fSJohn Baldwin 		change_svgid(newcred, newcred->cr_gid);
7489b3b1c5fSJohn Baldwin 		p->p_ucred = newcred;
7499b3b1c5fSJohn Baldwin 		newcred = NULL;
750c52007c2SDavid Greenman 	} else {
751b1fc0ec1SRobert Watson 		if (oldcred->cr_uid == oldcred->cr_ruid &&
752b1fc0ec1SRobert Watson 		    oldcred->cr_gid == oldcred->cr_rgid)
753c52007c2SDavid Greenman 			p->p_flag &= ~P_SUGID;
75426f9a767SRodney W. Grimes 		/*
755c52007c2SDavid Greenman 		 * Implement correct POSIX saved-id behavior.
756b1fc0ec1SRobert Watson 		 *
757b1fc0ec1SRobert Watson 		 * XXX: It's not clear that the existing behavior is
7589b3b1c5fSJohn Baldwin 		 * POSIX-compliant.  A number of sources indicate that the
7599b3b1c5fSJohn Baldwin 		 * saved uid/gid should only be updated if the new ruid is
7609b3b1c5fSJohn Baldwin 		 * not equal to the old ruid, or the new euid is not equal
7619b3b1c5fSJohn Baldwin 		 * to the old euid and the new euid is not equal to the old
7629b3b1c5fSJohn Baldwin 		 * ruid.  The FreeBSD code always updates the saved uid/gid.
7639b3b1c5fSJohn Baldwin 		 * Also, this code uses the new (replaced) euid and egid as
7649b3b1c5fSJohn Baldwin 		 * the source, which may or may not be the right ones to use.
76526f9a767SRodney W. Grimes 		 */
766b1fc0ec1SRobert Watson 		if (oldcred->cr_svuid != oldcred->cr_uid ||
767b1fc0ec1SRobert Watson 		    oldcred->cr_svgid != oldcred->cr_gid) {
768b1fc0ec1SRobert Watson 			change_svuid(newcred, newcred->cr_uid);
769b1fc0ec1SRobert Watson 			change_svgid(newcred, newcred->cr_gid);
770b1fc0ec1SRobert Watson 			p->p_ucred = newcred;
7719b3b1c5fSJohn Baldwin 			newcred = NULL;
7729b3b1c5fSJohn Baldwin 		}
773b1fc0ec1SRobert Watson 	}
77426f9a767SRodney W. Grimes 
77526f9a767SRodney W. Grimes 	/*
776619eb6e5SJeff Roberson 	 * Store the vp for use in procfs.  This vnode was referenced prior
777619eb6e5SJeff Roberson 	 * to locking the proc lock.
7782a531c80SDavid Greenman 	 */
7799b3b1c5fSJohn Baldwin 	textvp = p->p_textvp;
780632dbc19SKonstantin Belousov 	p->p_textvp = binvp;
7812a531c80SDavid Greenman 
7825d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
7835d217f17SJohn Birrell 	/*
7845d217f17SJohn Birrell 	 * Tell the DTrace fasttrap provider about the exec if it
7855d217f17SJohn Birrell 	 * has declared an interest.
7865d217f17SJohn Birrell 	 */
7875d217f17SJohn Birrell 	if (dtrace_fasttrap_exec)
7885d217f17SJohn Birrell 		dtrace_fasttrap_exec(p);
7895d217f17SJohn Birrell #endif
7905d217f17SJohn Birrell 
7912a531c80SDavid Greenman 	/*
7929ca45e81SDag-Erling Smørgrav 	 * Notify others that we exec'd, and clear the P_INEXEC flag
7939ca45e81SDag-Erling Smørgrav 	 * as we're now a bona fide freshly-execed process.
794cb679c38SJonathan Lemon 	 */
795ad3b9257SJohn-Mark Gurney 	KNOTE_LOCKED(&p->p_klist, NOTE_EXEC);
7969ca45e81SDag-Erling Smørgrav 	p->p_flag &= ~P_INEXEC;
797cb679c38SJonathan Lemon 
79826f9a767SRodney W. Grimes 	/* clear "fork but no exec" flag, as we _are_ execing */
79926f9a767SRodney W. Grimes 	p->p_acflag &= ~AFORK;
80026f9a767SRodney W. Grimes 
8015997cae9SDon Lewis 	/*
80234ea500bSDon Lewis 	 * Free any previous argument cache and replace it with
8035997cae9SDon Lewis 	 * the new argument cache, if any.
8045997cae9SDon Lewis 	 */
8059b3b1c5fSJohn Baldwin 	oldargs = p->p_args;
806e1b1aa3bSJohn Baldwin 	p->p_args = newargs;
807e1b1aa3bSJohn Baldwin 	newargs = NULL;
808ebccf1e3SJoseph Koshy 
809ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
810ebccf1e3SJoseph Koshy 	/*
811f263522aSJoseph Koshy 	 * Check if system-wide sampling is in effect or if the
812f263522aSJoseph Koshy 	 * current process is using PMCs.  If so, do exec() time
813ebccf1e3SJoseph Koshy 	 * processing.  This processing needs to happen AFTER the
814ebccf1e3SJoseph Koshy 	 * P_INEXEC flag is cleared.
815ebccf1e3SJoseph Koshy 	 *
816ebccf1e3SJoseph Koshy 	 * The proc lock needs to be released before taking the PMC
817ebccf1e3SJoseph Koshy 	 * SX.
818ebccf1e3SJoseph Koshy 	 */
819f263522aSJoseph Koshy 	if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
820e1b1aa3bSJohn Baldwin 		PROC_UNLOCK(p);
8211ef6ea9bSKonstantin Belousov 		VOP_UNLOCK(imgp->vp, 0);
82215139246SJoseph Koshy 		pe.pm_credentialschanged = credential_changing;
82315139246SJoseph Koshy 		pe.pm_entryaddr = imgp->entry_addr;
82415139246SJoseph Koshy 
82515139246SJoseph Koshy 		PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
8262974cc36SKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
827ebccf1e3SJoseph Koshy 	} else
828ebccf1e3SJoseph Koshy 		PROC_UNLOCK(p);
829ebccf1e3SJoseph Koshy #else  /* !HWPMC_HOOKS */
830ebccf1e3SJoseph Koshy 	PROC_UNLOCK(p);
831ebccf1e3SJoseph Koshy #endif
832e1b1aa3bSJohn Baldwin 
833e913ca22SDoug Rabson 	/* Set values passed into the program in registers. */
8343ebc1248SPeter Wemm 	if (p->p_sysent->sv_setregs)
835a107d8aaSNathan Whitehorn 		(*p->p_sysent->sv_setregs)(td, imgp,
836a107d8aaSNathan Whitehorn 		    (u_long)(uintptr_t)stack_base);
8373ebc1248SPeter Wemm 	else
838a107d8aaSNathan Whitehorn 		exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base);
839e913ca22SDoug Rabson 
8400359a12eSAttilio Rao 	vfs_mark_atime(imgp->vp, td->td_ucred);
8416341095eSKen Smith 
842d9fae5abSAndriy Gapon 	SDT_PROBE(proc, kernel, , exec__success, args->fname, 0, 0, 0, 0);
8435d217f17SJohn Birrell 
844e506f34bSCraig Rodrigues done1:
8459b3b1c5fSJohn Baldwin 	/*
8469b3b1c5fSJohn Baldwin 	 * Free any resources malloc'd earlier that we didn't use.
