19454b2d8SWarner Losh /*- 226f9a767SRodney W. Grimes * Copyright (c) 1993, David Greenman 326f9a767SRodney W. Grimes * All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 1426f9a767SRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1726f9a767SRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24df8bae1dSRodney W. Grimes * SUCH DAMAGE. 25df8bae1dSRodney W. Grimes */ 26df8bae1dSRodney W. Grimes 27677b542eSDavid E. O'Brien #include <sys/cdefs.h> 28677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 29677b542eSDavid E. O'Brien 3012bc222eSJonathan Anderson #include "opt_capsicum.h" 314da0d332SPeter Wemm #include "opt_hwpmc_hooks.h" 321e9b3d91SPeter Wemm #include "opt_ktrace.h" 33f8a47341SAlan Cox #include "opt_vm.h" 341e9b3d91SPeter Wemm 35df8bae1dSRodney W. Grimes #include <sys/param.h> 364a144410SRobert Watson #include <sys/capsicum.h> 3726f9a767SRodney W. Grimes #include <sys/systm.h> 3875b8b3b2SJohn Baldwin #include <sys/eventhandler.h> 39fb919e4dSMark Murray #include <sys/lock.h> 40fb919e4dSMark Murray #include <sys/mutex.h> 41d2d3e875SBruce Evans #include <sys/sysproto.h> 4226f9a767SRodney W. Grimes #include <sys/signalvar.h> 4326f9a767SRodney W. Grimes #include <sys/kernel.h> 4426f9a767SRodney W. Grimes #include <sys/mount.h> 45797f2d22SPoul-Henning Kamp #include <sys/filedesc.h> 46079cc25bSDavid Greenman #include <sys/fcntl.h> 4726f9a767SRodney W. Grimes #include <sys/acct.h> 4826f9a767SRodney W. Grimes #include <sys/exec.h> 4926f9a767SRodney W. Grimes #include <sys/imgact.h> 50e1743d02SSøren Schmidt #include <sys/imgact_elf.h> 5126f9a767SRodney W. Grimes #include <sys/wait.h> 52333ea485SGuido van Rooij #include <sys/malloc.h> 53acd3428bSRobert Watson #include <sys/priv.h> 54a794e791SBruce Evans #include <sys/proc.h> 552a024a2bSSean Eric Fagan #include <sys/pioctl.h> 56a794e791SBruce Evans #include <sys/namei.h> 576004362eSDavid Schultz #include <sys/resourcevar.h> 5889f6b863SAttilio Rao #include <sys/rwlock.h> 5944ad5475SJohn Baldwin #include <sys/sched.h> 605d217f17SJohn Birrell #include <sys/sdt.h> 6159c8bc40SAlan Cox #include <sys/sf_buf.h> 6284e0b075SDavid Xu #include <sys/syscallsubr.h> 631e1e0b44SSøren Schmidt #include <sys/sysent.h> 64797f2d22SPoul-Henning Kamp #include <sys/shm.h> 6599ac3bc8SPeter Wemm #include <sys/sysctl.h> 66a794e791SBruce Evans #include <sys/vnode.h> 67dfa7fd1dSEdward Tomasz Napierala #include <sys/stat.h> 68c781aea8SPeter Wemm #ifdef KTRACE 69c781aea8SPeter Wemm #include <sys/ktrace.h> 70c781aea8SPeter Wemm #endif 7126f9a767SRodney W. Grimes 7226f9a767SRodney W. Grimes #include <vm/vm.h> 73efeaf95aSDavid Greenman #include <vm/vm_param.h> 74efeaf95aSDavid Greenman #include <vm/pmap.h> 751616db3cSJohn Dyson #include <vm/vm_page.h> 76efeaf95aSDavid Greenman #include <vm/vm_map.h> 7726f9a767SRodney W. Grimes #include <vm/vm_kern.h> 78efeaf95aSDavid Greenman #include <vm/vm_extern.h> 791ebd0c59SDavid Greenman #include <vm/vm_object.h> 801616db3cSJohn Dyson #include <vm/vm_pager.h> 8126f9a767SRodney W. Grimes 82ebccf1e3SJoseph Koshy #ifdef HWPMC_HOOKS 83ebccf1e3SJoseph Koshy #include <sys/pmckern.h> 84ebccf1e3SJoseph Koshy #endif 85ebccf1e3SJoseph Koshy 8626f9a767SRodney W. Grimes #include <machine/reg.h> 8726f9a767SRodney W. Grimes 88ae1078d6SWayne Salamon #include <security/audit/audit.h> 89aed55708SRobert Watson #include <security/mac/mac_framework.h> 90ae1078d6SWayne Salamon 915d217f17SJohn Birrell #ifdef KDTRACE_HOOKS 925d217f17SJohn Birrell #include <sys/dtrace_bsd.h> 935d217f17SJohn Birrell dtrace_execexit_func_t dtrace_fasttrap_exec; 945d217f17SJohn Birrell #endif 955d217f17SJohn Birrell 965d217f17SJohn Birrell SDT_PROVIDER_DECLARE(proc); 97d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec, "char *"); 98d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec__failure, "int"); 99d9fae5abSAndriy Gapon SDT_PROBE_DEFINE1(proc, kernel, , exec__success, "char *"); 1005d217f17SJohn Birrell 101b9df5231SPoul-Henning Kamp MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments"); 102b9df5231SPoul-Henning Kamp 103*bcb60d52SConrad Meyer int coredump_pack_fileinfo = 1; 104*bcb60d52SConrad Meyer SYSCTL_INT(_kern, OID_AUTO, coredump_pack_fileinfo, CTLFLAG_RWTUN, 105*bcb60d52SConrad Meyer &coredump_pack_fileinfo, 0, 106*bcb60d52SConrad Meyer "Enable file path packing in 'procstat -f' coredump notes"); 107*bcb60d52SConrad Meyer 10805ba50f5SJake Burkholder static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS); 10905ba50f5SJake Burkholder static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS); 1105dadd17bSJake Burkholder static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS); 111610ecfe0SMaxim Sobolev static int do_execve(struct thread *td, struct image_args *args, 112610ecfe0SMaxim Sobolev struct mac *mac_p); 11305ba50f5SJake Burkholder 1149701cd40SJohn Baldwin /* XXX This should be vm_size_t. */ 11505ba50f5SJake Burkholder SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD, 11605ba50f5SJake Burkholder NULL, 0, sysctl_kern_ps_strings, "LU", ""); 117486bddb0SDoug Rabson 1189701cd40SJohn Baldwin /* XXX This should be vm_size_t. */ 119ff66f6a4SRobert Watson SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD| 120ff66f6a4SRobert Watson CTLFLAG_CAPRD, NULL, 0, sysctl_kern_usrstack, "LU", ""); 12199ac3bc8SPeter Wemm 1225dadd17bSJake Burkholder SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD, 1235dadd17bSJake Burkholder NULL, 0, sysctl_kern_stackprot, "I", ""); 1245dadd17bSJake Burkholder 125b9df5231SPoul-Henning Kamp u_long ps_arg_cache_limit = PAGE_SIZE / 16; 126c3699b5fSPeter Wemm SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, 1279701cd40SJohn Baldwin &ps_arg_cache_limit, 0, ""); 128b9df5231SPoul-Henning Kamp 129eda6009cSKonstantin Belousov static int disallow_high_osrel; 130eda6009cSKonstantin Belousov SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW, 131eda6009cSKonstantin Belousov &disallow_high_osrel, 0, 132eda6009cSKonstantin Belousov "Disallow execution of binaries built for higher version of the world"); 133eda6009cSKonstantin Belousov 134878adb85SBjoern A. Zeeb static int map_at_zero = 0; 135af3b2549SHans Petter Selasky SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RWTUN, &map_at_zero, 0, 136878adb85SBjoern A. Zeeb "Permit processes to map an object at virtual address 0."); 137878adb85SBjoern A. Zeeb 13805ba50f5SJake Burkholder static int 13905ba50f5SJake Burkholder sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS) 14005ba50f5SJake Burkholder { 14105ba50f5SJake Burkholder struct proc *p; 142df7c361eSPeter Wemm int error; 14305ba50f5SJake Burkholder 14405ba50f5SJake Burkholder p = curproc; 145a7bc3102SPeter Wemm #ifdef SCTL_MASK32 146a7bc3102SPeter Wemm if (req->flags & SCTL_MASK32) { 147df7c361eSPeter Wemm unsigned int val; 148df7c361eSPeter Wemm val = (unsigned int)p->p_sysent->sv_psstrings; 149df7c361eSPeter Wemm error = SYSCTL_OUT(req, &val, sizeof(val)); 150df7c361eSPeter Wemm } else 151df7c361eSPeter Wemm #endif 152df7c361eSPeter Wemm error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings, 153df7c361eSPeter Wemm sizeof(p->p_sysent->sv_psstrings)); 154df7c361eSPeter Wemm return error; 15505ba50f5SJake Burkholder } 15605ba50f5SJake Burkholder 15705ba50f5SJake Burkholder static int 15805ba50f5SJake Burkholder sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS) 15905ba50f5SJake Burkholder { 16005ba50f5SJake Burkholder struct proc *p; 161df7c361eSPeter Wemm int error; 16205ba50f5SJake Burkholder 16305ba50f5SJake Burkholder p = curproc; 164a7bc3102SPeter Wemm #ifdef SCTL_MASK32 165a7bc3102SPeter Wemm if (req->flags & SCTL_MASK32) { 166df7c361eSPeter Wemm unsigned int val; 167df7c361eSPeter Wemm val = (unsigned int)p->p_sysent->sv_usrstack; 168df7c361eSPeter Wemm error = SYSCTL_OUT(req, &val, sizeof(val)); 169df7c361eSPeter Wemm } else 170df7c361eSPeter Wemm #endif 171df7c361eSPeter Wemm error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack, 172df7c361eSPeter Wemm sizeof(p->p_sysent->sv_usrstack)); 173df7c361eSPeter Wemm return error; 17405ba50f5SJake Burkholder } 17505ba50f5SJake Burkholder 1765dadd17bSJake Burkholder static int 1775dadd17bSJake Burkholder sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS) 1785dadd17bSJake Burkholder { 1795dadd17bSJake Burkholder struct proc *p; 1805dadd17bSJake Burkholder 1815dadd17bSJake Burkholder p = curproc; 1825dadd17bSJake Burkholder return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot, 1835dadd17bSJake Burkholder sizeof(p->p_sysent->sv_stackprot))); 1845dadd17bSJake Burkholder } 1855dadd17bSJake Burkholder 18699ac3bc8SPeter Wemm /* 187aa855a59SPeter Wemm * Each of the items is a pointer to a `const struct execsw', hence the 188aa855a59SPeter Wemm * double pointer here. 189df8bae1dSRodney W. Grimes */ 190aa855a59SPeter Wemm static const struct execsw **execsw; 19126f9a767SRodney W. Grimes 192ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_ 193ca46e90eSBruce Evans struct execve_args { 194ca46e90eSBruce Evans char *fname; 195ca46e90eSBruce Evans char **argv; 196ca46e90eSBruce Evans char **envv; 197ca46e90eSBruce Evans }; 198ca46e90eSBruce Evans #endif 199ca46e90eSBruce Evans 200ca46e90eSBruce Evans int 2017b445033SKonstantin Belousov sys_execve(struct thread *td, struct execve_args *uap) 202ca46e90eSBruce Evans { 203610ecfe0SMaxim Sobolev struct image_args args; 2047b445033SKonstantin Belousov struct vmspace *oldvmspace; 2057b445033SKonstantin Belousov int error; 206ca46e90eSBruce Evans 2077b445033SKonstantin Belousov error = pre_execve(td, &oldvmspace); 2087b445033SKonstantin Belousov if (error != 0) 2097b445033SKonstantin Belousov return (error); 210610ecfe0SMaxim Sobolev error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE, 211610ecfe0SMaxim Sobolev uap->argv, uap->envv); 212610ecfe0SMaxim Sobolev if (error == 0) 213610ecfe0SMaxim Sobolev error = kern_execve(td, &args, NULL); 2147b445033SKonstantin Belousov post_execve(td, error, oldvmspace); 215610ecfe0SMaxim Sobolev return (error); 216ca46e90eSBruce Evans } 217ca46e90eSBruce Evans 218ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_ 219632dbc19SKonstantin Belousov struct fexecve_args { 220632dbc19SKonstantin Belousov int fd; 221632dbc19SKonstantin Belousov char **argv; 222632dbc19SKonstantin Belousov char **envv; 223632dbc19SKonstantin Belousov } 224632dbc19SKonstantin Belousov #endif 225632dbc19SKonstantin Belousov int 2268451d0ddSKip Macy sys_fexecve(struct thread *td, struct fexecve_args *uap) 227632dbc19SKonstantin Belousov { 228632dbc19SKonstantin Belousov struct image_args args; 2297b445033SKonstantin Belousov struct vmspace *oldvmspace; 2307b445033SKonstantin Belousov int error; 231632dbc19SKonstantin Belousov 2327b445033SKonstantin Belousov error = pre_execve(td, &oldvmspace); 2337b445033SKonstantin Belousov if (error != 0) 2347b445033SKonstantin Belousov return (error); 235632dbc19SKonstantin Belousov error = exec_copyin_args(&args, NULL, UIO_SYSSPACE, 236632dbc19SKonstantin Belousov uap->argv, uap->envv); 237632dbc19SKonstantin Belousov if (error == 0) { 238632dbc19SKonstantin Belousov args.fd = uap->fd; 239632dbc19SKonstantin Belousov error = kern_execve(td, &args, NULL); 240632dbc19SKonstantin Belousov } 2417b445033SKonstantin Belousov post_execve(td, error, oldvmspace); 242632dbc19SKonstantin Belousov return (error); 243632dbc19SKonstantin Belousov } 244632dbc19SKonstantin Belousov 245632dbc19SKonstantin Belousov #ifndef _SYS_SYSPROTO_H_ 246ca46e90eSBruce Evans struct __mac_execve_args { 247ca46e90eSBruce Evans char *fname; 248ca46e90eSBruce Evans char **argv; 249ca46e90eSBruce Evans char **envv; 250ca46e90eSBruce Evans struct mac *mac_p; 251ca46e90eSBruce Evans }; 252ca46e90eSBruce Evans #endif 253ca46e90eSBruce Evans 254ca46e90eSBruce Evans int 2557b445033SKonstantin Belousov sys___mac_execve(struct thread *td, struct __mac_execve_args *uap) 256ca46e90eSBruce Evans { 257ca46e90eSBruce Evans #ifdef MAC 258610ecfe0SMaxim Sobolev struct image_args args; 2597b445033SKonstantin Belousov struct vmspace *oldvmspace; 2607b445033SKonstantin Belousov int error; 261610ecfe0SMaxim Sobolev 2627b445033SKonstantin Belousov error = pre_execve(td, &oldvmspace); 2637b445033SKonstantin Belousov if (error != 0) 2647b445033SKonstantin Belousov return (error); 265610ecfe0SMaxim Sobolev error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE, 266610ecfe0SMaxim Sobolev uap->argv, uap->envv); 267610ecfe0SMaxim Sobolev if (error == 0) 268610ecfe0SMaxim Sobolev error = kern_execve(td, &args, uap->mac_p); 2697b445033SKonstantin Belousov post_execve(td, error, oldvmspace); 270610ecfe0SMaxim Sobolev return (error); 271ca46e90eSBruce Evans #else 272ca46e90eSBruce Evans return (ENOSYS); 273ca46e90eSBruce Evans #endif 274ca46e90eSBruce Evans } 275ca46e90eSBruce Evans 27684e0b075SDavid Xu int 2777b445033SKonstantin Belousov pre_execve(struct thread *td, struct vmspace **oldvmspace) 278906ac69dSDavid Xu { 2797b445033SKonstantin Belousov struct proc *p; 280906ac69dSDavid Xu int error; 281906ac69dSDavid Xu 2827b445033SKonstantin Belousov KASSERT(td == curthread, ("non-current thread %p", td)); 2837b445033SKonstantin Belousov error = 0; 2847b445033SKonstantin Belousov p = td->td_proc; 2857b445033SKonstantin Belousov if ((p->p_flag & P_HADTHREADS) != 0) { 286906ac69dSDavid Xu PROC_LOCK(p); 2877b445033SKonstantin Belousov if (thread_single(p, SINGLE_BOUNDARY) != 0) 2887b445033SKonstantin Belousov error = ERESTART; 289906ac69dSDavid Xu PROC_UNLOCK(p); 290906ac69dSDavid Xu } 2917b445033SKonstantin Belousov KASSERT(error != 0 || (td->td_pflags & TDP_EXECVMSPC) == 0, 2927b445033SKonstantin Belousov ("nested execve")); 2937b445033SKonstantin Belousov *oldvmspace = p->p_vmspace; 2947b445033SKonstantin Belousov return (error); 2957b445033SKonstantin Belousov } 296906ac69dSDavid Xu 2977b445033SKonstantin Belousov void 2987b445033SKonstantin Belousov post_execve(struct thread *td, int error, struct vmspace *oldvmspace) 2997b445033SKonstantin Belousov { 3007b445033SKonstantin Belousov struct proc *p; 301906ac69dSDavid Xu 3027b445033SKonstantin Belousov KASSERT(td == curthread, ("non-current thread %p", td)); 3037b445033SKonstantin Belousov p = td->td_proc; 3047b445033SKonstantin Belousov if ((p->p_flag & P_HADTHREADS) != 0) { 305906ac69dSDavid Xu PROC_LOCK(p); 306906ac69dSDavid Xu /* 307906ac69dSDavid Xu * If success, we upgrade to SINGLE_EXIT state to 308906ac69dSDavid Xu * force other threads to suicide. 309906ac69dSDavid Xu */ 310906ac69dSDavid Xu if (error == 0) 3116ddcc233SKonstantin Belousov thread_single(p, SINGLE_EXIT); 312906ac69dSDavid Xu else 3136ddcc233SKonstantin Belousov thread_single_end(p, SINGLE_BOUNDARY); 314906ac69dSDavid Xu PROC_UNLOCK(p); 315906ac69dSDavid Xu } 3167032434eSKonstantin Belousov if ((td->td_pflags & TDP_EXECVMSPC) != 0) { 3177b445033SKonstantin Belousov KASSERT(p->p_vmspace != oldvmspace, 3187032434eSKonstantin Belousov ("oldvmspace still used")); 3197032434eSKonstantin Belousov vmspace_free(oldvmspace); 3207032434eSKonstantin Belousov td->td_pflags &= ~TDP_EXECVMSPC; 3217032434eSKonstantin Belousov } 3227b445033SKonstantin Belousov } 323906ac69dSDavid Xu 3247b445033SKonstantin Belousov /* 3257b445033SKonstantin Belousov * XXX: kern_execve has the astonishing property of not always returning to 3267b445033SKonstantin Belousov * the caller. If sufficiently bad things happen during the call to 3277b445033SKonstantin Belousov * do_execve(), it can end up calling exit1(); as a result, callers must 3287b445033SKonstantin Belousov * avoid doing anything which they might need to undo (e.g., allocating 3297b445033SKonstantin Belousov * memory). 3307b445033SKonstantin Belousov */ 3317b445033SKonstantin Belousov int 3327b445033SKonstantin Belousov kern_execve(struct thread *td, struct image_args *args, struct mac *mac_p) 3337b445033SKonstantin Belousov { 3347b445033SKonstantin Belousov 3357b445033SKonstantin Belousov AUDIT_ARG_ARGV(args->begin_argv, args->argc, 3367b445033SKonstantin Belousov args->begin_envv - args->begin_argv); 3377b445033SKonstantin Belousov AUDIT_ARG_ENVV(args->begin_envv, args->envc, 3387b445033SKonstantin Belousov args->endp - args->begin_envv); 3397b445033SKonstantin Belousov return (do_execve(td, args, mac_p)); 340906ac69dSDavid Xu } 341906ac69dSDavid Xu 34226f9a767SRodney W. Grimes /* 343450ffb44SRobert Watson * In-kernel implementation of execve(). All arguments are assumed to be 344450ffb44SRobert Watson * userspace pointers from the passed thread. 34526f9a767SRodney W. Grimes */ 346450ffb44SRobert Watson static int 347610ecfe0SMaxim Sobolev do_execve(td, args, mac_p) 348b40ce416SJulian Elischer struct thread *td; 349610ecfe0SMaxim Sobolev struct image_args *args; 350670cb89bSRobert Watson struct mac *mac_p; 351df8bae1dSRodney W. Grimes { 352b40ce416SJulian Elischer struct proc *p = td->td_proc; 35369c9eff8SEd Schouten struct nameidata nd; 3549b3b1c5fSJohn Baldwin struct ucred *newcred = NULL, *oldcred; 355350d5181SMateusz Guzik struct uidinfo *euip = NULL; 356654f6be1SBruce Evans register_t *stack_base; 3575ca4819dSJohn Baldwin int error, i; 358c52007c2SDavid Greenman struct image_params image_params, *imgp; 3599f5c1d19SDiomidis Spinellis struct vattr attr; 3604d77a549SAlfred Perlstein int (*img_first)(struct image_params *); 36169be5db9SAlfred Perlstein struct pargs *oldargs = NULL, *newargs = NULL; 36290af4afaSJohn Baldwin struct sigacts *oldsigacts, *newsigacts; 3636c84de02SJohn Baldwin #ifdef KTRACE 3646c84de02SJohn Baldwin struct vnode *tracevp = NULL; 365a5881ea5SJohn Baldwin struct ucred *tracecred = NULL; 3666c84de02SJohn Baldwin #endif 36761617058SMateusz Guzik struct vnode *oldtextvp = NULL, *newtextvp; 3687008be5bSPawel Jakub Dawidek cap_rights_t rights; 369d06c0d4dSRobert Watson int credential_changing; 370619eb6e5SJeff Roberson int textset; 371ccafe7ebSRobert Watson #ifdef MAC 3726356dba0SRobert Watson struct label *interpvplabel = NULL; 373eca8a663SRobert Watson int will_transition; 374ccafe7ebSRobert Watson #endif 37515139246SJoseph Koshy #ifdef HWPMC_HOOKS 37615139246SJoseph Koshy struct pmckern_procexec pe; 37715139246SJoseph Koshy #endif 378632dbc19SKonstantin Belousov static const char fexecv_proc_title[] = "(fexecv)"; 37926f9a767SRodney W. Grimes 380c52007c2SDavid Greenman imgp = &image_params; 381df8bae1dSRodney W. Grimes 3829ca45e81SDag-Erling Smørgrav /* 3839ca45e81SDag-Erling Smørgrav * Lock the process and set the P_INEXEC flag to indicate that 3849ca45e81SDag-Erling Smørgrav * it should be left alone until we're done here. This is 3859ca45e81SDag-Erling Smørgrav * necessary to avoid race conditions - e.g. in ptrace() - 3869ca45e81SDag-Erling Smørgrav * that might allow a local user to illicitly obtain elevated 3879ca45e81SDag-Erling Smørgrav * privileges. 3889ca45e81SDag-Erling Smørgrav */ 3899ca45e81SDag-Erling Smørgrav PROC_LOCK(p); 3909ca45e81SDag-Erling Smørgrav KASSERT((p->p_flag & P_INEXEC) == 0, 39191f91617SDavid E. O'Brien ("%s(): process already has P_INEXEC flag", __func__)); 3929ca45e81SDag-Erling Smørgrav p->p_flag |= P_INEXEC; 3939ca45e81SDag-Erling Smørgrav PROC_UNLOCK(p); 3949ca45e81SDag-Erling Smørgrav 395df8bae1dSRodney W. Grimes /* 396c52007c2SDavid Greenman * Initialize part of the common data 397df8bae1dSRodney W. Grimes */ 3988e572983SMateusz Guzik bzero(imgp, sizeof(*imgp)); 399c52007c2SDavid Greenman imgp->proc = p; 400c52007c2SDavid Greenman imgp->attr = &attr; 401610ecfe0SMaxim Sobolev imgp->args = args; 40226f9a767SRodney W. Grimes 403670cb89bSRobert Watson #ifdef MAC 404eca8a663SRobert Watson error = mac_execve_enter(imgp, mac_p); 405532c491bSJeff Roberson if (error) 406670cb89bSRobert Watson goto exec_fail; 407670cb89bSRobert Watson #endif 408670cb89bSRobert Watson 40926f9a767SRodney W. Grimes /* 41026f9a767SRodney W. Grimes * Translate the file name. namei() returns a vnode pointer 41126f9a767SRodney W. Grimes * in ni_vp amoung other things. 