xref: /freebsd/sys/kern/kern_exec.c (revision cda688443a603fd87a9f637a3517a8621f8d60c9)
19454b2d8SWarner Losh /*-
226f9a767SRodney W. Grimes  * Copyright (c) 1993, David Greenman
326f9a767SRodney W. Grimes  * All rights reserved.
4df8bae1dSRodney W. Grimes  *
5df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
6df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
7df8bae1dSRodney W. Grimes  * are met:
8df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
9df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
10df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
12df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
13df8bae1dSRodney W. Grimes  *
1426f9a767SRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1726f9a767SRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
25df8bae1dSRodney W. Grimes  */
26df8bae1dSRodney W. Grimes 
27677b542eSDavid E. O'Brien #include <sys/cdefs.h>
28677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
29677b542eSDavid E. O'Brien 
3012bc222eSJonathan Anderson #include "opt_capsicum.h"
314da0d332SPeter Wemm #include "opt_hwpmc_hooks.h"
321e9b3d91SPeter Wemm #include "opt_ktrace.h"
33f8a47341SAlan Cox #include "opt_vm.h"
341e9b3d91SPeter Wemm 
35df8bae1dSRodney W. Grimes #include <sys/param.h>
364a144410SRobert Watson #include <sys/capsicum.h>
3726f9a767SRodney W. Grimes #include <sys/systm.h>
3875b8b3b2SJohn Baldwin #include <sys/eventhandler.h>
39fb919e4dSMark Murray #include <sys/lock.h>
40fb919e4dSMark Murray #include <sys/mutex.h>
41d2d3e875SBruce Evans #include <sys/sysproto.h>
4226f9a767SRodney W. Grimes #include <sys/signalvar.h>
4326f9a767SRodney W. Grimes #include <sys/kernel.h>
4426f9a767SRodney W. Grimes #include <sys/mount.h>
45797f2d22SPoul-Henning Kamp #include <sys/filedesc.h>
46079cc25bSDavid Greenman #include <sys/fcntl.h>
4726f9a767SRodney W. Grimes #include <sys/acct.h>
4826f9a767SRodney W. Grimes #include <sys/exec.h>
4926f9a767SRodney W. Grimes #include <sys/imgact.h>
50e1743d02SSøren Schmidt #include <sys/imgact_elf.h>
5126f9a767SRodney W. Grimes #include <sys/wait.h>
52333ea485SGuido van Rooij #include <sys/malloc.h>
53acd3428bSRobert Watson #include <sys/priv.h>
54a794e791SBruce Evans #include <sys/proc.h>
552a024a2bSSean Eric Fagan #include <sys/pioctl.h>
56a794e791SBruce Evans #include <sys/namei.h>
576004362eSDavid Schultz #include <sys/resourcevar.h>
5889f6b863SAttilio Rao #include <sys/rwlock.h>
5944ad5475SJohn Baldwin #include <sys/sched.h>
605d217f17SJohn Birrell #include <sys/sdt.h>
6159c8bc40SAlan Cox #include <sys/sf_buf.h>
6284e0b075SDavid Xu #include <sys/syscallsubr.h>
631e1e0b44SSøren Schmidt #include <sys/sysent.h>
64797f2d22SPoul-Henning Kamp #include <sys/shm.h>
6599ac3bc8SPeter Wemm #include <sys/sysctl.h>
66a794e791SBruce Evans #include <sys/vnode.h>
67dfa7fd1dSEdward Tomasz Napierala #include <sys/stat.h>
68c781aea8SPeter Wemm #ifdef KTRACE
69c781aea8SPeter Wemm #include <sys/ktrace.h>
70c781aea8SPeter Wemm #endif
7126f9a767SRodney W. Grimes 
7226f9a767SRodney W. Grimes #include <vm/vm.h>
73efeaf95aSDavid Greenman #include <vm/vm_param.h>
74efeaf95aSDavid Greenman #include <vm/pmap.h>
751616db3cSJohn Dyson #include <vm/vm_page.h>
76efeaf95aSDavid Greenman #include <vm/vm_map.h>
7726f9a767SRodney W. Grimes #include <vm/vm_kern.h>
78efeaf95aSDavid Greenman #include <vm/vm_extern.h>
791ebd0c59SDavid Greenman #include <vm/vm_object.h>
801616db3cSJohn Dyson #include <vm/vm_pager.h>
8126f9a767SRodney W. Grimes 
82ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
83ebccf1e3SJoseph Koshy #include <sys/pmckern.h>
84ebccf1e3SJoseph Koshy #endif
85ebccf1e3SJoseph Koshy 
8626f9a767SRodney W. Grimes #include <machine/reg.h>
8726f9a767SRodney W. Grimes 
88ae1078d6SWayne Salamon #include <security/audit/audit.h>
89aed55708SRobert Watson #include <security/mac/mac_framework.h>
90ae1078d6SWayne Salamon 
915d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
925d217f17SJohn Birrell #include <sys/dtrace_bsd.h>
935d217f17SJohn Birrell dtrace_execexit_func_t	dtrace_fasttrap_exec;
945d217f17SJohn Birrell #endif
955d217f17SJohn Birrell 
965d217f17SJohn Birrell SDT_PROVIDER_DECLARE(proc);
9736160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec, "char *");
9836160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec__failure, "int");
9936160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec__success, "char *");
1005d217f17SJohn Birrell 
101b9df5231SPoul-Henning Kamp MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
102b9df5231SPoul-Henning Kamp 
103bcb60d52SConrad Meyer int coredump_pack_fileinfo = 1;
104bcb60d52SConrad Meyer SYSCTL_INT(_kern, OID_AUTO, coredump_pack_fileinfo, CTLFLAG_RWTUN,
105bcb60d52SConrad Meyer     &coredump_pack_fileinfo, 0,
106bcb60d52SConrad Meyer     "Enable file path packing in 'procstat -f' coredump notes");
107bcb60d52SConrad Meyer 
108e6b95927SConrad Meyer int coredump_pack_vmmapinfo = 1;
109e6b95927SConrad Meyer SYSCTL_INT(_kern, OID_AUTO, coredump_pack_vmmapinfo, CTLFLAG_RWTUN,
110e6b95927SConrad Meyer     &coredump_pack_vmmapinfo, 0,
111e6b95927SConrad Meyer     "Enable file path packing in 'procstat -v' coredump notes");
112e6b95927SConrad Meyer 
11305ba50f5SJake Burkholder static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS);
11405ba50f5SJake Burkholder static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS);
1155dadd17bSJake Burkholder static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS);
116610ecfe0SMaxim Sobolev static int do_execve(struct thread *td, struct image_args *args,
117610ecfe0SMaxim Sobolev     struct mac *mac_p);
11805ba50f5SJake Burkholder 
1199701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
12005ba50f5SJake Burkholder SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD,
12105ba50f5SJake Burkholder     NULL, 0, sysctl_kern_ps_strings, "LU", "");
122486bddb0SDoug Rabson 
1239701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
124ff66f6a4SRobert Watson SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD|
125ff66f6a4SRobert Watson     CTLFLAG_CAPRD, NULL, 0, sysctl_kern_usrstack, "LU", "");
12699ac3bc8SPeter Wemm 
1275dadd17bSJake Burkholder SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD,
1285dadd17bSJake Burkholder     NULL, 0, sysctl_kern_stackprot, "I", "");
1295dadd17bSJake Burkholder 
130b9df5231SPoul-Henning Kamp u_long ps_arg_cache_limit = PAGE_SIZE / 16;
131c3699b5fSPeter Wemm SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
1329701cd40SJohn Baldwin     &ps_arg_cache_limit, 0, "");
133b9df5231SPoul-Henning Kamp 
134eda6009cSKonstantin Belousov static int disallow_high_osrel;
135eda6009cSKonstantin Belousov SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW,
136eda6009cSKonstantin Belousov     &disallow_high_osrel, 0,
137eda6009cSKonstantin Belousov     "Disallow execution of binaries built for higher version of the world");
138eda6009cSKonstantin Belousov 
139878adb85SBjoern A. Zeeb static int map_at_zero = 0;