8479b3b1c5fSJohn Baldwin 	 */
8481419eacbSAlfred Perlstein 	uifree(euip);
8499b3b1c5fSJohn Baldwin 	if (newcred == NULL)
8509b3b1c5fSJohn Baldwin 		crfree(oldcred);
8519b3b1c5fSJohn Baldwin 	else
8529b3b1c5fSJohn Baldwin 		crfree(newcred);
85322db15c0SAttilio Rao 	VOP_UNLOCK(imgp->vp, 0);
8545d217f17SJohn Birrell 
8559b3b1c5fSJohn Baldwin 	/*
8569b3b1c5fSJohn Baldwin 	 * Handle deferred decrement of ref counts.
8579b3b1c5fSJohn Baldwin 	 */
8585050aa86SKonstantin Belousov 	if (textvp != NULL)
8599b3b1c5fSJohn Baldwin 		vrele(textvp);
860632dbc19SKonstantin Belousov 	if (binvp && error != 0)
861632dbc19SKonstantin Belousov 		vrele(binvp);
8626c84de02SJohn Baldwin #ifdef KTRACE
8635050aa86SKonstantin Belousov 	if (tracevp != NULL)
8649b3b1c5fSJohn Baldwin 		vrele(tracevp);
865a5881ea5SJohn Baldwin 	if (tracecred != NULL)
866a5881ea5SJohn Baldwin 		crfree(tracecred);
8676c84de02SJohn Baldwin #endif
8682974cc36SKonstantin Belousov 	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
8699b3b1c5fSJohn Baldwin 	pargs_drop(oldargs);
87069be5db9SAlfred Perlstein 	pargs_drop(newargs);
87190af4afaSJohn Baldwin 	if (oldsigacts != NULL)
87290af4afaSJohn Baldwin 		sigacts_free(oldsigacts);
873b9df5231SPoul-Henning Kamp 
8741616db3cSJohn Dyson exec_fail_dealloc:
8751616db3cSJohn Dyson 
87626f9a767SRodney W. Grimes 	/*
87726f9a767SRodney W. Grimes 	 * free various allocated resources
87826f9a767SRodney W. Grimes 	 */
879d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
8801616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
88126f9a767SRodney W. Grimes 
882d6c847f3SBruce Evans 	if (imgp->vp != NULL) {
883632dbc19SKonstantin Belousov 		if (args->fname)
88469c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
8859a75ea23SKonstantin Belousov 		if (imgp->opened)
8869a75ea23SKonstantin Belousov 			VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td);
887619eb6e5SJeff Roberson 		vput(imgp->vp);
888a3cf6ebaSDavid Greenman 	}
88926f9a767SRodney W. Grimes 
890d6c847f3SBruce Evans 	if (imgp->object != NULL)
8910b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
8920b2ed1aeSJeff Roberson 
8933ff06357SKonstantin Belousov 	free(imgp->freepath, M_TEMP);
8943ff06357SKonstantin Belousov 
895d1989db5SRobert Drehmel 	if (error == 0) {
896afe1a688SKonstantin Belousov 		PROC_LOCK(p);
897afe1a688SKonstantin Belousov 		td->td_dbgflags |= TDB_EXEC;
898afe1a688SKonstantin Belousov 		PROC_UNLOCK(p);
899afe1a688SKonstantin Belousov 
900d1989db5SRobert Drehmel 		/*
901d1989db5SRobert Drehmel 		 * Stop the process here if its stop event mask has
902d1989db5SRobert Drehmel 		 * the S_EXEC bit set.
903d1989db5SRobert Drehmel 		 */
904d1989db5SRobert Drehmel 		STOPEVENT(p, S_EXEC, 0);
905116734c4SMatthew Dillon 		goto done2;
906d1989db5SRobert Drehmel 	}
9071616db3cSJohn Dyson 
90826f9a767SRodney W. Grimes exec_fail:
9099ca45e81SDag-Erling Smørgrav 	/* we're done here, clear P_INEXEC */
9109ca45e81SDag-Erling Smørgrav 	PROC_LOCK(p);
9119ca45e81SDag-Erling Smørgrav 	p->p_flag &= ~P_INEXEC;
9129ca45e81SDag-Erling Smørgrav 	PROC_UNLOCK(p);
9139ca45e81SDag-Erling Smørgrav 
914d9fae5abSAndriy Gapon 	SDT_PROBE(proc, kernel, , exec__failure, error, 0, 0, 0, 0);
9155d217f17SJohn Birrell 
916116734c4SMatthew Dillon done2:
917670cb89bSRobert Watson #ifdef MAC
918670cb89bSRobert Watson 	mac_execve_exit(imgp);
9196356dba0SRobert Watson 	mac_execve_interpreter_exit(interpvplabel);
920670cb89bSRobert Watson #endif
9218917b8d2SJohn Baldwin 	exec_free_args(args);
9228917b8d2SJohn Baldwin 
9238917b8d2SJohn Baldwin 	if (error && imgp->vmspace_destroyed) {
9248917b8d2SJohn Baldwin 		/* sorry, no more process anymore. exit gracefully */
9258917b8d2SJohn Baldwin 		exit1(td, W_EXITCODE(0, SIGABRT));
9268917b8d2SJohn Baldwin 		/* NOT REACHED */
9278917b8d2SJohn Baldwin 	}
9287705d4b2SDmitry Chagin 
9297705d4b2SDmitry Chagin #ifdef KTRACE
9307705d4b2SDmitry Chagin 	if (error == 0)
9317705d4b2SDmitry Chagin 		ktrprocctor(p);
9327705d4b2SDmitry Chagin #endif
9337705d4b2SDmitry Chagin 
934116734c4SMatthew Dillon 	return (error);