412ae1078d6SWayne Salamon * 413ae1078d6SWayne Salamon * XXXAUDIT: It would be desirable to also audit the name of the 414ae1078d6SWayne Salamon * interpreter if this is an interpreted binary. 41526f9a767SRodney W. Grimes */ 416632dbc19SKonstantin Belousov if (args->fname != NULL) { 41769c9eff8SEd Schouten NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME 4185050aa86SKonstantin Belousov | AUDITVNODE1, UIO_SYSSPACE, args->fname, td); 419632dbc19SKonstantin Belousov } 42026f9a767SRodney W. Grimes 421e506f34bSCraig Rodrigues SDT_PROBE(proc, kernel, , exec, args->fname, 0, 0, 0, 0 ); 422e506f34bSCraig Rodrigues 42326f9a767SRodney W. Grimes interpret: 424632dbc19SKonstantin Belousov if (args->fname != NULL) { 42512bc222eSJonathan Anderson #ifdef CAPABILITY_MODE 42612bc222eSJonathan Anderson /* 42712bc222eSJonathan Anderson * While capability mode can't reach this point via direct 42812bc222eSJonathan Anderson * path arguments to execve(), we also don't allow 42912bc222eSJonathan Anderson * interpreters to be used in capability mode (for now). 43012bc222eSJonathan Anderson * Catch indirect lookups and return a permissions error. 43112bc222eSJonathan Anderson */ 43212bc222eSJonathan Anderson if (IN_CAPABILITY_MODE(td)) { 43312bc222eSJonathan Anderson error = ECAPMODE; 43412bc222eSJonathan Anderson goto exec_fail; 43512bc222eSJonathan Anderson } 43612bc222eSJonathan Anderson #endif 43769c9eff8SEd Schouten error = namei(&nd); 438610ecfe0SMaxim Sobolev if (error) 43926f9a767SRodney W. Grimes goto exec_fail; 44026f9a767SRodney W. Grimes 44161617058SMateusz Guzik newtextvp = nd.ni_vp; 44261617058SMateusz Guzik imgp->vp = newtextvp; 443632dbc19SKonstantin Belousov } else { 44414961ba7SRobert Watson AUDIT_ARG_FD(args->fd); 445a9d2f8d8SRobert Watson /* 446c8e781f6SPawel Jakub Dawidek * Descriptors opened only with O_EXEC or O_RDONLY are allowed. 447a9d2f8d8SRobert Watson */ 4487008be5bSPawel Jakub Dawidek error = fgetvp_exec(td, args->fd, 44961617058SMateusz Guzik cap_rights_init(&rights, CAP_FEXECVE), &newtextvp); 450632dbc19SKonstantin Belousov if (error) 451632dbc19SKonstantin Belousov goto exec_fail; 45261617058SMateusz Guzik vn_lock(newtextvp, LK_EXCLUSIVE | LK_RETRY); 45361617058SMateusz Guzik AUDIT_ARG_VNODE1(newtextvp); 45461617058SMateusz Guzik imgp->vp = newtextvp; 455632dbc19SKonstantin Belousov } 45626f9a767SRodney W. Grimes 45726f9a767SRodney W. Grimes /* 4589022e4adSDavid Greenman * Check file permissions (also 'opens' file) 4599022e4adSDavid Greenman */ 460c52007c2SDavid Greenman error = exec_check_permissions(imgp); 461619eb6e5SJeff Roberson if (error) 46226f9a767SRodney W. Grimes goto exec_fail_dealloc; 463619eb6e5SJeff Roberson 4648516dd18SPoul-Henning Kamp imgp->object = imgp->vp->v_object; 4658516dd18SPoul-Henning Kamp if (imgp->object != NULL) 4660b2ed1aeSJeff Roberson vm_object_reference(imgp->object); 46726f9a767SRodney W. Grimes 468619eb6e5SJeff Roberson /* 469619eb6e5SJeff Roberson * Set VV_TEXT now so no one can write to the executable while we're 470619eb6e5SJeff Roberson * activating it. 471619eb6e5SJeff Roberson * 472619eb6e5SJeff Roberson * Remember if this was set before and unset it in case this is not 473619eb6e5SJeff Roberson * actually an executable image. 474619eb6e5SJeff Roberson */ 475877d24acSKonstantin Belousov textset = VOP_IS_TEXT(imgp->vp); 476877d24acSKonstantin Belousov VOP_SET_TEXT(imgp->vp); 477619eb6e5SJeff Roberson 4781616db3cSJohn Dyson error = exec_map_first_page(imgp); 4796d5a0a8cSDavid Greenman if (error) 48026f9a767SRodney W. Grimes goto exec_fail_dealloc; 48126f9a767SRodney W. Grimes 482f231de47SKonstantin Belousov imgp->proc->p_osrel = 0; 48326f9a767SRodney W. Grimes /* 484d323ddf3SMatthew Dillon * If the current process has a special image activator it 485d323ddf3SMatthew Dillon * wants to try first, call it. For example, emulating shell 486d323ddf3SMatthew Dillon * scripts differently. 48726f9a767SRodney W. Grimes */ 488d323ddf3SMatthew Dillon error = -1; 489d323ddf3SMatthew Dillon if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL) 490d323ddf3SMatthew Dillon error = img_first(imgp); 491d323ddf3SMatthew Dillon 492d323ddf3SMatthew Dillon /* 493d323ddf3SMatthew Dillon * Loop through the list of image activators, calling each one. 494d323ddf3SMatthew Dillon * An activator returns -1 if there is no match, 0 on success, 495d323ddf3SMatthew Dillon * and an error otherwise. 496d323ddf3SMatthew Dillon */ 497d323ddf3SMatthew Dillon for (i = 0; error == -1 && execsw[i]; ++i) { 498d323ddf3SMatthew Dillon if (execsw[i]->ex_imgact == NULL || 499d323ddf3SMatthew Dillon execsw[i]->ex_imgact == img_first) { 500d323ddf3SMatthew Dillon continue; 501d323ddf3SMatthew Dillon } 502c52007c2SDavid Greenman error = (*execsw[i]->ex_imgact)(imgp); 503d323ddf3SMatthew Dillon } 504d323ddf3SMatthew Dillon 505d323ddf3SMatthew Dillon if (error) { 506619eb6e5SJeff Roberson if (error == -1) { 507877d24acSKonstantin Belousov if (textset == 0) 508877d24acSKonstantin Belousov VOP_UNSET_TEXT(imgp->vp); 509d323ddf3SMatthew Dillon error = ENOEXEC; 510619eb6e5SJeff Roberson } 51126f9a767SRodney W. Grimes goto exec_fail_dealloc; 512d323ddf3SMatthew Dillon } 513d323ddf3SMatthew Dillon 514d323ddf3SMatthew Dillon /* 515d323ddf3SMatthew Dillon * Special interpreter operation, cleanup and loop up to try to 516d323ddf3SMatthew Dillon * activate the interpreter. 517d323ddf3SMatthew Dillon */ 518c52007c2SDavid Greenman if (imgp->interpreted) { 5191616db3cSJohn Dyson exec_unmap_first_page(imgp); 520619eb6e5SJeff Roberson /* 521619eb6e5SJeff Roberson * VV_TEXT needs to be unset for scripts. There is a short 522619eb6e5SJeff Roberson * period before we determine that something is a script where 523619eb6e5SJeff Roberson * VV_TEXT will be set. The vnode lock is held over this 524619eb6e5SJeff Roberson * entire period so nothing should illegitimately be blocked. 525619eb6e5SJeff Roberson */ 526877d24acSKonstantin Belousov VOP_UNSET_TEXT(imgp->vp); 527762e6b85SEivind Eklund /* free name buffer and old vnode */ 528632dbc19SKonstantin Belousov if (args->fname != NULL) 52969c9eff8SEd Schouten NDFREE(&nd, NDF_ONLY_PNBUF); 530670cb89bSRobert Watson #ifdef MAC 53161617058SMateusz Guzik mac_execve_interpreter_enter(newtextvp, &interpvplabel); 532670cb89bSRobert Watson #endif 5339a75ea23SKonstantin Belousov if (imgp->opened) { 53461617058SMateusz Guzik VOP_CLOSE(newtextvp, FREAD, td->td_ucred, td); 5359a75ea23SKonstantin Belousov imgp->opened = 0; 5369a75ea23SKonstantin Belousov } 53761617058SMateusz Guzik vput(newtextvp); 5380b2ed1aeSJeff Roberson vm_object_deallocate(imgp->object); 5390b2ed1aeSJeff Roberson imgp->object = NULL; 54026f9a767SRodney W. Grimes /* set new name to that of the interpreter */ 5415050aa86SKonstantin Belousov NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME, 542b40ce416SJulian Elischer UIO_SYSSPACE, imgp->interpreter_name, td); 543632dbc19SKonstantin Belousov args->fname = imgp->interpreter_name; 54426f9a767SRodney W. Grimes goto interpret; 54526f9a767SRodney W. Grimes } 54626f9a767SRodney W. Grimes 54726f9a767SRodney W. Grimes /* 548ded7d39cSChristian S.J. Peron * NB: We unlock the vnode here because it is believed that none 549ded7d39cSChristian S.J. Peron * of the sv_copyout_strings/sv_fixup operations require the vnode. 550ded7d39cSChristian S.J. Peron */ 551ded7d39cSChristian S.J. Peron VOP_UNLOCK(imgp->vp, 0); 5523ff06357SKonstantin Belousov 5533ff06357SKonstantin Belousov /* 5543ff06357SKonstantin Belousov * Do the best to calculate the full path to the image file. 5553ff06357SKonstantin Belousov */ 5563ff06357SKonstantin Belousov if (imgp->auxargs != NULL && 5573ff06357SKonstantin Belousov ((args->fname != NULL && args->fname[0] == '/') || 5583ff06357SKonstantin Belousov vn_fullpath(td, imgp->vp, &imgp->execpath, &imgp->freepath) != 0)) 5593ff06357SKonstantin Belousov imgp->execpath = args->fname; 5603ff06357SKonstantin Belousov 561eda6009cSKonstantin Belousov if (disallow_high_osrel && 562eda6009cSKonstantin Belousov P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) { 563eda6009cSKonstantin Belousov error = ENOEXEC; 564eda6009cSKonstantin Belousov uprintf("Osrel %d for image %s too high\n", p->p_osrel, 565eda6009cSKonstantin Belousov imgp->execpath != NULL ? imgp->execpath : "<unresolved>"); 566eda6009cSKonstantin Belousov vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 567eda6009cSKonstantin Belousov goto exec_fail_dealloc; 568eda6009cSKonstantin Belousov } 569eda6009cSKonstantin Belousov 57039f5ebb7SEd Schouten /* ABI enforces the use of Capsicum. Switch into capabilities mode. */ 57139f5ebb7SEd Schouten if (SV_PROC_FLAG(p, SV_CAPSICUM)) 57239f5ebb7SEd Schouten sys_cap_enter(td, NULL); 57339f5ebb7SEd Schouten 574ded7d39cSChristian S.J. Peron /* 57526f9a767SRodney W. Grimes * Copy out strings (args and env) and initialize stack base 57626f9a767SRodney W. Grimes */ 5773ebc1248SPeter Wemm if (p->p_sysent->sv_copyout_strings) 5783ebc1248SPeter Wemm stack_base = (*p->p_sysent->sv_copyout_strings)(imgp); 5793ebc1248SPeter Wemm else 580c52007c2SDavid Greenman stack_base = exec_copyout_strings(imgp); 58126f9a767SRodney W. Grimes 58226f9a767SRodney W. Grimes /* 5831e1e0b44SSøren Schmidt * If custom stack fixup routine present for this process 5841e1e0b44SSøren Schmidt * let it do the stack setup. 5851e1e0b44SSøren Schmidt * Else stuff argument count as first item on stack 58626f9a767SRodney W. Grimes */ 587d6c847f3SBruce Evans if (p->p_sysent->sv_fixup != NULL) 588c52007c2SDavid Greenman (*p->p_sysent->sv_fixup)(&stack_base, imgp); 5891e1e0b44SSøren Schmidt else 590610ecfe0SMaxim Sobolev suword(--stack_base, imgp->args->argc); 59126f9a767SRodney W. Grimes 592457f7e23SEd Schouten if (args->fdp != NULL) { 593457f7e23SEd Schouten /* Install a brand new file descriptor table. */ 594457f7e23SEd Schouten fdinstall_remapped(td, args->fdp); 595457f7e23SEd Schouten args->fdp = NULL; 596457f7e23SEd Schouten } else { 597a78e8d2aSDavid Greenman /* 598457f7e23SEd Schouten * Keep on using the existing file descriptor table. For 599457f7e23SEd Schouten * security and other reasons, the file descriptor table 600457f7e23SEd Schouten * cannot be shared after an exec. 601a78e8d2aSDavid Greenman */ 602b9d32c36SMateusz Guzik fdunshare(td); 603b0bc0cadSMateusz Guzik /* close files on exec */ 604b0bc0cadSMateusz Guzik fdcloseexec(td); 605457f7e23SEd Schouten } 606a78e8d2aSDavid Greenman 607333ea485SGuido van Rooij /* 6089b3b1c5fSJohn Baldwin * Malloc things before we need locks. 