140af3b2549SHans Petter Selasky SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RWTUN, &map_at_zero, 0,
141878adb85SBjoern A. Zeeb     "Permit processes to map an object at virtual address 0.");
142878adb85SBjoern A. Zeeb 
14305ba50f5SJake Burkholder static int
14405ba50f5SJake Burkholder sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
14505ba50f5SJake Burkholder {
14605ba50f5SJake Burkholder 	struct proc *p;
147df7c361eSPeter Wemm 	int error;
14805ba50f5SJake Burkholder 
14905ba50f5SJake Burkholder 	p = curproc;
150a7bc3102SPeter Wemm #ifdef SCTL_MASK32
151a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
152df7c361eSPeter Wemm 		unsigned int val;
153df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_psstrings;
154df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
155df7c361eSPeter Wemm 	} else
156df7c361eSPeter Wemm #endif
157df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings,
158df7c361eSPeter Wemm 		   sizeof(p->p_sysent->sv_psstrings));
159df7c361eSPeter Wemm 	return error;
16005ba50f5SJake Burkholder }
16105ba50f5SJake Burkholder 
16205ba50f5SJake Burkholder static int
16305ba50f5SJake Burkholder sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS)
16405ba50f5SJake Burkholder {
16505ba50f5SJake Burkholder 	struct proc *p;
166df7c361eSPeter Wemm 	int error;
16705ba50f5SJake Burkholder 
16805ba50f5SJake Burkholder 	p = curproc;
169a7bc3102SPeter Wemm #ifdef SCTL_MASK32
170a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
171df7c361eSPeter Wemm 		unsigned int val;
172df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_usrstack;
173df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
174df7c361eSPeter Wemm 	} else
175df7c361eSPeter Wemm #endif
176df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack,
177df7c361eSPeter Wemm 		    sizeof(p->p_sysent->sv_usrstack));
178df7c361eSPeter Wemm 	return error;
17905ba50f5SJake Burkholder }
18005ba50f5SJake Burkholder 
1815dadd17bSJake Burkholder static int
1825dadd17bSJake Burkholder sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS)
1835dadd17bSJake Burkholder {
1845dadd17bSJake Burkholder 	struct proc *p;
1855dadd17bSJake Burkholder 
1865dadd17bSJake Burkholder 	p = curproc;
1875dadd17bSJake Burkholder 	return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot,
1885dadd17bSJake Burkholder 	    sizeof(p->p_sysent->sv_stackprot)));
1895dadd17bSJake Burkholder }
1905dadd17bSJake Burkholder 
19199ac3bc8SPeter Wemm /*
192aa855a59SPeter Wemm  * Each of the items is a pointer to a `const struct execsw', hence the
193aa855a59SPeter Wemm  * double pointer here.
194df8bae1dSRodney W. Grimes  */
195aa855a59SPeter Wemm static const struct execsw **execsw;
19626f9a767SRodney W. Grimes 
197ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
198ca46e90eSBruce Evans struct execve_args {
199ca46e90eSBruce Evans 	char    *fname;
200ca46e90eSBruce Evans 	char    **argv;
201ca46e90eSBruce Evans 	char    **envv;
202ca46e90eSBruce Evans };
203ca46e90eSBruce Evans #endif
204ca46e90eSBruce Evans 
205ca46e90eSBruce Evans int
2067b445033SKonstantin Belousov sys_execve(struct thread *td, struct execve_args *uap)
207ca46e90eSBruce Evans {
208610ecfe0SMaxim Sobolev 	struct image_args args;
2097b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2107b445033SKonstantin Belousov 	int error;
211ca46e90eSBruce Evans 
2127b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2137b445033SKonstantin Belousov 	if (error != 0)