93526f9a767SRodney W. Grimes }
93626f9a767SRodney W. Grimes 
9371616db3cSJohn Dyson int
9381616db3cSJohn Dyson exec_map_first_page(imgp)
9391616db3cSJohn Dyson 	struct image_params *imgp;
9401616db3cSJohn Dyson {
941d8aad40cSJohn Baldwin 	int rv, i;
94295461b45SJohn Dyson 	int initial_pagein;
94395461b45SJohn Dyson 	vm_page_t ma[VM_INITIAL_PAGEIN];
9441616db3cSJohn Dyson 	vm_object_t object;
9451616db3cSJohn Dyson 
946d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
9471616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
9481616db3cSJohn Dyson 
9498516dd18SPoul-Henning Kamp 	object = imgp->vp->v_object;
9504d7d2993SJeff Roberson 	if (object == NULL)
9514d7d2993SJeff Roberson 		return (EACCES);
95289f6b863SAttilio Rao 	VM_OBJECT_WLOCK(object);
953f8a47341SAlan Cox #if VM_NRESERVLEVEL > 0
954f8a47341SAlan Cox 	if ((object->flags & OBJ_COLORED) == 0) {
955f8a47341SAlan Cox 		object->flags |= OBJ_COLORED;
956f8a47341SAlan Cox 		object->pg_color = 0;
957f8a47341SAlan Cox 	}
958f8a47341SAlan Cox #endif
9595944de8eSKonstantin Belousov 	ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL);
9600a2e596aSAlan Cox 	if (ma[0]->valid != VM_PAGE_BITS_ALL) {
96195461b45SJohn Dyson 		initial_pagein = VM_INITIAL_PAGEIN;
96295461b45SJohn Dyson 		if (initial_pagein > object->size)
96395461b45SJohn Dyson 			initial_pagein = object->size;
96495461b45SJohn Dyson 		for (i = 1; i < initial_pagein; i++) {
96541890423SAlan Cox 			if ((ma[i] = vm_page_next(ma[i - 1])) != NULL) {
9666ec2fca5SAlan Cox 				if (ma[i]->valid)
9676ec2fca5SAlan Cox 					break;
968c7aebda8SAttilio Rao 				if (vm_page_tryxbusy(ma[i]))
96906fa71cdSAlan Cox 					break;
97095461b45SJohn Dyson 			} else {
971ca0387efSJake Burkholder 				ma[i] = vm_page_alloc(object, i,
9727bfda801SAlan Cox 				    VM_ALLOC_NORMAL | VM_ALLOC_IFNOTCACHED);
97395461b45SJohn Dyson 				if (ma[i] == NULL)
97495461b45SJohn Dyson 					break;
97595461b45SJohn Dyson 			}
97695461b45SJohn Dyson 		}
97795461b45SJohn Dyson 		initial_pagein = i;
97895461b45SJohn Dyson 		rv = vm_pager_get_pages(object, ma, initial_pagein, 0);
97995461b45SJohn Dyson 		ma[0] = vm_page_lookup(object, 0);
980d1a6e42dSAlan Cox 		if ((rv != VM_PAGER_OK) || (ma[0] == NULL)) {
981eb00b276SAlan Cox 			if (ma[0] != NULL) {
9825ac59343SAlan Cox 				vm_page_lock(ma[0]);
9838f9110f6SJohn Dyson 				vm_page_free(ma[0]);
9845ac59343SAlan Cox 				vm_page_unlock(ma[0]);
9856ec2fca5SAlan Cox 			}
98689f6b863SAttilio Rao 			VM_OBJECT_WUNLOCK(object);
987a7cddfedSJake Burkholder 			return (EIO);
9881616db3cSJohn Dyson 		}
9891616db3cSJohn Dyson 	}
990c7aebda8SAttilio Rao 	vm_page_xunbusy(ma[0]);
9912965a453SKip Macy 	vm_page_lock(ma[0]);
992be996836SAttilio Rao 	vm_page_hold(ma[0]);
9932965a453SKip Macy 	vm_page_unlock(ma[0]);
99489f6b863SAttilio Rao 	VM_OBJECT_WUNLOCK(object);
9951616db3cSJohn Dyson 
99659c8bc40SAlan Cox 	imgp->firstpage = sf_buf_alloc(ma[0], 0);
99759c8bc40SAlan Cox 	imgp->image_header = (char *)sf_buf_kva(imgp->firstpage);
9981616db3cSJohn Dyson 
999a7cddfedSJake Burkholder 	return (0);
10001616db3cSJohn Dyson }
10011616db3cSJohn Dyson 
10021616db3cSJohn Dyson void
10031616db3cSJohn Dyson exec_unmap_first_page(imgp)
10041616db3cSJohn Dyson 	struct image_params *imgp;
10051616db3cSJohn Dyson {
100659c8bc40SAlan Cox 	vm_page_t m;
100723955314SAlfred Perlstein 
1008d6c847f3SBruce Evans 	if (imgp->firstpage != NULL) {
100959c8bc40SAlan Cox 		m = sf_buf_page(imgp->firstpage);
101059c8bc40SAlan Cox 		sf_buf_free(imgp->firstpage);
10111616db3cSJohn Dyson 		imgp->firstpage = NULL;
10122965a453SKip Macy 		vm_page_lock(m);
1013be996836SAttilio Rao 		vm_page_unhold(m);
10142965a453SKip Macy 		vm_page_unlock(m);
10151616db3cSJohn Dyson 	}
10161616db3cSJohn Dyson }
10171616db3cSJohn Dyson 
101826f9a767SRodney W. Grimes /*
101926f9a767SRodney W. Grimes  * Destroy old address space, and allocate a new stack
102026f9a767SRodney W. Grimes  *	The new stack is only SGROWSIZ large because it is grown
102126f9a767SRodney W. Grimes  *	automatically in trap.c.