6099b3b1c5fSJohn Baldwin */ 610610ecfe0SMaxim Sobolev i = imgp->args->begin_envv - imgp->args->begin_argv; 6115997cae9SDon Lewis /* Cache arguments if they fit inside our allowance */ 6125997cae9SDon Lewis if (ps_arg_cache_limit >= i + sizeof(struct pargs)) { 6139b3b1c5fSJohn Baldwin newargs = pargs_alloc(i); 6145997cae9SDon Lewis bcopy(imgp->args->begin_argv, newargs->ar_args, i); 6155997cae9SDon Lewis } 6169b3b1c5fSJohn Baldwin 6172974cc36SKonstantin Belousov vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 6189b3b1c5fSJohn Baldwin 6199b3b1c5fSJohn Baldwin /* 620333ea485SGuido van Rooij * For security and other reasons, signal handlers cannot 6218688bb93SJohn Baldwin * be shared after an exec. The new process gets a copy of the old 622b2c3fa70SDima Dorfman * handlers. In execsigs(), the new process will have its signals 623333ea485SGuido van Rooij * reset. 624333ea485SGuido van Rooij */ 62590af4afaSJohn Baldwin if (sigacts_shared(p->p_sigacts)) { 62690af4afaSJohn Baldwin oldsigacts = p->p_sigacts; 62790af4afaSJohn Baldwin newsigacts = sigacts_alloc(); 62890af4afaSJohn Baldwin sigacts_copy(newsigacts, oldsigacts); 629a6bad85eSMateusz Guzik } else { 63090af4afaSJohn Baldwin oldsigacts = NULL; 631a6bad85eSMateusz Guzik newsigacts = NULL; /* satisfy gcc */ 632a6bad85eSMateusz Guzik } 633333ea485SGuido van Rooij 634d00c8ea4SMateusz Guzik PROC_LOCK(p); 635d00c8ea4SMateusz Guzik if (oldsigacts) 636d00c8ea4SMateusz Guzik p->p_sigacts = newsigacts; 637350d5181SMateusz Guzik oldcred = p->p_ucred; 638fdf4e8b3SWarner Losh /* Stop profiling */ 639fdf4e8b3SWarner Losh stopprofclock(p); 640fdf4e8b3SWarner Losh 64126f9a767SRodney W. Grimes /* reset caught signals */ 64226f9a767SRodney W. Grimes execsigs(p); 64326f9a767SRodney W. Grimes 64426f9a767SRodney W. Grimes /* name this process - nameiexec(p, ndp) */ 6455ca4819dSJohn Baldwin bzero(p->p_comm, sizeof(p->p_comm)); 6465ca4819dSJohn Baldwin if (args->fname) 6475ca4819dSJohn Baldwin bcopy(nd.ni_cnd.cn_nameptr, p->p_comm, 6485ca4819dSJohn Baldwin min(nd.ni_cnd.cn_namelen, MAXCOMLEN)); 64961617058SMateusz Guzik else if (vn_commname(newtextvp, p->p_comm, sizeof(p->p_comm)) != 0) 6505ca4819dSJohn Baldwin bcopy(fexecv_proc_title, p->p_comm, sizeof(fexecv_proc_title)); 651ca081fdbSJulian Elischer bcopy(p->p_comm, td->td_name, sizeof(td->td_name)); 65244ad5475SJohn Baldwin #ifdef KTR 65344ad5475SJohn Baldwin sched_clear_tdname(td); 65444ad5475SJohn Baldwin #endif 65526f9a767SRodney W. Grimes 65626f9a767SRodney W. Grimes /* 65724b34f09SSujal Patel * mark as execed, wakeup the process that vforked (if any) and tell 658dc733423SDag-Erling Smørgrav * it that it now has its own resources back 65926f9a767SRodney W. Grimes */ 66026f9a767SRodney W. Grimes p->p_flag |= P_EXEC; 661677258f7SKonstantin Belousov if ((p->p_flag2 & P2_NOTRACE_EXEC) == 0) 662677258f7SKonstantin Belousov p->p_flag2 &= ~P2_NOTRACE; 663965d0860SMateusz Guzik if (p->p_flag & P_PPWAIT) { 664888d4d4fSKonstantin Belousov p->p_flag &= ~(P_PPWAIT | P_PPTRACE); 665aeb32571SKonstantin Belousov cv_broadcast(&p->p_pwait); 66626f9a767SRodney W. Grimes } 66726f9a767SRodney W. Grimes 66826f9a767SRodney W. Grimes /* 669a78e8d2aSDavid Greenman * Implement image setuid/setgid. 670a78e8d2aSDavid Greenman * 671a78e8d2aSDavid Greenman * Don't honor setuid/setgid if the filesystem prohibits it or if 672a78e8d2aSDavid Greenman * the process is being traced. 673670cb89bSRobert Watson * 67412bc222eSJonathan Anderson * We disable setuid/setgid/etc in compatibility mode on the basis 67512bc222eSJonathan Anderson * that most setugid applications are not written with that 67612bc222eSJonathan Anderson * environment in mind, and will therefore almost certainly operate 67712bc222eSJonathan Anderson * incorrectly. In principle there's no reason that setugid 67812bc222eSJonathan Anderson * applications might not be useful in capability mode, so we may want 67912bc222eSJonathan Anderson * to reconsider this conservative design choice in the future. 68012bc222eSJonathan Anderson * 681670cb89bSRobert Watson * XXXMAC: For the time being, use NOSUID to also prohibit 682670cb89bSRobert Watson * transitions on the file system. 683c52007c2SDavid Greenman */ 684d06c0d4dSRobert Watson credential_changing = 0; 685dfa7fd1dSEdward Tomasz Napierala credential_changing |= (attr.va_mode & S_ISUID) && oldcred->cr_uid != 686d06c0d4dSRobert Watson attr.va_uid; 687dfa7fd1dSEdward Tomasz Napierala credential_changing |= (attr.va_mode & S_ISGID) && oldcred->cr_gid != 688d06c0d4dSRobert Watson attr.va_gid; 689ccafe7ebSRobert Watson #ifdef MAC 69030d239bcSRobert Watson will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp, 6916356dba0SRobert Watson interpvplabel, imgp); 692ccafe7ebSRobert Watson credential_changing |= will_transition; 693ccafe7ebSRobert Watson #endif 694d06c0d4dSRobert Watson 695d06c0d4dSRobert Watson if (credential_changing && 69612bc222eSJonathan Anderson #ifdef CAPABILITY_MODE 69712bc222eSJonathan Anderson ((oldcred->cr_flags & CRED_FLAG_CAPMODE) == 0) && 69812bc222eSJonathan Anderson #endif 699a78e8d2aSDavid Greenman (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 && 700c52007c2SDavid Greenman (p->p_flag & P_TRACED) == 0) { 701c52007c2SDavid Greenman /* 702c52007c2SDavid Greenman * Turn off syscall tracing for set-id programs, except for 703b85db196SPeter Wemm * root. Record any set-id flags first to make sure that 704b85db196SPeter Wemm * we do not regain any tracing during a possible block. 70526f9a767SRodney W. Grimes */ 706b85db196SPeter Wemm setsugid(p); 707acd3428bSRobert Watson 7086c84de02SJohn Baldwin #ifdef KTRACE 709c331c970SAndriy Gapon if (p->p_tracecred != NULL && 710c331c970SAndriy Gapon priv_check_cred(p->p_tracecred, PRIV_DEBUG_DIFFCRED, 0)) 711d680caabSJohn Baldwin ktrprocexec(p, &tracecred, &tracevp); 7126c84de02SJohn Baldwin #endif 71328b325aaSDon Lewis /* 714c1e2d386SNate Lawson * Close any file descriptors 0..2 that reference procfs, 715c1e2d386SNate Lawson * then make sure file descriptors 0..2 are in use. 71628b325aaSDon Lewis * 7178a5177ccSMateusz Guzik * Both fdsetugidsafety() and fdcheckstd() may call functions 7188a5177ccSMateusz Guzik * taking sleepable locks, so temporarily drop our locks. 71928b325aaSDon Lewis */ 72028b325aaSDon Lewis PROC_UNLOCK(p); 72122db15c0SAttilio Rao VOP_UNLOCK(imgp->vp, 0); 72211888da8SMateusz Guzik fdsetugidsafety(td); 723e983a376SJacques Vidrine error = fdcheckstd(td); 72463c9e754SJohn Baldwin if (error != 0) 72569be5db9SAlfred Perlstein goto done1; 726350d5181SMateusz Guzik newcred = crdup(oldcred); 727350d5181SMateusz Guzik euip = uifind(attr.va_uid); 7285e2554b7SMateusz Guzik vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 729e1b1aa3bSJohn Baldwin PROC_LOCK(p); 730c52007c2SDavid Greenman /* 731c52007c2SDavid Greenman * Set the new credentials. 732c52007c2SDavid Greenman */ 733dfa7fd1dSEdward Tomasz Napierala if (attr.va_mode & S_ISUID) 7341419eacbSAlfred Perlstein change_euid(newcred, euip); 735dfa7fd1dSEdward Tomasz Napierala if (attr.va_mode & S_ISGID) 736b1fc0ec1SRobert Watson change_egid(newcred, attr.va_gid); 737ccafe7ebSRobert Watson #ifdef MAC 738670cb89bSRobert Watson if (will_transition) { 73930d239bcSRobert Watson mac_vnode_execve_transition(oldcred, newcred, imgp->vp, 7406356dba0SRobert Watson interpvplabel, imgp); 741670cb89bSRobert Watson } 742ccafe7ebSRobert Watson #endif 7439b3b1c5fSJohn Baldwin /* 7449b3b1c5fSJohn Baldwin * Implement correct POSIX saved-id behavior. 745ccafe7ebSRobert Watson * 746ccafe7ebSRobert Watson * XXXMAC: Note that the current logic will save the 747ccafe7ebSRobert Watson * uid and gid if a MAC domain transition occurs, even 748ccafe7ebSRobert Watson * though maybe it shouldn't. 7499b3b1c5fSJohn Baldwin */ 7509b3b1c5fSJohn Baldwin change_svuid(newcred, newcred->cr_uid); 7519b3b1c5fSJohn Baldwin change_svgid(newcred, newcred->cr_gid); 752daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 753c52007c2SDavid Greenman } else { 754b1fc0ec1SRobert Watson if (oldcred->cr_uid == oldcred->cr_ruid && 755b1fc0ec1SRobert Watson oldcred->cr_gid == oldcred->cr_rgid) 756c52007c2SDavid Greenman p->p_flag &= ~P_SUGID; 75726f9a767SRodney W. Grimes /* 758c52007c2SDavid Greenman * Implement correct POSIX saved-id behavior. 759b1fc0ec1SRobert Watson * 760b1fc0ec1SRobert Watson * XXX: It's not clear that the existing behavior is 7619b3b1c5fSJohn Baldwin * POSIX-compliant. A number of sources indicate that the 7629b3b1c5fSJohn Baldwin * saved uid/gid should only be updated if the new ruid is 7639b3b1c5fSJohn Baldwin * not equal to the old ruid, or the new euid is not equal 7649b3b1c5fSJohn Baldwin * to the old euid and the new euid is not equal to the old 7659b3b1c5fSJohn Baldwin * ruid. The FreeBSD code always updates the saved uid/gid. 7669b3b1c5fSJohn Baldwin * Also, this code uses the new (replaced) euid and egid as 7679b3b1c5fSJohn Baldwin * the source, which may or may not be the right ones to use. 76826f9a767SRodney W. Grimes */ 769b1fc0ec1SRobert Watson if (oldcred->cr_svuid != oldcred->cr_uid || 770b1fc0ec1SRobert Watson oldcred->cr_svgid != oldcred->cr_gid) { 771350d5181SMateusz Guzik PROC_UNLOCK(p); 7725e2554b7SMateusz Guzik VOP_UNLOCK(imgp->vp, 0); 773350d5181SMateusz Guzik newcred = crdup(oldcred); 7745e2554b7SMateusz Guzik vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 775350d5181SMateusz Guzik PROC_LOCK(p); 776b1fc0ec1SRobert Watson change_svuid(newcred, newcred->cr_uid); 777b1fc0ec1SRobert Watson change_svgid(newcred, newcred->cr_gid); 778daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 7799b3b1c5fSJohn Baldwin } 780b1fc0ec1SRobert Watson } 78126f9a767SRodney W. Grimes 78226f9a767SRodney W. Grimes /* 783853be5ffSMateusz Guzik * Store the vp for use in procfs. This vnode was referenced by namei 784853be5ffSMateusz Guzik * or fgetvp_exec. 7852a531c80SDavid Greenman */ 78661617058SMateusz Guzik oldtextvp = p->p_textvp; 78761617058SMateusz Guzik p->p_textvp = newtextvp; 7882a531c80SDavid Greenman 7895d217f17SJohn Birrell #ifdef KDTRACE_HOOKS 7905d217f17SJohn Birrell /* 7915d217f17SJohn Birrell * Tell the DTrace fasttrap provider about the exec if it 7925d217f17SJohn Birrell * has declared an interest. 