2147b445033SKonstantin Belousov 		return (error);
215610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
216610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
217610ecfe0SMaxim Sobolev 	if (error == 0)
218610ecfe0SMaxim Sobolev 		error = kern_execve(td, &args, NULL);
2197b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
220610ecfe0SMaxim Sobolev 	return (error);
221ca46e90eSBruce Evans }
222ca46e90eSBruce Evans 
223ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
224632dbc19SKonstantin Belousov struct fexecve_args {
225632dbc19SKonstantin Belousov 	int	fd;
226632dbc19SKonstantin Belousov 	char	**argv;
227632dbc19SKonstantin Belousov 	char	**envv;
228632dbc19SKonstantin Belousov }
229632dbc19SKonstantin Belousov #endif
230632dbc19SKonstantin Belousov int
2318451d0ddSKip Macy sys_fexecve(struct thread *td, struct fexecve_args *uap)
232632dbc19SKonstantin Belousov {
233632dbc19SKonstantin Belousov 	struct image_args args;
2347b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2357b445033SKonstantin Belousov 	int error;
236632dbc19SKonstantin Belousov 
2377b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2387b445033SKonstantin Belousov 	if (error != 0)
2397b445033SKonstantin Belousov 		return (error);
240632dbc19SKonstantin Belousov 	error = exec_copyin_args(&args, NULL, UIO_SYSSPACE,
241632dbc19SKonstantin Belousov 	    uap->argv, uap->envv);
242632dbc19SKonstantin Belousov 	if (error == 0) {
243632dbc19SKonstantin Belousov 		args.fd = uap->fd;
244632dbc19SKonstantin Belousov 		error = kern_execve(td, &args, NULL);
245632dbc19SKonstantin Belousov 	}
2467b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
247632dbc19SKonstantin Belousov 	return (error);
248632dbc19SKonstantin Belousov }
249632dbc19SKonstantin Belousov 
250632dbc19SKonstantin Belousov #ifndef _SYS_SYSPROTO_H_
251ca46e90eSBruce Evans struct __mac_execve_args {
252ca46e90eSBruce Evans 	char	*fname;
253ca46e90eSBruce Evans 	char	**argv;
254ca46e90eSBruce Evans 	char	**envv;
255ca46e90eSBruce Evans 	struct mac	*mac_p;
256ca46e90eSBruce Evans };
257ca46e90eSBruce Evans #endif
258ca46e90eSBruce Evans 
259ca46e90eSBruce Evans int
2607b445033SKonstantin Belousov sys___mac_execve(struct thread *td, struct __mac_execve_args *uap)
261ca46e90eSBruce Evans {
262ca46e90eSBruce Evans #ifdef MAC
263610ecfe0SMaxim Sobolev 	struct image_args args;
2647b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2657b445033SKonstantin Belousov 	int error;
266610ecfe0SMaxim Sobolev 
2677b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2687b445033SKonstantin Belousov 	if (error != 0)
2697b445033SKonstantin Belousov 		return (error);
270610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
271610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
272610ecfe0SMaxim Sobolev 	if (error == 0)
273610ecfe0SMaxim Sobolev 		error = kern_execve(td, &args, uap->mac_p);
2747b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
275610ecfe0SMaxim Sobolev 	return (error);
276ca46e90eSBruce Evans #else
277ca46e90eSBruce Evans 	return (ENOSYS);
278ca46e90eSBruce Evans #endif
279ca46e90eSBruce Evans }
280ca46e90eSBruce Evans 
28184e0b075SDavid Xu int
2827b445033SKonstantin Belousov pre_execve(struct thread *td, struct vmspace **oldvmspace)
283906ac69dSDavid Xu {
2847b445033SKonstantin Belousov 	struct proc *p;
285906ac69dSDavid Xu 	int error;
286906ac69dSDavid Xu 
2877b445033SKonstantin Belousov 	KASSERT(td == curthread, ("non-current thread %p", td));