102226f9a767SRodney W. Grimes  */
102326f9a767SRodney W. Grimes int
102405ba50f5SJake Burkholder exec_new_vmspace(imgp, sv)
1025c52007c2SDavid Greenman 	struct image_params *imgp;
102605ba50f5SJake Burkholder 	struct sysentvec *sv;
102726f9a767SRodney W. Grimes {
102826f9a767SRodney W. Grimes 	int error;
10295e20c11fSAlan Cox 	struct proc *p = imgp->proc;
10305e20c11fSAlan Cox 	struct vmspace *vmspace = p->p_vmspace;
10316297a3d8SKonstantin Belousov 	vm_object_t obj;
1032878adb85SBjoern A. Zeeb 	vm_offset_t sv_minuser, stack_addr;
103305ba50f5SJake Burkholder 	vm_map_t map;
103459d8f3ffSJohn Baldwin 	u_long ssiz;
103526f9a767SRodney W. Grimes 
1036c52007c2SDavid Greenman 	imgp->vmspace_destroyed = 1;
1037993182e5SAlexander Leidinger 	imgp->sysent = sv;
103826f9a767SRodney W. Grimes 
1039bd37fd72SKris Kennaway 	/* May be called with Giant held */
1040993182e5SAlexander Leidinger 	EVENTHANDLER_INVOKE(process_exec, p, imgp);
10416f5dafeaSAlan Cox 
10426f5dafeaSAlan Cox 	/*
1043af9ec885SJohn Dyson 	 * Blow away entire process VM, if address space not shared,
1044af9ec885SJohn Dyson 	 * otherwise, create a new VM space so that other threads are
1045af9ec885SJohn Dyson 	 * not disrupted
1046af9ec885SJohn Dyson 	 */
104705ba50f5SJake Burkholder 	map = &vmspace->vm_map;
1048878adb85SBjoern A. Zeeb 	if (map_at_zero)
1049878adb85SBjoern A. Zeeb 		sv_minuser = sv->sv_minuser;
1050878adb85SBjoern A. Zeeb 	else
1051878adb85SBjoern A. Zeeb 		sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
1052878adb85SBjoern A. Zeeb 	if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser &&
105305ba50f5SJake Burkholder 	    vm_map_max(map) == sv->sv_maxuser) {
10543db161e0SMatthew Dillon 		shmexit(vmspace);
1055b9eee07eSPeter Wemm 		pmap_remove_pages(vmspace_pmap(vmspace));
105605ba50f5SJake Burkholder 		vm_map_remove(map, vm_map_min(map), vm_map_max(map));
1057af9ec885SJohn Dyson 	} else {
1058878adb85SBjoern A. Zeeb 		error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
105989b57fcfSKonstantin Belousov 		if (error)
106089b57fcfSKonstantin Belousov 			return (error);
10615e20c11fSAlan Cox 		vmspace = p->p_vmspace;
106205ba50f5SJake Burkholder 		map = &vmspace->vm_map;
1063af9ec885SJohn Dyson 	}
106426f9a767SRodney W. Grimes 
10656297a3d8SKonstantin Belousov 	/* Map a shared page */
10666297a3d8SKonstantin Belousov 	obj = sv->sv_shared_page_obj;
10676297a3d8SKonstantin Belousov 	if (obj != NULL) {
10686297a3d8SKonstantin Belousov 		vm_object_reference(obj);
10696297a3d8SKonstantin Belousov 		error = vm_map_fixed(map, obj, 0,
10706297a3d8SKonstantin Belousov 		    sv->sv_shared_page_base, sv->sv_shared_page_len,
10711e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
10721e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
10731e65d73cSKonstantin Belousov 		    MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE);
10746297a3d8SKonstantin Belousov 		if (error) {
10756297a3d8SKonstantin Belousov 			vm_object_deallocate(obj);
10766297a3d8SKonstantin Belousov 			return (error);
10776297a3d8SKonstantin Belousov 		}
10786297a3d8SKonstantin Belousov 	}
10796297a3d8SKonstantin Belousov 
108026f9a767SRodney W. Grimes 	/* Allocate a new stack */
108159d8f3ffSJohn Baldwin 	if (sv->sv_maxssiz != NULL)
108259d8f3ffSJohn Baldwin 		ssiz = *sv->sv_maxssiz;
108359d8f3ffSJohn Baldwin 	else
108459d8f3ffSJohn Baldwin 		ssiz = maxssiz;
108559d8f3ffSJohn Baldwin 	stack_addr = sv->sv_usrstack - ssiz;
108659d8f3ffSJohn Baldwin 	error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz,
10876297a3d8SKonstantin Belousov 	    obj != NULL && imgp->stack_prot != 0 ? imgp->stack_prot :
10886297a3d8SKonstantin Belousov 		sv->sv_stackprot,
10896297a3d8SKonstantin Belousov 	    VM_PROT_ALL, MAP_STACK_GROWS_DOWN);
10902267af78SJulian Elischer 	if (error)
10912267af78SJulian Elischer 		return (error);
10922267af78SJulian Elischer 
109363c47a5cSDoug Rabson #ifdef __ia64__
1094fd75d710SMarcel Moolenaar 	/* Allocate a new register stack */
1095bab1f052SMarcel Moolenaar 	stack_addr = IA64_BACKINGSTORE;
109659d8f3ffSJohn Baldwin 	error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz,
1097fd75d710SMarcel Moolenaar 	    sv->sv_stackprot, VM_PROT_ALL, MAP_STACK_GROWS_UP);
1098fd75d710SMarcel Moolenaar 	if (error)
1099fd75d710SMarcel Moolenaar 		return (error);
110063c47a5cSDoug Rabson #endif
110163c47a5cSDoug Rabson 
110278960940SAlan Cox 	/*
110378960940SAlan Cox 	 * vm_ssize and vm_maxsaddr are somewhat antiquated concepts, but they
110478960940SAlan Cox 	 * are still used to enforce the stack rlimit on the process stack.
11052267af78SJulian Elischer 	 */
1106cbc89bfbSPaul Saab 	vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT;
110759d8f3ffSJohn Baldwin 	vmspace->vm_maxsaddr = (char *)sv->sv_usrstack - ssiz;
110826f9a767SRodney W. Grimes 
110926f9a767SRodney W. Grimes 	return (0);
111026f9a767SRodney W. Grimes }
111126f9a767SRodney W. Grimes 
111226f9a767SRodney W. Grimes /*
1113873fbcd7SRobert Watson  * Copy out argument and environment strings from the old process address
1114873fbcd7SRobert Watson  * space into the temporary string buffer.
111526f9a767SRodney W. Grimes  */
111626f9a767SRodney W. Grimes int
1117610ecfe0SMaxim Sobolev exec_copyin_args(struct image_args *args, char *fname,
1118610ecfe0SMaxim Sobolev     enum uio_seg segflg, char **argv, char **envv)
111926f9a767SRodney W. Grimes {
112026f9a767SRodney W. Grimes 	char *argp, *envp;
1121ecbb00a2SDoug Rabson 	int error;
1122ecbb00a2SDoug Rabson 	size_t length;
112326f9a767SRodney W. Grimes 
1124610ecfe0SMaxim Sobolev 	bzero(args, sizeof(*args));
1125610ecfe0SMaxim Sobolev 	if (argv == NULL)
1126610ecfe0SMaxim Sobolev 		return (EFAULT);
11272af6e14dSAlan Cox 
112826f9a767SRodney W. Grimes 	/*
11292af6e14dSAlan Cox 	 * Allocate demand-paged memory for the file name, argument, and
11302af6e14dSAlan Cox 	 * environment strings.