7935d217f17SJohn Birrell */ 7945d217f17SJohn Birrell if (dtrace_fasttrap_exec) 7955d217f17SJohn Birrell dtrace_fasttrap_exec(p); 7965d217f17SJohn Birrell #endif 7975d217f17SJohn Birrell 7982a531c80SDavid Greenman /* 7999ca45e81SDag-Erling Smørgrav * Notify others that we exec'd, and clear the P_INEXEC flag 8009ca45e81SDag-Erling Smørgrav * as we're now a bona fide freshly-execed process. 801cb679c38SJonathan Lemon */ 802ad3b9257SJohn-Mark Gurney KNOTE_LOCKED(&p->p_klist, NOTE_EXEC); 8039ca45e81SDag-Erling Smørgrav p->p_flag &= ~P_INEXEC; 804cb679c38SJonathan Lemon 80526f9a767SRodney W. Grimes /* clear "fork but no exec" flag, as we _are_ execing */ 80626f9a767SRodney W. Grimes p->p_acflag &= ~AFORK; 80726f9a767SRodney W. Grimes 8085997cae9SDon Lewis /* 80934ea500bSDon Lewis * Free any previous argument cache and replace it with 8105997cae9SDon Lewis * the new argument cache, if any. 8115997cae9SDon Lewis */ 8129b3b1c5fSJohn Baldwin oldargs = p->p_args; 813e1b1aa3bSJohn Baldwin p->p_args = newargs; 814e1b1aa3bSJohn Baldwin newargs = NULL; 815ebccf1e3SJoseph Koshy 816ebccf1e3SJoseph Koshy #ifdef HWPMC_HOOKS 817ebccf1e3SJoseph Koshy /* 818f263522aSJoseph Koshy * Check if system-wide sampling is in effect or if the 819f263522aSJoseph Koshy * current process is using PMCs. If so, do exec() time 820ebccf1e3SJoseph Koshy * processing. This processing needs to happen AFTER the 821ebccf1e3SJoseph Koshy * P_INEXEC flag is cleared. 822ebccf1e3SJoseph Koshy * 823ebccf1e3SJoseph Koshy * The proc lock needs to be released before taking the PMC 824ebccf1e3SJoseph Koshy * SX. 825ebccf1e3SJoseph Koshy */ 826f263522aSJoseph Koshy if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) { 827e1b1aa3bSJohn Baldwin PROC_UNLOCK(p); 8281ef6ea9bSKonstantin Belousov VOP_UNLOCK(imgp->vp, 0); 82915139246SJoseph Koshy pe.pm_credentialschanged = credential_changing; 83015139246SJoseph Koshy pe.pm_entryaddr = imgp->entry_addr; 83115139246SJoseph Koshy 83215139246SJoseph Koshy PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe); 8332974cc36SKonstantin Belousov vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 834ebccf1e3SJoseph Koshy } else 835ebccf1e3SJoseph Koshy PROC_UNLOCK(p); 836ebccf1e3SJoseph Koshy #else /* !HWPMC_HOOKS */ 837ebccf1e3SJoseph Koshy PROC_UNLOCK(p); 838ebccf1e3SJoseph Koshy #endif 839e1b1aa3bSJohn Baldwin 840e913ca22SDoug Rabson /* Set values passed into the program in registers. */ 8413ebc1248SPeter Wemm if (p->p_sysent->sv_setregs) 842a107d8aaSNathan Whitehorn (*p->p_sysent->sv_setregs)(td, imgp, 843a107d8aaSNathan Whitehorn (u_long)(uintptr_t)stack_base); 8443ebc1248SPeter Wemm else 845a107d8aaSNathan Whitehorn exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base); 846e913ca22SDoug Rabson 8470359a12eSAttilio Rao vfs_mark_atime(imgp->vp, td->td_ucred); 8486341095eSKen Smith 849d9fae5abSAndriy Gapon SDT_PROBE(proc, kernel, , exec__success, args->fname, 0, 0, 0, 0); 8505d217f17SJohn Birrell 8515e2554b7SMateusz Guzik VOP_UNLOCK(imgp->vp, 0); 852e506f34bSCraig Rodrigues done1: 8539b3b1c5fSJohn Baldwin /* 8549b3b1c5fSJohn Baldwin * Free any resources malloc'd earlier that we didn't use. 8559b3b1c5fSJohn Baldwin */ 856350d5181SMateusz Guzik if (euip != NULL) 8571419eacbSAlfred Perlstein uifree(euip); 858350d5181SMateusz Guzik if (newcred != NULL) 8599b3b1c5fSJohn Baldwin crfree(oldcred); 8605d217f17SJohn Birrell 8619b3b1c5fSJohn Baldwin /* 8629b3b1c5fSJohn Baldwin * Handle deferred decrement of ref counts. 8639b3b1c5fSJohn Baldwin */ 86461617058SMateusz Guzik if (oldtextvp != NULL) 86561617058SMateusz Guzik vrele(oldtextvp); 8666c84de02SJohn Baldwin #ifdef KTRACE 8675050aa86SKonstantin Belousov if (tracevp != NULL) 8689b3b1c5fSJohn Baldwin vrele(tracevp); 869a5881ea5SJohn Baldwin if (tracecred != NULL) 870a5881ea5SJohn Baldwin crfree(tracecred); 8716c84de02SJohn Baldwin #endif 8722974cc36SKonstantin Belousov vn_lock(imgp->vp, LK_SHARED | LK_RETRY); 8739b3b1c5fSJohn Baldwin pargs_drop(oldargs); 87469be5db9SAlfred Perlstein pargs_drop(newargs); 87590af4afaSJohn Baldwin if (oldsigacts != NULL) 87690af4afaSJohn Baldwin sigacts_free(oldsigacts); 877b9df5231SPoul-Henning Kamp 8781616db3cSJohn Dyson exec_fail_dealloc: 8791616db3cSJohn Dyson 88026f9a767SRodney W. Grimes /* 88126f9a767SRodney W. Grimes * free various allocated resources 88226f9a767SRodney W. Grimes */ 883d6c847f3SBruce Evans if (imgp->firstpage != NULL) 8841616db3cSJohn Dyson exec_unmap_first_page(imgp); 88526f9a767SRodney W. Grimes 886d6c847f3SBruce Evans if (imgp->vp != NULL) { 887632dbc19SKonstantin Belousov if (args->fname) 88869c9eff8SEd Schouten NDFREE(&nd, NDF_ONLY_PNBUF); 8899a75ea23SKonstantin Belousov if (imgp->opened) 8909a75ea23SKonstantin Belousov VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td); 891853be5ffSMateusz Guzik if (error != 0) 892619eb6e5SJeff Roberson vput(imgp->vp); 893853be5ffSMateusz Guzik else 894853be5ffSMateusz Guzik VOP_UNLOCK(imgp->vp, 0); 895a3cf6ebaSDavid Greenman } 89626f9a767SRodney W. Grimes 897d6c847f3SBruce Evans if (imgp->object != NULL) 8980b2ed1aeSJeff Roberson vm_object_deallocate(imgp->object); 8990b2ed1aeSJeff Roberson 9003ff06357SKonstantin Belousov free(imgp->freepath, M_TEMP); 9013ff06357SKonstantin Belousov 902d1989db5SRobert Drehmel if (error == 0) { 903afe1a688SKonstantin Belousov PROC_LOCK(p); 904afe1a688SKonstantin Belousov td->td_dbgflags |= TDB_EXEC; 905afe1a688SKonstantin Belousov PROC_UNLOCK(p); 906afe1a688SKonstantin Belousov 907d1989db5SRobert Drehmel /* 908d1989db5SRobert Drehmel * Stop the process here if its stop event mask has 909d1989db5SRobert Drehmel * the S_EXEC bit set. 910d1989db5SRobert Drehmel */ 911d1989db5SRobert Drehmel STOPEVENT(p, S_EXEC, 0); 912116734c4SMatthew Dillon goto done2; 913d1989db5SRobert Drehmel } 9141616db3cSJohn Dyson 91526f9a767SRodney W. Grimes exec_fail: 9169ca45e81SDag-Erling Smørgrav /* we're done here, clear P_INEXEC */ 9179ca45e81SDag-Erling Smørgrav PROC_LOCK(p); 9189ca45e81SDag-Erling Smørgrav p->p_flag &= ~P_INEXEC; 9199ca45e81SDag-Erling Smørgrav PROC_UNLOCK(p); 9209ca45e81SDag-Erling Smørgrav 921d9fae5abSAndriy Gapon SDT_PROBE(proc, kernel, , exec__failure, error, 0, 0, 0, 0); 9225d217f17SJohn Birrell 923116734c4SMatthew Dillon done2: 924670cb89bSRobert Watson #ifdef MAC 925670cb89bSRobert Watson mac_execve_exit(imgp); 9266356dba0SRobert Watson mac_execve_interpreter_exit(interpvplabel); 927670cb89bSRobert Watson #endif 9288917b8d2SJohn Baldwin exec_free_args(args); 9298917b8d2SJohn Baldwin 9308917b8d2SJohn Baldwin if (error && imgp->vmspace_destroyed) { 9318917b8d2SJohn Baldwin /* sorry, no more process anymore. exit gracefully */ 932b4490c6eSKonstantin Belousov exit1(td, 0, SIGABRT); 9338917b8d2SJohn Baldwin /* NOT REACHED */ 9348917b8d2SJohn Baldwin } 9357705d4b2SDmitry Chagin 9367705d4b2SDmitry Chagin #ifdef KTRACE 9377705d4b2SDmitry Chagin if (error == 0) 9387705d4b2SDmitry Chagin ktrprocctor(p); 9397705d4b2SDmitry Chagin #endif 9407705d4b2SDmitry Chagin 941116734c4SMatthew Dillon return (error); 94226f9a767SRodney W. Grimes } 94326f9a767SRodney W. Grimes 9441616db3cSJohn Dyson int 9451616db3cSJohn Dyson exec_map_first_page(imgp) 9461616db3cSJohn Dyson struct image_params *imgp; 9471616db3cSJohn Dyson { 948d8aad40cSJohn Baldwin int rv, i; 94995461b45SJohn Dyson int initial_pagein; 95095461b45SJohn Dyson vm_page_t ma[VM_INITIAL_PAGEIN]; 9511616db3cSJohn Dyson vm_object_t object; 9521616db3cSJohn Dyson 953d6c847f3SBruce Evans if (imgp->firstpage != NULL) 9541616db3cSJohn Dyson exec_unmap_first_page(imgp); 9551616db3cSJohn Dyson 9568516dd18SPoul-Henning Kamp object = imgp->vp->v_object; 9574d7d2993SJeff Roberson if (object == NULL) 9584d7d2993SJeff Roberson return (EACCES); 95989f6b863SAttilio Rao VM_OBJECT_WLOCK(object); 960f8a47341SAlan Cox #if VM_NRESERVLEVEL > 0 9613d653db0SAlan Cox vm_object_color(object, 0); 962f8a47341SAlan Cox #endif 9635944de8eSKonstantin Belousov ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL); 9640a2e596aSAlan Cox if (ma[0]->valid != VM_PAGE_BITS_ALL) { 96595461b45SJohn Dyson initial_pagein = VM_INITIAL_PAGEIN; 96695461b45SJohn Dyson if (initial_pagein > object->size) 96795461b45SJohn Dyson initial_pagein = object->size; 96895461b45SJohn Dyson for (i = 1; i < initial_pagein; i++) { 96941890423SAlan Cox if ((ma[i] = vm_page_next(ma[i - 1])) != NULL) { 9706ec2fca5SAlan Cox if (ma[i]->valid) 9716ec2fca5SAlan Cox break; 972c7aebda8SAttilio Rao if (vm_page_tryxbusy(ma[i])) 97306fa71cdSAlan Cox break; 97495461b45SJohn Dyson } else { 975ca0387efSJake Burkholder ma[i] = vm_page_alloc(object, i, 9767bfda801SAlan Cox VM_ALLOC_NORMAL | VM_ALLOC_IFNOTCACHED); 97795461b45SJohn Dyson if (ma[i] == NULL) 97895461b45SJohn Dyson break; 97995461b45SJohn Dyson } 98095461b45SJohn Dyson } 98195461b45SJohn Dyson initial_pagein = i; 98295461b45SJohn Dyson rv = vm_pager_get_pages(object, ma, initial_pagein, 0); 983093c7f39SGleb Smirnoff if (rv != VM_PAGER_OK) { 9845ac59343SAlan Cox vm_page_lock(ma[0]); 9858f9110f6SJohn Dyson vm_page_free(ma[0]); 9865ac59343SAlan Cox vm_page_unlock(ma[0]); 98789f6b863SAttilio Rao VM_OBJECT_WUNLOCK(object); 988a7cddfedSJake Burkholder return (EIO); 9891616db3cSJohn Dyson } 9901616db3cSJohn Dyson } 991c7aebda8SAttilio Rao vm_page_xunbusy(ma[0]); 9922965a453SKip Macy vm_page_lock(ma[0]); 993be996836SAttilio Rao vm_page_hold(ma[0]); 