2887b445033SKonstantin Belousov 	error = 0;
2897b445033SKonstantin Belousov 	p = td->td_proc;
2907b445033SKonstantin Belousov 	if ((p->p_flag & P_HADTHREADS) != 0) {
291906ac69dSDavid Xu 		PROC_LOCK(p);
2927b445033SKonstantin Belousov 		if (thread_single(p, SINGLE_BOUNDARY) != 0)
2937b445033SKonstantin Belousov 			error = ERESTART;
294906ac69dSDavid Xu 		PROC_UNLOCK(p);
295906ac69dSDavid Xu 	}
2967b445033SKonstantin Belousov 	KASSERT(error != 0 || (td->td_pflags & TDP_EXECVMSPC) == 0,
2977b445033SKonstantin Belousov 	    ("nested execve"));
2987b445033SKonstantin Belousov 	*oldvmspace = p->p_vmspace;
2997b445033SKonstantin Belousov 	return (error);
3007b445033SKonstantin Belousov }
301906ac69dSDavid Xu 
3027b445033SKonstantin Belousov void
3037b445033SKonstantin Belousov post_execve(struct thread *td, int error, struct vmspace *oldvmspace)
3047b445033SKonstantin Belousov {
3057b445033SKonstantin Belousov 	struct proc *p;
306906ac69dSDavid Xu 
3077b445033SKonstantin Belousov 	KASSERT(td == curthread, ("non-current thread %p", td));
3087b445033SKonstantin Belousov 	p = td->td_proc;
3097b445033SKonstantin Belousov 	if ((p->p_flag & P_HADTHREADS) != 0) {
310906ac69dSDavid Xu 		PROC_LOCK(p);
311906ac69dSDavid Xu 		/*
312906ac69dSDavid Xu 		 * If success, we upgrade to SINGLE_EXIT state to
313906ac69dSDavid Xu 		 * force other threads to suicide.
314906ac69dSDavid Xu 		 */
315906ac69dSDavid Xu 		if (error == 0)
3166ddcc233SKonstantin Belousov 			thread_single(p, SINGLE_EXIT);
317906ac69dSDavid Xu 		else
3186ddcc233SKonstantin Belousov 			thread_single_end(p, SINGLE_BOUNDARY);
319906ac69dSDavid Xu 		PROC_UNLOCK(p);
320906ac69dSDavid Xu 	}
3217032434eSKonstantin Belousov 	if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
3227b445033SKonstantin Belousov 		KASSERT(p->p_vmspace != oldvmspace,
3237032434eSKonstantin Belousov 		    ("oldvmspace still used"));
3247032434eSKonstantin Belousov 		vmspace_free(oldvmspace);
3257032434eSKonstantin Belousov 		td->td_pflags &= ~TDP_EXECVMSPC;
3267032434eSKonstantin Belousov 	}
3277b445033SKonstantin Belousov }
328906ac69dSDavid Xu 
3297b445033SKonstantin Belousov /*
3307b445033SKonstantin Belousov  * XXX: kern_execve has the astonishing property of not always returning to
3317b445033SKonstantin Belousov  * the caller.  If sufficiently bad things happen during the call to
3327b445033SKonstantin Belousov  * do_execve(), it can end up calling exit1(); as a result, callers must
3337b445033SKonstantin Belousov  * avoid doing anything which they might need to undo (e.g., allocating
3347b445033SKonstantin Belousov  * memory).
3357b445033SKonstantin Belousov  */
3367b445033SKonstantin Belousov int
3377b445033SKonstantin Belousov kern_execve(struct thread *td, struct image_args *args, struct mac *mac_p)
3387b445033SKonstantin Belousov {
3397b445033SKonstantin Belousov 
3407b445033SKonstantin Belousov 	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
3417b445033SKonstantin Belousov 	    args->begin_envv - args->begin_argv);
3427b445033SKonstantin Belousov 	AUDIT_ARG_ENVV(args->begin_envv, args->envc,
3437b445033SKonstantin Belousov 	    args->endp - args->begin_envv);
3447b445033SKonstantin Belousov 	return (do_execve(td, args, mac_p));
345906ac69dSDavid Xu }
346906ac69dSDavid Xu 
34726f9a767SRodney W. Grimes /*
348450ffb44SRobert Watson  * In-kernel implementation of execve().  All arguments are assumed to be
349450ffb44SRobert Watson  * userspace pointers from the passed thread.