113126f9a767SRodney W. Grimes 	 */
11322af6e14dSAlan Cox 	error = exec_alloc_args(args);
11332af6e14dSAlan Cox 	if (error != 0)
11342af6e14dSAlan Cox 		return (error);
11359e4e5114SAlan Cox 
1136610ecfe0SMaxim Sobolev 	/*
1137610ecfe0SMaxim Sobolev 	 * Copy the file name.
1138610ecfe0SMaxim Sobolev 	 */
1139632dbc19SKonstantin Belousov 	if (fname != NULL) {
11402af6e14dSAlan Cox 		args->fname = args->buf;
1141610ecfe0SMaxim Sobolev 		error = (segflg == UIO_SYSSPACE) ?
1142610ecfe0SMaxim Sobolev 		    copystr(fname, args->fname, PATH_MAX, &length) :
1143610ecfe0SMaxim Sobolev 		    copyinstr(fname, args->fname, PATH_MAX, &length);
1144c30af532SMaxim Sobolev 		if (error != 0)
114568ff3c24SStephan Uphoff 			goto err_exit;
1146632dbc19SKonstantin Belousov 	} else
11479e4e5114SAlan Cox 		length = 0;
11489e4e5114SAlan Cox 
11492af6e14dSAlan Cox 	args->begin_argv = args->buf + length;
11509e4e5114SAlan Cox 	args->endp = args->begin_argv;
11519e4e5114SAlan Cox 	args->stringspace = ARG_MAX;
115226f9a767SRodney W. Grimes 
1153610ecfe0SMaxim Sobolev 	/*
1154610ecfe0SMaxim Sobolev 	 * extract arguments first
1155610ecfe0SMaxim Sobolev 	 */
1156610ecfe0SMaxim Sobolev 	while ((argp = (caddr_t) (intptr_t) fuword(argv++))) {
115768ff3c24SStephan Uphoff 		if (argp == (caddr_t) -1) {
115868ff3c24SStephan Uphoff 			error = EFAULT;
115968ff3c24SStephan Uphoff 			goto err_exit;
116068ff3c24SStephan Uphoff 		}
1161610ecfe0SMaxim Sobolev 		if ((error = copyinstr(argp, args->endp,
1162610ecfe0SMaxim Sobolev 		    args->stringspace, &length))) {
1163610ecfe0SMaxim Sobolev 			if (error == ENAMETOOLONG)
116468ff3c24SStephan Uphoff 				error = E2BIG;
116568ff3c24SStephan Uphoff 			goto err_exit;
1166610ecfe0SMaxim Sobolev 		}
1167610ecfe0SMaxim Sobolev 		args->stringspace -= length;
1168610ecfe0SMaxim Sobolev 		args->endp += length;
1169610ecfe0SMaxim Sobolev 		args->argc++;
1170610ecfe0SMaxim Sobolev 	}
1171610ecfe0SMaxim Sobolev 
1172610ecfe0SMaxim Sobolev 	args->begin_envv = args->endp;
1173b9df5231SPoul-Henning Kamp 
117426f9a767SRodney W. Grimes 	/*
117526f9a767SRodney W. Grimes 	 * extract environment strings
117626f9a767SRodney W. Grimes 	 */
11770fd1a014SDavid Greenman 	if (envv) {
1178aae0aa45SBruce Evans 		while ((envp = (caddr_t)(intptr_t)fuword(envv++))) {
117968ff3c24SStephan Uphoff 			if (envp == (caddr_t)-1) {
118068ff3c24SStephan Uphoff 				error = EFAULT;
118168ff3c24SStephan Uphoff 				goto err_exit;
118268ff3c24SStephan Uphoff 			}
1183610ecfe0SMaxim Sobolev 			if ((error = copyinstr(envp, args->endp,
1184610ecfe0SMaxim Sobolev 			    args->stringspace, &length))) {
11850fd1a014SDavid Greenman 				if (error == ENAMETOOLONG)
118668ff3c24SStephan Uphoff 					error = E2BIG;
118768ff3c24SStephan Uphoff 				goto err_exit;
11880fd1a014SDavid Greenman 			}
1189610ecfe0SMaxim Sobolev 			args->stringspace -= length;
1190610ecfe0SMaxim Sobolev 			args->endp += length;
1191610ecfe0SMaxim Sobolev 			args->envc++;
119226f9a767SRodney W. Grimes 		}
11930fd1a014SDavid Greenman 	}
119426f9a767SRodney W. Grimes 
119526f9a767SRodney W. Grimes 	return (0);
119668ff3c24SStephan Uphoff 
119768ff3c24SStephan Uphoff err_exit:
119868ff3c24SStephan Uphoff 	exec_free_args(args);
119968ff3c24SStephan Uphoff 	return (error);
120026f9a767SRodney W. Grimes }
120126f9a767SRodney W. Grimes 
12022af6e14dSAlan Cox /*
12032af6e14dSAlan Cox  * Allocate temporary demand-paged, zero-filled memory for the file name,
12042af6e14dSAlan Cox  * argument, and environment strings.  Returns zero if the allocation succeeds
12052af6e14dSAlan Cox  * and ENOMEM otherwise.
12062af6e14dSAlan Cox  */
12072af6e14dSAlan Cox int
12082af6e14dSAlan Cox exec_alloc_args(struct image_args *args)
12092af6e14dSAlan Cox {
12102af6e14dSAlan Cox 
12115df87b21SJeff Roberson 	args->buf = (char *)kmap_alloc_wait(exec_map, PATH_MAX + ARG_MAX);
12122af6e14dSAlan Cox 	return (args->buf != NULL ? 0 : ENOMEM);
12132af6e14dSAlan Cox }
12142af6e14dSAlan Cox 
121569a8f9e3SAlan Cox void
1216610ecfe0SMaxim Sobolev exec_free_args(struct image_args *args)
1217610ecfe0SMaxim Sobolev {
1218610ecfe0SMaxim Sobolev 
121969a8f9e3SAlan Cox 	if (args->buf != NULL) {
12205df87b21SJeff Roberson 		kmap_free_wakeup(exec_map, (vm_offset_t)args->buf,
12212af6e14dSAlan Cox 		    PATH_MAX + ARG_MAX);
1222610ecfe0SMaxim Sobolev 		args->buf = NULL;
1223610ecfe0SMaxim Sobolev 	}
1224a14a9498SAlan Cox 	if (args->fname_buf != NULL) {
1225a14a9498SAlan Cox 		free(args->fname_buf, M_TEMP);
1226a14a9498SAlan Cox 		args->fname_buf = NULL;
1227a14a9498SAlan Cox 	}
1228610ecfe0SMaxim Sobolev }
1229610ecfe0SMaxim Sobolev 
123026f9a767SRodney W. Grimes /*
1231873fbcd7SRobert Watson  * Copy strings out to the new process address space, constructing new arg
1232873fbcd7SRobert Watson  * and env vector tables. Return a pointer to the base so that it can be used
1233873fbcd7SRobert Watson  * as the initial stack pointer.