99470978c93SKonstantin Belousov vm_page_activate(ma[0]); 9952965a453SKip Macy vm_page_unlock(ma[0]); 99689f6b863SAttilio Rao VM_OBJECT_WUNLOCK(object); 9971616db3cSJohn Dyson 99859c8bc40SAlan Cox imgp->firstpage = sf_buf_alloc(ma[0], 0); 99959c8bc40SAlan Cox imgp->image_header = (char *)sf_buf_kva(imgp->firstpage); 10001616db3cSJohn Dyson 1001a7cddfedSJake Burkholder return (0); 10021616db3cSJohn Dyson } 10031616db3cSJohn Dyson 10041616db3cSJohn Dyson void 10051616db3cSJohn Dyson exec_unmap_first_page(imgp) 10061616db3cSJohn Dyson struct image_params *imgp; 10071616db3cSJohn Dyson { 100859c8bc40SAlan Cox vm_page_t m; 100923955314SAlfred Perlstein 1010d6c847f3SBruce Evans if (imgp->firstpage != NULL) { 101159c8bc40SAlan Cox m = sf_buf_page(imgp->firstpage); 101259c8bc40SAlan Cox sf_buf_free(imgp->firstpage); 10131616db3cSJohn Dyson imgp->firstpage = NULL; 10142965a453SKip Macy vm_page_lock(m); 1015be996836SAttilio Rao vm_page_unhold(m); 10162965a453SKip Macy vm_page_unlock(m); 10171616db3cSJohn Dyson } 10181616db3cSJohn Dyson } 10191616db3cSJohn Dyson 102026f9a767SRodney W. Grimes /* 102126f9a767SRodney W. Grimes * Destroy old address space, and allocate a new stack 102226f9a767SRodney W. Grimes * The new stack is only SGROWSIZ large because it is grown 102326f9a767SRodney W. Grimes * automatically in trap.c. 102426f9a767SRodney W. Grimes */ 102526f9a767SRodney W. Grimes int 102605ba50f5SJake Burkholder exec_new_vmspace(imgp, sv) 1027c52007c2SDavid Greenman struct image_params *imgp; 102805ba50f5SJake Burkholder struct sysentvec *sv; 102926f9a767SRodney W. Grimes { 103026f9a767SRodney W. Grimes int error; 10315e20c11fSAlan Cox struct proc *p = imgp->proc; 10325e20c11fSAlan Cox struct vmspace *vmspace = p->p_vmspace; 10336297a3d8SKonstantin Belousov vm_object_t obj; 1034316b3843SKonstantin Belousov struct rlimit rlim_stack; 1035878adb85SBjoern A. Zeeb vm_offset_t sv_minuser, stack_addr; 103605ba50f5SJake Burkholder vm_map_t map; 103759d8f3ffSJohn Baldwin u_long ssiz; 103826f9a767SRodney W. Grimes 1039c52007c2SDavid Greenman imgp->vmspace_destroyed = 1; 1040993182e5SAlexander Leidinger imgp->sysent = sv; 104126f9a767SRodney W. Grimes 1042bd37fd72SKris Kennaway /* May be called with Giant held */ 1043993182e5SAlexander Leidinger EVENTHANDLER_INVOKE(process_exec, p, imgp); 10446f5dafeaSAlan Cox 10456f5dafeaSAlan Cox /* 1046af9ec885SJohn Dyson * Blow away entire process VM, if address space not shared, 1047af9ec885SJohn Dyson * otherwise, create a new VM space so that other threads are 1048af9ec885SJohn Dyson * not disrupted 1049af9ec885SJohn Dyson */ 105005ba50f5SJake Burkholder map = &vmspace->vm_map; 1051878adb85SBjoern A. Zeeb if (map_at_zero) 1052878adb85SBjoern A. Zeeb sv_minuser = sv->sv_minuser; 1053878adb85SBjoern A. Zeeb else 1054878adb85SBjoern A. Zeeb sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE); 1055878adb85SBjoern A. Zeeb if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser && 105605ba50f5SJake Burkholder vm_map_max(map) == sv->sv_maxuser) { 10573db161e0SMatthew Dillon shmexit(vmspace); 1058b9eee07eSPeter Wemm pmap_remove_pages(vmspace_pmap(vmspace)); 105905ba50f5SJake Burkholder vm_map_remove(map, vm_map_min(map), vm_map_max(map)); 1060af9ec885SJohn Dyson } else { 1061878adb85SBjoern A. Zeeb error = vmspace_exec(p, sv_minuser, sv->sv_maxuser); 106289b57fcfSKonstantin Belousov if (error) 106389b57fcfSKonstantin Belousov return (error); 10645e20c11fSAlan Cox vmspace = p->p_vmspace; 106505ba50f5SJake Burkholder map = &vmspace->vm_map; 1066af9ec885SJohn Dyson } 106726f9a767SRodney W. Grimes 10686297a3d8SKonstantin Belousov /* Map a shared page */ 10696297a3d8SKonstantin Belousov obj = sv->sv_shared_page_obj; 10706297a3d8SKonstantin Belousov if (obj != NULL) { 10716297a3d8SKonstantin Belousov vm_object_reference(obj); 10726297a3d8SKonstantin Belousov error = vm_map_fixed(map, obj, 0, 10736297a3d8SKonstantin Belousov sv->sv_shared_page_base, sv->sv_shared_page_len, 10741e65d73cSKonstantin Belousov VM_PROT_READ | VM_PROT_EXECUTE, 10751e65d73cSKonstantin Belousov VM_PROT_READ | VM_PROT_EXECUTE, 10761e65d73cSKonstantin Belousov MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE); 10776297a3d8SKonstantin Belousov if (error) { 10786297a3d8SKonstantin Belousov vm_object_deallocate(obj); 10796297a3d8SKonstantin Belousov return (error); 10806297a3d8SKonstantin Belousov } 10816297a3d8SKonstantin Belousov } 10826297a3d8SKonstantin Belousov 108326f9a767SRodney W. Grimes /* Allocate a new stack */ 1084316b3843SKonstantin Belousov if (imgp->stack_sz != 0) { 1085fe8a824cSKonstantin Belousov ssiz = trunc_page(imgp->stack_sz); 1086316b3843SKonstantin Belousov PROC_LOCK(p); 1087f6f6d240SMateusz Guzik lim_rlimit_proc(p, RLIMIT_STACK, &rlim_stack); 1088316b3843SKonstantin Belousov PROC_UNLOCK(p); 1089316b3843SKonstantin Belousov if (ssiz > rlim_stack.rlim_max) 1090316b3843SKonstantin Belousov ssiz = rlim_stack.rlim_max; 1091316b3843SKonstantin Belousov if (ssiz > rlim_stack.rlim_cur) { 1092316b3843SKonstantin Belousov rlim_stack.rlim_cur = ssiz; 1093316b3843SKonstantin Belousov kern_setrlimit(curthread, RLIMIT_STACK, &rlim_stack); 1094316b3843SKonstantin Belousov } 1095316b3843SKonstantin Belousov } else if (sv->sv_maxssiz != NULL) { 109659d8f3ffSJohn Baldwin ssiz = *sv->sv_maxssiz; 1097316b3843SKonstantin Belousov } else { 109859d8f3ffSJohn Baldwin ssiz = maxssiz; 1099316b3843SKonstantin Belousov } 110059d8f3ffSJohn Baldwin stack_addr = sv->sv_usrstack - ssiz; 110159d8f3ffSJohn Baldwin error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz, 11026297a3d8SKonstantin Belousov obj != NULL && imgp->stack_prot != 0 ? imgp->stack_prot : 11036297a3d8SKonstantin Belousov sv->sv_stackprot, 11046297a3d8SKonstantin Belousov VM_PROT_ALL, MAP_STACK_GROWS_DOWN); 11052267af78SJulian Elischer if (error) 11062267af78SJulian Elischer return (error); 11072267af78SJulian Elischer 110878960940SAlan Cox /* 110978960940SAlan Cox * vm_ssize and vm_maxsaddr are somewhat antiquated concepts, but they 111078960940SAlan Cox * are still used to enforce the stack rlimit on the process stack. 11112267af78SJulian Elischer */ 1112cbc89bfbSPaul Saab vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT; 11136ef12002SKonstantin Belousov vmspace->vm_maxsaddr = (char *)stack_addr; 111426f9a767SRodney W. Grimes 111526f9a767SRodney W. Grimes return (0); 111626f9a767SRodney W. Grimes } 111726f9a767SRodney W. Grimes 111826f9a767SRodney W. Grimes /* 1119873fbcd7SRobert Watson * Copy out argument and environment strings from the old process address 1120873fbcd7SRobert Watson * space into the temporary string buffer. 112126f9a767SRodney W. Grimes */ 112226f9a767SRodney W. Grimes int 1123610ecfe0SMaxim Sobolev exec_copyin_args(struct image_args *args, char *fname, 1124610ecfe0SMaxim Sobolev enum uio_seg segflg, char **argv, char **envv) 112526f9a767SRodney W. Grimes { 11260a2c94b8SKonstantin Belousov u_long argp, envp; 1127ecbb00a2SDoug Rabson int error; 1128ecbb00a2SDoug Rabson size_t length; 112926f9a767SRodney W. Grimes 1130610ecfe0SMaxim Sobolev bzero(args, sizeof(*args)); 1131610ecfe0SMaxim Sobolev if (argv == NULL) 1132610ecfe0SMaxim Sobolev return (EFAULT); 11332af6e14dSAlan Cox 113426f9a767SRodney W. Grimes /* 11352af6e14dSAlan Cox * Allocate demand-paged memory for the file name, argument, and 11362af6e14dSAlan Cox * environment strings. 113726f9a767SRodney W. Grimes */ 11382af6e14dSAlan Cox error = exec_alloc_args(args); 11392af6e14dSAlan Cox if (error != 0) 11402af6e14dSAlan Cox return (error); 11419e4e5114SAlan Cox 1142610ecfe0SMaxim Sobolev /* 1143610ecfe0SMaxim Sobolev * Copy the file name. 1144610ecfe0SMaxim Sobolev */ 1145632dbc19SKonstantin Belousov if (fname != NULL) { 11462af6e14dSAlan Cox args->fname = args->buf; 1147610ecfe0SMaxim Sobolev error = (segflg == UIO_SYSSPACE) ? 1148610ecfe0SMaxim Sobolev copystr(fname, args->fname, PATH_MAX, &length) : 1149610ecfe0SMaxim Sobolev copyinstr(fname, args->fname, PATH_MAX, &length); 1150c30af532SMaxim Sobolev if (error != 0) 115168ff3c24SStephan Uphoff goto err_exit; 1152632dbc19SKonstantin Belousov } else 11539e4e5114SAlan Cox length = 0; 11549e4e5114SAlan Cox 11552af6e14dSAlan Cox args->begin_argv = args->buf + length; 11569e4e5114SAlan Cox args->endp = args->begin_argv; 11579e4e5114SAlan Cox args->stringspace = ARG_MAX; 115826f9a767SRodney W. Grimes 1159610ecfe0SMaxim Sobolev /* 1160610ecfe0SMaxim Sobolev * extract arguments first 1161610ecfe0SMaxim Sobolev */ 11620a2c94b8SKonstantin Belousov for (;;) { 11630a2c94b8SKonstantin Belousov error = fueword(argv++, &argp); 11640a2c94b8SKonstantin Belousov if (error == -1) { 116568ff3c24SStephan Uphoff error = EFAULT; 116668ff3c24SStephan Uphoff goto err_exit; 116768ff3c24SStephan Uphoff } 11680a2c94b8SKonstantin Belousov if (argp == 0) 11690a2c94b8SKonstantin Belousov break; 11700a2c94b8SKonstantin Belousov error = copyinstr((void *)(uintptr_t)argp, args->endp, 11710a2c94b8SKonstantin Belousov args->stringspace, &length); 11720a2c94b8SKonstantin Belousov if (error != 0) { 1173610ecfe0SMaxim Sobolev if (error == ENAMETOOLONG) 117468ff3c24SStephan Uphoff error = E2BIG; 117568ff3c24SStephan Uphoff goto err_exit; 1176610ecfe0SMaxim Sobolev } 1177610ecfe0SMaxim Sobolev args->stringspace -= length; 1178610ecfe0SMaxim Sobolev args->endp += length; 1179610ecfe0SMaxim Sobolev args->argc++; 1180610ecfe0SMaxim Sobolev } 1181610ecfe0SMaxim Sobolev 1182610ecfe0SMaxim Sobolev args->begin_envv = args->endp; 1183b9df5231SPoul-Henning Kamp 118426f9a767SRodney W. Grimes /* 118526f9a767SRodney W. Grimes * extract environment strings 118626f9a767SRodney W. Grimes */ 11870fd1a014SDavid Greenman if (envv) { 11880a2c94b8SKonstantin Belousov for (;;) { 11890a2c94b8SKonstantin Belousov error = fueword(envv++, &envp); 11900a2c94b8SKonstantin Belousov if (error == -1) { 119168ff3c24SStephan Uphoff error = EFAULT; 119268ff3c24SStephan Uphoff goto err_exit; 119368ff3c24SStephan Uphoff } 11940a2c94b8SKonstantin Belousov if (envp == 0) 