123426f9a767SRodney W. Grimes  */
1235654f6be1SBruce Evans register_t *
1236c52007c2SDavid Greenman exec_copyout_strings(imgp)
1237c52007c2SDavid Greenman 	struct image_params *imgp;
123826f9a767SRodney W. Grimes {
123926f9a767SRodney W. Grimes 	int argc, envc;
124026f9a767SRodney W. Grimes 	char **vectp;
124188b124ceSKonstantin Belousov 	char *stringp;
124288b124ceSKonstantin Belousov 	uintptr_t destp;
1243654f6be1SBruce Evans 	register_t *stack_base;
124493f6448cSDavid Greenman 	struct ps_strings *arginfo;
1245f3bec5d7SJake Burkholder 	struct proc *p;
12463ff06357SKonstantin Belousov 	size_t execpath_len;
1247ee235befSKonstantin Belousov 	int szsigcode, szps;
1248ee235befSKonstantin Belousov 	char canary[sizeof(long) * 8];
124926f9a767SRodney W. Grimes 
1250ee235befSKonstantin Belousov 	szps = sizeof(pagesizes[0]) * MAXPAGESIZES;
125126f9a767SRodney W. Grimes 	/*
125226f9a767SRodney W. Grimes 	 * Calculate string base and vector table pointers.
1253d66a5066SPeter Wemm 	 * Also deal with signal trampoline code for this exec type.
125426f9a767SRodney W. Grimes 	 */
12553ff06357SKonstantin Belousov 	if (imgp->execpath != NULL && imgp->auxargs != NULL)
12563ff06357SKonstantin Belousov 		execpath_len = strlen(imgp->execpath) + 1;
12573ff06357SKonstantin Belousov 	else
12583ff06357SKonstantin Belousov 		execpath_len = 0;
1259f3bec5d7SJake Burkholder 	p = imgp->proc;
1260f3bec5d7SJake Burkholder 	szsigcode = 0;
126105ba50f5SJake Burkholder 	arginfo = (struct ps_strings *)p->p_sysent->sv_psstrings;
12626297a3d8SKonstantin Belousov 	if (p->p_sysent->sv_sigcode_base == 0) {
1263f3bec5d7SJake Burkholder 		if (p->p_sysent->sv_szsigcode != NULL)
1264f3bec5d7SJake Burkholder 			szsigcode = *(p->p_sysent->sv_szsigcode);
12656297a3d8SKonstantin Belousov 	}
126688b124ceSKonstantin Belousov 	destp =	(uintptr_t)arginfo;
12671ed012f9SPeter Wemm 
126826f9a767SRodney W. Grimes 	/*
1269d66a5066SPeter Wemm 	 * install sigcode
1270d66a5066SPeter Wemm 	 */
127188b124ceSKonstantin Belousov 	if (szsigcode != 0) {
127288b124ceSKonstantin Belousov 		destp -= szsigcode;
127388b124ceSKonstantin Belousov 		destp = rounddown2(destp, sizeof(void *));
127488b124ceSKonstantin Belousov 		copyout(p->p_sysent->sv_sigcode, (void *)destp, szsigcode);
127588b124ceSKonstantin Belousov 	}
1276d66a5066SPeter Wemm 
1277d66a5066SPeter Wemm 	/*
12783ff06357SKonstantin Belousov 	 * Copy the image path for the rtld.
12793ff06357SKonstantin Belousov 	 */
12803ff06357SKonstantin Belousov 	if (execpath_len != 0) {
128188b124ceSKonstantin Belousov 		destp -= execpath_len;
128288b124ceSKonstantin Belousov 		imgp->execpathp = destp;
128388b124ceSKonstantin Belousov 		copyout(imgp->execpath, (void *)destp, execpath_len);
12843ff06357SKonstantin Belousov 	}
12853ff06357SKonstantin Belousov 
12863ff06357SKonstantin Belousov 	/*
1287ee235befSKonstantin Belousov 	 * Prepare the canary for SSP.
1288ee235befSKonstantin Belousov 	 */
1289ee235befSKonstantin Belousov 	arc4rand(canary, sizeof(canary), 0);
129088b124ceSKonstantin Belousov 	destp -= sizeof(canary);
129188b124ceSKonstantin Belousov 	imgp->canary = destp;
129288b124ceSKonstantin Belousov 	copyout(canary, (void *)destp, sizeof(canary));
1293ee235befSKonstantin Belousov 	imgp->canarylen = sizeof(canary);
1294ee235befSKonstantin Belousov 
1295ee235befSKonstantin Belousov 	/*
1296ee235befSKonstantin Belousov 	 * Prepare the pagesizes array.
1297ee235befSKonstantin Belousov 	 */
129888b124ceSKonstantin Belousov 	destp -= szps;
129988b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
130088b124ceSKonstantin Belousov 	imgp->pagesizes = destp;
130188b124ceSKonstantin Belousov 	copyout(pagesizes, (void *)destp, szps);
1302ee235befSKonstantin Belousov 	imgp->pagesizeslen = szps;
1303ee235befSKonstantin Belousov 
130488b124ceSKonstantin Belousov 	destp -= ARG_MAX - imgp->args->stringspace;
130588b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
130688b124ceSKonstantin Belousov 
1307ee235befSKonstantin Belousov 	/*
1308e1743d02SSøren Schmidt 	 * If we have a valid auxargs ptr, prepare some room
1309e1743d02SSøren Schmidt 	 * on the stack.
1310e1743d02SSøren Schmidt 	 */
1311b9a22da4STakanori Watanabe 	if (imgp->auxargs) {
1312e1743d02SSøren Schmidt 		/*
1313b9a22da4STakanori Watanabe 		 * 'AT_COUNT*2' is size for the ELF Auxargs data. This is for
1314b9a22da4STakanori Watanabe 		 * lower compatibility.
1315b9a22da4STakanori Watanabe 		 */
1316ca0387efSJake Burkholder 		imgp->auxarg_size = (imgp->auxarg_size) ? imgp->auxarg_size :
1317ca0387efSJake Burkholder 		    (AT_COUNT * 2);
1318b9a22da4STakanori Watanabe 		/*
1319b9a22da4STakanori Watanabe 		 * The '+ 2' is for the null pointers at the end of each of
1320b9a22da4STakanori Watanabe 		 * the arg and env vector sets,and imgp->auxarg_size is room
1321b9a22da4STakanori Watanabe 		 * for argument of Runtime loader.
1322e1743d02SSøren Schmidt 		 */
1323610ecfe0SMaxim Sobolev 		vectp = (char **)(destp - (imgp->args->argc +
1324ee235befSKonstantin Belousov 		    imgp->args->envc + 2 + imgp->auxarg_size)
1325ee235befSKonstantin Belousov 		    * sizeof(char *));
1326610ecfe0SMaxim Sobolev 	} else {
1327e1743d02SSøren Schmidt 		/*
1328b9a22da4STakanori Watanabe 		 * The '+ 2' is for the null pointers at the end of each of
1329b9a22da4STakanori Watanabe 		 * the arg and env vector sets
133026f9a767SRodney W. Grimes 		 */
133188b124ceSKonstantin Belousov 		vectp = (char **)(destp - (imgp->args->argc + imgp->args->envc
133288b124ceSKonstantin Belousov 		    + 2) * sizeof(char *));
1333610ecfe0SMaxim Sobolev 	}
133426f9a767SRodney W. Grimes 
133526f9a767SRodney W. Grimes 	/*
133626f9a767SRodney W. Grimes 	 * vectp also becomes our initial stack base
133726f9a767SRodney W. Grimes 	 */
1338654f6be1SBruce Evans 	stack_base = (register_t *)vectp;
133926f9a767SRodney W. Grimes 
1340610ecfe0SMaxim Sobolev 	stringp = imgp->args->begin_argv;
1341610ecfe0SMaxim Sobolev 	argc = imgp->args->argc;
1342610ecfe0SMaxim Sobolev 	envc = imgp->args->envc;
134326f9a767SRodney W. Grimes 
134493f6448cSDavid Greenman 	/*
13453aed948bSDavid Greenman 	 * Copy out strings - arguments and environment.
134693f6448cSDavid Greenman 	 */
134788b124ceSKonstantin Belousov 	copyout(stringp, (void *)destp, ARG_MAX - imgp->args->stringspace);
134893f6448cSDavid Greenman 
134993f6448cSDavid Greenman 	/*
13503aed948bSDavid Greenman 	 * Fill in "ps_strings" struct for ps, w, etc.
13513aed948bSDavid Greenman 	 */
1352aae0aa45SBruce Evans 	suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp);
1353f4e26adeSNathan Whitehorn 	suword32(&arginfo->ps_nargvstr, argc);
13543aed948bSDavid Greenman 
13553aed948bSDavid Greenman 	/*
13563aed948bSDavid Greenman 	 * Fill in argument portion of vector table.
135793f6448cSDavid Greenman 	 */
135826f9a767SRodney W. Grimes 	for (; argc > 0; --argc) {
1359aae0aa45SBruce Evans 		suword(vectp++, (long)(intptr_t)destp);
13603aed948bSDavid Greenman 		while (*stringp++ != 0)
13613aed948bSDavid Greenman 			destp++;
13623aed948bSDavid Greenman 		destp++;
136326f9a767SRodney W. Grimes 	}
136426f9a767SRodney W. Grimes 
13651a6e52d0SJeroen Ruigrok van der Werven 	/* a null vector table pointer separates the argp's from the envp's */
13666ab46d52SBruce Evans 	suword(vectp++, 0);
136726f9a767SRodney W. Grimes 
1368aae0aa45SBruce Evans 	suword(&arginfo->ps_envstr, (long)(intptr_t)vectp);
1369f4e26adeSNathan Whitehorn 	suword32(&arginfo->ps_nenvstr, envc);
137093f6448cSDavid Greenman 
137193f6448cSDavid Greenman 	/*
13723aed948bSDavid Greenman 	 * Fill in environment portion of vector table.
137393f6448cSDavid Greenman 	 */
137426f9a767SRodney W. Grimes 	for (; envc > 0; --envc) {
1375aae0aa45SBruce Evans 		suword(vectp++, (long)(intptr_t)destp);
13763aed948bSDavid Greenman 		while (*stringp++ != 0)
13773aed948bSDavid Greenman 			destp++;
13783aed948bSDavid Greenman 		destp++;
137926f9a767SRodney W. Grimes 	}
138026f9a767SRodney W. Grimes 
138126f9a767SRodney W. Grimes 	/* end of vector table is a null pointer */
13826ab46d52SBruce Evans 	suword(vectp, 0);
138326f9a767SRodney W. Grimes 
138426f9a767SRodney W. Grimes 	return (stack_base);
138526f9a767SRodney W. Grimes }
138626f9a767SRodney W. Grimes 
138726f9a767SRodney W. Grimes /*
138826f9a767SRodney W. Grimes  * Check permissions of file to execute.
1389cf64863aSRobert Watson  *	Called with imgp->vp locked.
139026f9a767SRodney W. Grimes  *	Return 0 for success or error code on failure.
139126f9a767SRodney W. Grimes  */
1392c8a79999SPeter Wemm int
1393c52007c2SDavid Greenman exec_check_permissions(imgp)
1394c52007c2SDavid Greenman 	struct image_params *imgp;
139526f9a767SRodney W. Grimes {
1396c52007c2SDavid Greenman 	struct vnode *vp = imgp->vp;
1397c52007c2SDavid Greenman 	struct vattr *attr = imgp->attr;
1398a854ed98SJohn Baldwin 	struct thread *td;
1399140dedb8SKonstantin Belousov 	int error, writecount;
140026f9a767SRodney W. Grimes 
14016617724cSJeff Roberson 	td = curthread;
1402339b79b9SRobert Watson 
1403ec35c2afSRobert Watson 	/* Get file attributes */
14040359a12eSAttilio Rao 	error = VOP_GETATTR(vp, attr, td->td_ucred);
1405ec35c2afSRobert Watson 	if (error)
1406ec35c2afSRobert Watson 		return (error);
1407ec35c2afSRobert Watson 
1408339b79b9SRobert Watson #ifdef MAC
140930d239bcSRobert Watson 	error = mac_vnode_check_exec(td->td_ucred, imgp->vp, imgp);
1410339b79b9SRobert Watson 	if (error)
1411339b79b9SRobert Watson 		return (error);
1412339b79b9SRobert Watson #endif
1413339b79b9SRobert Watson 
141426f9a767SRodney W. Grimes 	/*
1415de478dd4SJaakko Heinonen 	 * 1) Check if file execution is disabled for the filesystem that
1416de478dd4SJaakko Heinonen 	 *    this file resides on.