11950a2c94b8SKonstantin Belousov break; 11960a2c94b8SKonstantin Belousov error = copyinstr((void *)(uintptr_t)envp, 11970a2c94b8SKonstantin Belousov args->endp, args->stringspace, &length); 11980a2c94b8SKonstantin Belousov if (error != 0) { 11990fd1a014SDavid Greenman if (error == ENAMETOOLONG) 120068ff3c24SStephan Uphoff error = E2BIG; 120168ff3c24SStephan Uphoff goto err_exit; 12020fd1a014SDavid Greenman } 1203610ecfe0SMaxim Sobolev args->stringspace -= length; 1204610ecfe0SMaxim Sobolev args->endp += length; 1205610ecfe0SMaxim Sobolev args->envc++; 120626f9a767SRodney W. Grimes } 12070fd1a014SDavid Greenman } 120826f9a767SRodney W. Grimes 120926f9a767SRodney W. Grimes return (0); 121068ff3c24SStephan Uphoff 121168ff3c24SStephan Uphoff err_exit: 121268ff3c24SStephan Uphoff exec_free_args(args); 121368ff3c24SStephan Uphoff return (error); 121426f9a767SRodney W. Grimes } 121526f9a767SRodney W. Grimes 1216457f7e23SEd Schouten int 1217457f7e23SEd Schouten exec_copyin_data_fds(struct thread *td, struct image_args *args, 1218457f7e23SEd Schouten const void *data, size_t datalen, const int *fds, size_t fdslen) 1219457f7e23SEd Schouten { 1220457f7e23SEd Schouten struct filedesc *ofdp; 1221457f7e23SEd Schouten const char *p; 1222457f7e23SEd Schouten int *kfds; 1223457f7e23SEd Schouten int error; 1224457f7e23SEd Schouten 1225457f7e23SEd Schouten memset(args, '\0', sizeof(*args)); 1226457f7e23SEd Schouten ofdp = td->td_proc->p_fd; 1227457f7e23SEd Schouten if (datalen >= ARG_MAX || fdslen > ofdp->fd_lastfile + 1) 1228457f7e23SEd Schouten return (E2BIG); 1229457f7e23SEd Schouten error = exec_alloc_args(args); 1230457f7e23SEd Schouten if (error != 0) 1231457f7e23SEd Schouten return (error); 1232457f7e23SEd Schouten 1233457f7e23SEd Schouten args->begin_argv = args->buf; 1234457f7e23SEd Schouten args->stringspace = ARG_MAX; 1235457f7e23SEd Schouten 1236457f7e23SEd Schouten if (datalen > 0) { 1237457f7e23SEd Schouten /* 1238457f7e23SEd Schouten * Argument buffer has been provided. Copy it into the 1239457f7e23SEd Schouten * kernel as a single string and add a terminating null 1240457f7e23SEd Schouten * byte. 1241457f7e23SEd Schouten */ 1242457f7e23SEd Schouten error = copyin(data, args->begin_argv, datalen); 1243457f7e23SEd Schouten if (error != 0) 1244457f7e23SEd Schouten goto err_exit; 1245457f7e23SEd Schouten args->begin_argv[datalen] = '\0'; 1246457f7e23SEd Schouten args->endp = args->begin_argv + datalen + 1; 1247457f7e23SEd Schouten args->stringspace -= datalen + 1; 1248457f7e23SEd Schouten 1249457f7e23SEd Schouten /* 1250457f7e23SEd Schouten * Traditional argument counting. Count the number of 1251457f7e23SEd Schouten * null bytes. 1252457f7e23SEd Schouten */ 1253457f7e23SEd Schouten for (p = args->begin_argv; p < args->endp; ++p) 1254457f7e23SEd Schouten if (*p == '\0') 1255457f7e23SEd Schouten ++args->argc; 1256457f7e23SEd Schouten } else { 1257457f7e23SEd Schouten /* No argument buffer provided. */ 1258457f7e23SEd Schouten args->endp = args->begin_argv; 1259457f7e23SEd Schouten } 1260457f7e23SEd Schouten /* There are no environment variables. */ 1261457f7e23SEd Schouten args->begin_envv = args->endp; 1262457f7e23SEd Schouten 1263457f7e23SEd Schouten /* Create new file descriptor table. */ 1264457f7e23SEd Schouten kfds = malloc(fdslen * sizeof(int), M_TEMP, M_WAITOK); 1265457f7e23SEd Schouten error = copyin(fds, kfds, fdslen * sizeof(int)); 1266457f7e23SEd Schouten if (error != 0) { 1267457f7e23SEd Schouten free(kfds, M_TEMP); 1268457f7e23SEd Schouten goto err_exit; 1269457f7e23SEd Schouten } 1270457f7e23SEd Schouten error = fdcopy_remapped(ofdp, kfds, fdslen, &args->fdp); 1271457f7e23SEd Schouten free(kfds, M_TEMP); 1272457f7e23SEd Schouten if (error != 0) 1273457f7e23SEd Schouten goto err_exit; 1274457f7e23SEd Schouten 1275457f7e23SEd Schouten return (0); 1276457f7e23SEd Schouten err_exit: 1277457f7e23SEd Schouten exec_free_args(args); 1278457f7e23SEd Schouten return (error); 1279457f7e23SEd Schouten } 1280457f7e23SEd Schouten 12812af6e14dSAlan Cox /* 12822af6e14dSAlan Cox * Allocate temporary demand-paged, zero-filled memory for the file name, 12832af6e14dSAlan Cox * argument, and environment strings. Returns zero if the allocation succeeds 12842af6e14dSAlan Cox * and ENOMEM otherwise. 12852af6e14dSAlan Cox */ 12862af6e14dSAlan Cox int 12872af6e14dSAlan Cox exec_alloc_args(struct image_args *args) 12882af6e14dSAlan Cox { 12892af6e14dSAlan Cox 12905df87b21SJeff Roberson args->buf = (char *)kmap_alloc_wait(exec_map, PATH_MAX + ARG_MAX); 12912af6e14dSAlan Cox return (args->buf != NULL ? 0 : ENOMEM); 12922af6e14dSAlan Cox } 12932af6e14dSAlan Cox 129469a8f9e3SAlan Cox void 1295610ecfe0SMaxim Sobolev exec_free_args(struct image_args *args) 1296610ecfe0SMaxim Sobolev { 1297610ecfe0SMaxim Sobolev 129869a8f9e3SAlan Cox if (args->buf != NULL) { 12995df87b21SJeff Roberson kmap_free_wakeup(exec_map, (vm_offset_t)args->buf, 13002af6e14dSAlan Cox PATH_MAX + ARG_MAX); 1301610ecfe0SMaxim Sobolev args->buf = NULL; 1302610ecfe0SMaxim Sobolev } 1303a14a9498SAlan Cox if (args->fname_buf != NULL) { 1304a14a9498SAlan Cox free(args->fname_buf, M_TEMP); 1305a14a9498SAlan Cox args->fname_buf = NULL; 1306a14a9498SAlan Cox } 1307457f7e23SEd Schouten if (args->fdp != NULL) 1308457f7e23SEd Schouten fdescfree_remapped(args->fdp); 1309610ecfe0SMaxim Sobolev } 1310610ecfe0SMaxim Sobolev 131126f9a767SRodney W. Grimes /* 1312873fbcd7SRobert Watson * Copy strings out to the new process address space, constructing new arg 1313873fbcd7SRobert Watson * and env vector tables. Return a pointer to the base so that it can be used 1314873fbcd7SRobert Watson * as the initial stack pointer. 131526f9a767SRodney W. Grimes */ 1316654f6be1SBruce Evans register_t * 1317c52007c2SDavid Greenman exec_copyout_strings(imgp) 1318c52007c2SDavid Greenman struct image_params *imgp; 131926f9a767SRodney W. Grimes { 132026f9a767SRodney W. Grimes int argc, envc; 132126f9a767SRodney W. Grimes char **vectp; 132288b124ceSKonstantin Belousov char *stringp; 132388b124ceSKonstantin Belousov uintptr_t destp; 1324654f6be1SBruce Evans register_t *stack_base; 132593f6448cSDavid Greenman struct ps_strings *arginfo; 1326f3bec5d7SJake Burkholder struct proc *p; 13273ff06357SKonstantin Belousov size_t execpath_len; 1328ee235befSKonstantin Belousov int szsigcode, szps; 1329ee235befSKonstantin Belousov char canary[sizeof(long) * 8]; 133026f9a767SRodney W. Grimes 1331ee235befSKonstantin Belousov szps = sizeof(pagesizes[0]) * MAXPAGESIZES; 133226f9a767SRodney W. Grimes /* 133326f9a767SRodney W. Grimes * Calculate string base and vector table pointers. 1334d66a5066SPeter Wemm * Also deal with signal trampoline code for this exec type. 133526f9a767SRodney W. Grimes */ 13363ff06357SKonstantin Belousov if (imgp->execpath != NULL && imgp->auxargs != NULL) 13373ff06357SKonstantin Belousov execpath_len = strlen(imgp->execpath) + 1; 13383ff06357SKonstantin Belousov else 13393ff06357SKonstantin Belousov execpath_len = 0; 1340f3bec5d7SJake Burkholder p = imgp->proc; 1341f3bec5d7SJake Burkholder szsigcode = 0; 134205ba50f5SJake Burkholder arginfo = (struct ps_strings *)p->p_sysent->sv_psstrings; 13436297a3d8SKonstantin Belousov if (p->p_sysent->sv_sigcode_base == 0) { 1344f3bec5d7SJake Burkholder if (p->p_sysent->sv_szsigcode != NULL) 1345f3bec5d7SJake Burkholder szsigcode = *(p->p_sysent->sv_szsigcode); 13466297a3d8SKonstantin Belousov } 134788b124ceSKonstantin Belousov destp = (uintptr_t)arginfo; 13481ed012f9SPeter Wemm 134926f9a767SRodney W. Grimes /* 1350d66a5066SPeter Wemm * install sigcode 1351d66a5066SPeter Wemm */ 135288b124ceSKonstantin Belousov if (szsigcode != 0) { 135388b124ceSKonstantin Belousov destp -= szsigcode; 135488b124ceSKonstantin Belousov destp = rounddown2(destp, sizeof(void *)); 135588b124ceSKonstantin Belousov copyout(p->p_sysent->sv_sigcode, (void *)destp, szsigcode); 135688b124ceSKonstantin Belousov } 1357d66a5066SPeter Wemm 1358d66a5066SPeter Wemm /* 13593ff06357SKonstantin Belousov * Copy the image path for the rtld. 13603ff06357SKonstantin Belousov */ 13613ff06357SKonstantin Belousov if (execpath_len != 0) { 136288b124ceSKonstantin Belousov destp -= execpath_len; 136388b124ceSKonstantin Belousov imgp->execpathp = destp; 136488b124ceSKonstantin Belousov copyout(imgp->execpath, (void *)destp, execpath_len); 13653ff06357SKonstantin Belousov } 13663ff06357SKonstantin Belousov 13673ff06357SKonstantin Belousov /* 1368ee235befSKonstantin Belousov * Prepare the canary for SSP. 1369ee235befSKonstantin Belousov */ 1370ee235befSKonstantin Belousov arc4rand(canary, sizeof(canary), 0); 137188b124ceSKonstantin Belousov destp -= sizeof(canary); 137288b124ceSKonstantin Belousov imgp->canary = destp; 137388b124ceSKonstantin Belousov copyout(canary, (void *)destp, sizeof(canary)); 1374ee235befSKonstantin Belousov imgp->canarylen = sizeof(canary); 1375ee235befSKonstantin Belousov 1376ee235befSKonstantin Belousov /* 1377ee235befSKonstantin Belousov * Prepare the pagesizes array. 1378ee235befSKonstantin Belousov */ 137988b124ceSKonstantin Belousov destp -= szps; 138088b124ceSKonstantin Belousov destp = rounddown2(destp, sizeof(void *)); 138188b124ceSKonstantin Belousov imgp->pagesizes = destp; 138288b124ceSKonstantin Belousov copyout(pagesizes, (void *)destp, szps); 1383ee235befSKonstantin Belousov imgp->pagesizeslen = szps; 1384ee235befSKonstantin Belousov 138588b124ceSKonstantin Belousov destp -= ARG_MAX - imgp->args->stringspace; 138688b124ceSKonstantin Belousov destp = rounddown2(destp, sizeof(void *)); 138788b124ceSKonstantin Belousov 1388ee235befSKonstantin Belousov /* 1389e1743d02SSøren Schmidt * If we have a valid auxargs ptr, prepare some room 1390e1743d02SSøren Schmidt * on the stack. 1391e1743d02SSøren Schmidt */ 1392b9a22da4STakanori Watanabe if (imgp->auxargs) { 1393e1743d02SSøren Schmidt /* 1394b9a22da4STakanori Watanabe * 'AT_COUNT*2' is size for the ELF Auxargs data. This is for 1395b9a22da4STakanori Watanabe * lower compatibility. 1396b9a22da4STakanori Watanabe */ 1397ca0387efSJake Burkholder imgp->auxarg_size = (imgp->auxarg_size) ? imgp->auxarg_size : 1398ca0387efSJake Burkholder (AT_COUNT * 2); 1399b9a22da4STakanori Watanabe /* 1400b9a22da4STakanori Watanabe * The '+ 2' is for the null pointers at the end of each of 1401b9a22da4STakanori Watanabe * the arg and env vector sets,and imgp->auxarg_size is room 1402b9a22da4STakanori Watanabe * for argument of Runtime loader. 1403e1743d02SSøren Schmidt */ 1404610ecfe0SMaxim Sobolev vectp = (char **)(destp - (imgp->args->argc + 1405ee235befSKonstantin Belousov imgp->args->envc + 2 + imgp->auxarg_size) 1406ee235befSKonstantin Belousov * sizeof(char *)); 1407610ecfe0SMaxim Sobolev } else { 1408e1743d02SSøren Schmidt /* 1409b9a22da4STakanori Watanabe * The '+ 2' is for the null pointers at the end of each of 1410b9a22da4STakanori Watanabe * the arg and env vector sets 141126f9a767SRodney W. Grimes */ 141288b124ceSKonstantin Belousov vectp = (char **)(destp - (imgp->args->argc + imgp->args->envc 141388b124ceSKonstantin Belousov + 2) * sizeof(char *)); 1414610ecfe0SMaxim Sobolev } 141526f9a767SRodney W. Grimes 141626f9a767SRodney W. Grimes /* 141726f9a767SRodney W. Grimes * vectp also becomes our initial stack base 141826f9a767SRodney W. Grimes */ 1419654f6be1SBruce Evans stack_base = (register_t *)vectp; 142026f9a767SRodney W. Grimes 1421610ecfe0SMaxim Sobolev stringp = imgp->args->begin_argv; 1422610ecfe0SMaxim Sobolev argc = imgp->args->argc; 1423610ecfe0SMaxim Sobolev envc = imgp->args->envc; 142426f9a767SRodney W. Grimes 142593f6448cSDavid Greenman /* 14263aed948bSDavid Greenman * Copy out strings - arguments and environment. 142793f6448cSDavid Greenman */ 142888b124ceSKonstantin Belousov copyout(stringp, (void *)destp, ARG_MAX - imgp->args->stringspace); 142993f6448cSDavid Greenman 143093f6448cSDavid Greenman /* 14313aed948bSDavid Greenman * Fill in "ps_strings" struct for ps, w, etc. 14323aed948bSDavid Greenman */ 1433aae0aa45SBruce Evans suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp); 1434f4e26adeSNathan Whitehorn suword32(&arginfo->ps_nargvstr, argc); 14353aed948bSDavid Greenman 14363aed948bSDavid Greenman /* 14373aed948bSDavid Greenman * Fill in argument portion of vector table. 143893f6448cSDavid Greenman */ 143926f9a767SRodney W. Grimes for (; argc > 0; --argc) { 1440aae0aa45SBruce Evans suword(vectp++, (long)(intptr_t)destp); 14413aed948bSDavid Greenman while (*stringp++ != 0) 14423aed948bSDavid Greenman destp++; 14433aed948bSDavid Greenman destp++; 144426f9a767SRodney W. Grimes } 144526f9a767SRodney W. Grimes 14461a6e52d0SJeroen Ruigrok van der Werven /* a null vector table pointer separates the argp's from the envp's */ 14476ab46d52SBruce Evans suword(vectp++, 0); 144826f9a767SRodney W. Grimes 1449aae0aa45SBruce Evans suword(&arginfo->ps_envstr, (long)(intptr_t)vectp); 1450f4e26adeSNathan Whitehorn suword32(&arginfo->ps_nenvstr, envc); 145193f6448cSDavid Greenman 145293f6448cSDavid Greenman /* 14533aed948bSDavid Greenman * Fill in environment portion of vector table. 145493f6448cSDavid Greenman */ 145526f9a767SRodney W. Grimes for (; envc > 0; --envc) { 1456aae0aa45SBruce Evans suword(vectp++, (long)(intptr_t)destp); 14573aed948bSDavid Greenman while (*stringp++ != 0) 14583aed948bSDavid Greenman destp++; 14593aed948bSDavid Greenman destp++; 146026f9a767SRodney W. Grimes } 146126f9a767SRodney W. Grimes 146226f9a767SRodney W. Grimes /* end of vector table is a null pointer */ 14636ab46d52SBruce Evans suword(vectp, 0); 146426f9a767SRodney W. Grimes 146526f9a767SRodney W. Grimes return (stack_base); 146626f9a767SRodney W. Grimes } 146726f9a767SRodney W. Grimes 146826f9a767SRodney W. Grimes /* 146926f9a767SRodney W. Grimes * Check permissions of file to execute. 1470cf64863aSRobert Watson * Called with imgp->vp locked. 147126f9a767SRodney W. Grimes * Return 0 for success or error code on failure. 147226f9a767SRodney W. Grimes */ 1473c8a79999SPeter Wemm int 1474c52007c2SDavid Greenman exec_check_permissions(imgp) 1475c52007c2SDavid Greenman struct image_params *imgp; 147626f9a767SRodney W. Grimes { 1477c52007c2SDavid Greenman struct vnode *vp = imgp->vp; 1478c52007c2SDavid Greenman struct vattr *attr = imgp->attr; 1479a854ed98SJohn Baldwin struct thread *td; 1480140dedb8SKonstantin Belousov int error, writecount; 148126f9a767SRodney W. Grimes 14826617724cSJeff Roberson td = curthread; 1483339b79b9SRobert Watson 1484ec35c2afSRobert Watson /* Get file attributes */ 14850359a12eSAttilio Rao error = VOP_GETATTR(vp, attr, td->td_ucred); 1486ec35c2afSRobert Watson if (error) 1487ec35c2afSRobert Watson return (error); 1488ec35c2afSRobert Watson 1489339b79b9SRobert Watson #ifdef MAC 149030d239bcSRobert Watson error = mac_vnode_check_exec(td->td_ucred, imgp->vp, imgp); 1491339b79b9SRobert Watson if (error) 1492339b79b9SRobert Watson return (error); 1493339b79b9SRobert Watson #endif 1494339b79b9SRobert Watson 149526f9a767SRodney W. Grimes /* 1496de478dd4SJaakko Heinonen * 1) Check if file execution is disabled for the filesystem that 1497de478dd4SJaakko Heinonen * this file resides on. 1498de478dd4SJaakko Heinonen * 2) Ensure that at least one execute bit is on. Otherwise, a 1499de478dd4SJaakko Heinonen * privileged user will always succeed, and we don't want this 1500de478dd4SJaakko Heinonen * to happen unless the file really is executable. 1501de478dd4SJaakko Heinonen * 3) Ensure that the file is a regular file. 150226f9a767SRodney W. Grimes */ 1503c52007c2SDavid Greenman if ((vp->v_mount->mnt_flag & MNT_NOEXEC) || 1504de478dd4SJaakko Heinonen (attr->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0 || 1505a854ed98SJohn Baldwin (attr->va_type != VREG)) 150626f9a767SRodney W. Grimes return (EACCES); 150726f9a767SRodney W. Grimes 150826f9a767SRodney W. Grimes /* 150926f9a767SRodney W. Grimes * Zero length files can't be exec'd 151026f9a767SRodney W. Grimes */ 151126f9a767SRodney W. Grimes if (attr->va_size == 0) 151226f9a767SRodney W. Grimes return (ENOEXEC); 151326f9a767SRodney W. Grimes 151426f9a767SRodney W. Grimes /* 151526f9a767SRodney W. Grimes * Check for execute permission to file based on current credentials. 151626f9a767SRodney W. Grimes */ 1517a854ed98SJohn Baldwin error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); 151826f9a767SRodney W. Grimes if (error) 151926f9a767SRodney W. Grimes return (error); 152026f9a767SRodney W. Grimes 15216d5a0a8cSDavid Greenman /* 15226d5a0a8cSDavid Greenman * Check number of open-for-writes on the file and deny execution 15236d5a0a8cSDavid Greenman * if there are any. 15246d5a0a8cSDavid Greenman */ 1525140dedb8SKonstantin Belousov error = VOP_GET_WRITECOUNT(vp, &writecount); 1526140dedb8SKonstantin Belousov if (error != 0) 1527140dedb8SKonstantin Belousov return (error); 1528140dedb8SKonstantin Belousov if (writecount != 0) 15296d5a0a8cSDavid Greenman return (ETXTBSY); 15306d5a0a8cSDavid Greenman 15316d5a0a8cSDavid Greenman /* 15326d5a0a8cSDavid Greenman * Call filesystem specific open routine (which does nothing in the 15336d5a0a8cSDavid Greenman * general case). 15346d5a0a8cSDavid Greenman */ 15359e223287SKonstantin Belousov error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL); 15369a75ea23SKonstantin Belousov if (error == 0) 15379a75ea23SKonstantin Belousov imgp->opened = 1; 153826f9a767SRodney W. Grimes return (error); 1539df8bae1dSRodney W. Grimes } 1540aa855a59SPeter Wemm 1541aa855a59SPeter Wemm /* 1542aa855a59SPeter Wemm * Exec handler registration 1543aa855a59SPeter Wemm */ 1544aa855a59SPeter Wemm int 1545aa855a59SPeter Wemm exec_register(execsw_arg) 1546aa855a59SPeter Wemm const struct execsw *execsw_arg; 1547aa855a59SPeter Wemm { 1548aa855a59SPeter Wemm const struct execsw **es, **xs, **newexecsw; 1549aa855a59SPeter Wemm int count = 2; /* New slot and trailing NULL */ 1550aa855a59SPeter Wemm 1551aa855a59SPeter Wemm if (execsw) 1552aa855a59SPeter Wemm for (es = execsw; *es; es++) 1553aa855a59SPeter Wemm count++; 1554a163d034SWarner Losh newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); 1555aa855a59SPeter Wemm if (newexecsw == NULL) 1556a7cddfedSJake Burkholder return (ENOMEM); 1557aa855a59SPeter Wemm xs = newexecsw; 1558aa855a59SPeter Wemm if (execsw) 1559aa855a59SPeter Wemm for (es = execsw; *es; es++) 1560aa855a59SPeter Wemm *xs++ = *es; 1561aa855a59SPeter Wemm *xs++ = execsw_arg; 1562aa855a59SPeter Wemm *xs = NULL; 1563aa855a59SPeter Wemm if (execsw) 1564aa855a59SPeter Wemm free(execsw, M_TEMP); 1565aa855a59SPeter Wemm execsw = newexecsw; 1566a7cddfedSJake Burkholder return (0); 1567aa855a59SPeter Wemm } 1568aa855a59SPeter Wemm 1569aa855a59SPeter Wemm int 1570aa855a59SPeter Wemm exec_unregister(execsw_arg) 1571aa855a59SPeter Wemm const struct execsw *execsw_arg; 1572aa855a59SPeter Wemm { 1573aa855a59SPeter Wemm const struct execsw **es, **xs, **newexecsw; 1574aa855a59SPeter Wemm int count = 1; 1575aa855a59SPeter Wemm 1576aa855a59SPeter Wemm if (execsw == NULL) 1577aa855a59SPeter Wemm panic("unregister with no handlers left?\n"); 1578aa855a59SPeter Wemm 1579aa855a59SPeter Wemm for (es = execsw; *es; es++) { 1580aa855a59SPeter Wemm if (*es == execsw_arg) 1581aa855a59SPeter Wemm break; 1582aa855a59SPeter Wemm } 1583aa855a59SPeter Wemm if (*es == NULL) 1584a7cddfedSJake Burkholder return (ENOENT); 1585aa855a59SPeter Wemm for (es = execsw; *es; es++) 1586aa855a59SPeter Wemm if (*es != execsw_arg) 1587aa855a59SPeter Wemm count++; 1588a163d034SWarner Losh newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); 1589aa855a59SPeter Wemm if (newexecsw == NULL) 1590a7cddfedSJake Burkholder return (ENOMEM); 1591aa855a59SPeter Wemm xs = newexecsw; 1592aa855a59SPeter Wemm for (es = execsw; *es; es++) 1593aa855a59SPeter Wemm if (*es != execsw_arg) 1594aa855a59SPeter Wemm *xs++ = *es; 1595aa855a59SPeter Wemm *xs = NULL; 1596aa855a59SPeter Wemm if (execsw) 1597aa855a59SPeter Wemm free(execsw, M_TEMP); 1598aa855a59SPeter Wemm execsw = newexecsw; 1599a7cddfedSJake Burkholder return (0); 1600aa855a59SPeter Wemm } 1601