1417de478dd4SJaakko Heinonen 	 * 2) Ensure that at least one execute bit is on. Otherwise, a
1418de478dd4SJaakko Heinonen 	 *    privileged user will always succeed, and we don't want this
1419de478dd4SJaakko Heinonen 	 *    to happen unless the file really is executable.
1420de478dd4SJaakko Heinonen 	 * 3) Ensure that the file is a regular file.
142126f9a767SRodney W. Grimes 	 */
1422c52007c2SDavid Greenman 	if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
1423de478dd4SJaakko Heinonen 	    (attr->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0 ||
1424a854ed98SJohn Baldwin 	    (attr->va_type != VREG))
142526f9a767SRodney W. Grimes 		return (EACCES);
142626f9a767SRodney W. Grimes 
142726f9a767SRodney W. Grimes 	/*
142826f9a767SRodney W. Grimes 	 * Zero length files can't be exec'd
142926f9a767SRodney W. Grimes 	 */
143026f9a767SRodney W. Grimes 	if (attr->va_size == 0)
143126f9a767SRodney W. Grimes 		return (ENOEXEC);
143226f9a767SRodney W. Grimes 
143326f9a767SRodney W. Grimes 	/*
143426f9a767SRodney W. Grimes 	 *  Check for execute permission to file based on current credentials.
143526f9a767SRodney W. Grimes 	 */
1436a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td);
143726f9a767SRodney W. Grimes 	if (error)
143826f9a767SRodney W. Grimes 		return (error);
143926f9a767SRodney W. Grimes 
14406d5a0a8cSDavid Greenman 	/*
14416d5a0a8cSDavid Greenman 	 * Check number of open-for-writes on the file and deny execution
14426d5a0a8cSDavid Greenman 	 * if there are any.
14436d5a0a8cSDavid Greenman 	 */
1444140dedb8SKonstantin Belousov 	error = VOP_GET_WRITECOUNT(vp, &writecount);
1445140dedb8SKonstantin Belousov 	if (error != 0)
1446140dedb8SKonstantin Belousov 		return (error);
1447140dedb8SKonstantin Belousov 	if (writecount != 0)
14486d5a0a8cSDavid Greenman 		return (ETXTBSY);
14496d5a0a8cSDavid Greenman 
14506d5a0a8cSDavid Greenman 	/*
14516d5a0a8cSDavid Greenman 	 * Call filesystem specific open routine (which does nothing in the
14526d5a0a8cSDavid Greenman 	 * general case).
14536d5a0a8cSDavid Greenman 	 */
14549e223287SKonstantin Belousov 	error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL);
14559a75ea23SKonstantin Belousov 	if (error == 0)
14569a75ea23SKonstantin Belousov 		imgp->opened = 1;
145726f9a767SRodney W. Grimes 	return (error);
1458df8bae1dSRodney W. Grimes }
1459aa855a59SPeter Wemm 
1460aa855a59SPeter Wemm /*
1461aa855a59SPeter Wemm  * Exec handler registration
1462aa855a59SPeter Wemm  */
1463aa855a59SPeter Wemm int
1464aa855a59SPeter Wemm exec_register(execsw_arg)
1465aa855a59SPeter Wemm 	const struct execsw *execsw_arg;
1466aa855a59SPeter Wemm {
1467aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1468aa855a59SPeter Wemm 	int count = 2;	/* New slot and trailing NULL */
1469aa855a59SPeter Wemm 
1470aa855a59SPeter Wemm 	if (execsw)
1471aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1472aa855a59SPeter Wemm 			count++;
1473a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1474aa855a59SPeter Wemm 	if (newexecsw == NULL)
1475a7cddfedSJake Burkholder 		return (ENOMEM);
1476aa855a59SPeter Wemm 	xs = newexecsw;
1477aa855a59SPeter Wemm 	if (execsw)
1478aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1479aa855a59SPeter Wemm 			*xs++ = *es;
1480aa855a59SPeter Wemm 	*xs++ = execsw_arg;
1481aa855a59SPeter Wemm 	*xs = NULL;
1482aa855a59SPeter Wemm 	if (execsw)
1483aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1484aa855a59SPeter Wemm 	execsw = newexecsw;
1485a7cddfedSJake Burkholder 	return (0);
1486aa855a59SPeter Wemm }
1487aa855a59SPeter Wemm 
1488aa855a59SPeter Wemm int
1489aa855a59SPeter Wemm exec_unregister(execsw_arg)
1490aa855a59SPeter Wemm 	const struct execsw *execsw_arg;
1491aa855a59SPeter Wemm {
1492aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1493aa855a59SPeter Wemm 	int count = 1;
1494aa855a59SPeter Wemm 
1495aa855a59SPeter Wemm 	if (execsw == NULL)
1496aa855a59SPeter Wemm 		panic("unregister with no handlers left?\n");
1497aa855a59SPeter Wemm 
1498aa855a59SPeter Wemm 	for (es = execsw; *es; es++) {
1499aa855a59SPeter Wemm 		if (*es == execsw_arg)
1500aa855a59SPeter Wemm 			break;
1501aa855a59SPeter Wemm 	}
1502aa855a59SPeter Wemm 	if (*es == NULL)
1503a7cddfedSJake Burkholder 		return (ENOENT);
1504aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1505aa855a59SPeter Wemm 		if (*es != execsw_arg)
1506aa855a59SPeter Wemm 			count++;
1507a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1508aa855a59SPeter Wemm 	if (newexecsw == NULL)
1509a7cddfedSJake Burkholder 		return (ENOMEM);
1510aa855a59SPeter Wemm 	xs = newexecsw;
1511aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1512aa855a59SPeter Wemm 		if (*es != execsw_arg)
1513aa855a59SPeter Wemm 			*xs++ = *es;
1514aa855a59SPeter Wemm 	*xs = NULL;
1515aa855a59SPeter Wemm 	if (execsw)
1516aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1517aa855a59SPeter Wemm 	execsw = newexecsw;
1518a7cddfedSJake Burkholder 	return (0);
1519aa855a59SPeter Wemm }
1520