35026f9a767SRodney W. Grimes  */
351450ffb44SRobert Watson static int
352610ecfe0SMaxim Sobolev do_execve(td, args, mac_p)
353b40ce416SJulian Elischer 	struct thread *td;
354610ecfe0SMaxim Sobolev 	struct image_args *args;
355670cb89bSRobert Watson 	struct mac *mac_p;
356df8bae1dSRodney W. Grimes {
357b40ce416SJulian Elischer 	struct proc *p = td->td_proc;
35869c9eff8SEd Schouten 	struct nameidata nd;
359881010f0SBryan Drewery 	struct ucred *oldcred;
360350d5181SMateusz Guzik 	struct uidinfo *euip = NULL;
361654f6be1SBruce Evans 	register_t *stack_base;
3625ca4819dSJohn Baldwin 	int error, i;
363c52007c2SDavid Greenman 	struct image_params image_params, *imgp;
3649f5c1d19SDiomidis Spinellis 	struct vattr attr;
3654d77a549SAlfred Perlstein 	int (*img_first)(struct image_params *);
36669be5db9SAlfred Perlstein 	struct pargs *oldargs = NULL, *newargs = NULL;
367*cda68844SMateusz Guzik 	struct sigacts *oldsigacts = NULL, *newsigacts = NULL;
3686c84de02SJohn Baldwin #ifdef KTRACE
3696c84de02SJohn Baldwin 	struct vnode *tracevp = NULL;
370a5881ea5SJohn Baldwin 	struct ucred *tracecred = NULL;
3716c84de02SJohn Baldwin #endif
37261617058SMateusz Guzik 	struct vnode *oldtextvp = NULL, *newtextvp;
3737008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
374d06c0d4dSRobert Watson 	int credential_changing;
375619eb6e5SJeff Roberson 	int textset;
376ccafe7ebSRobert Watson #ifdef MAC
3776356dba0SRobert Watson 	struct label *interpvplabel = NULL;
378eca8a663SRobert Watson 	int will_transition;
379ccafe7ebSRobert Watson #endif
38015139246SJoseph Koshy #ifdef HWPMC_HOOKS
38115139246SJoseph Koshy 	struct pmckern_procexec pe;
38215139246SJoseph Koshy #endif
383632dbc19SKonstantin Belousov 	static const char fexecv_proc_title[] = "(fexecv)";
38426f9a767SRodney W. Grimes 
385c52007c2SDavid Greenman 	imgp = &image_params;
386df8bae1dSRodney W. Grimes 
3879ca45e81SDag-Erling Smørgrav 	/*
3889ca45e81SDag-Erling Smørgrav 	 * Lock the process and set the P_INEXEC flag to indicate that
3899ca45e81SDag-Erling Smørgrav 	 * it should be left alone until we're done here.  This is
3909ca45e81SDag-Erling Smørgrav 	 * necessary to avoid race conditions - e.g. in ptrace() -
3919ca45e81SDag-Erling Smørgrav 	 * that might allow a local user to illicitly obtain elevated
3929ca45e81SDag-Erling Smørgrav 	 * privileges.
3939ca45e81SDag-Erling Smørgrav 	 */
3949ca45e81SDag-Erling Smørgrav 	PROC_LOCK(p);
3959ca45e81SDag-Erling Smørgrav 	KASSERT((p->p_flag & P_INEXEC) == 0,
39691f91617SDavid E. O'Brien 	    ("%s(): process already has P_INEXEC flag", __func__));
3979ca45e81SDag-Erling Smørgrav 	p->p_flag |= P_INEXEC;
3989ca45e81SDag-Erling Smørgrav 	PROC_UNLOCK(p);
3999ca45e81SDag-Erling Smørgrav 
400df8bae1dSRodney W. Grimes 	/*
401c52007c2SDavid Greenman 	 * Initialize part of the common data
402df8bae1dSRodney W. Grimes 	 */
4038e572983SMateusz Guzik 	bzero(imgp, sizeof(*imgp));
404c52007c2SDavid Greenman 	imgp->proc = p;
405c52007c2SDavid Greenman 	imgp->attr = &attr;
406610ecfe0SMaxim Sobolev 	imgp->args = args;
407881010f0SBryan Drewery 	oldcred = p->p_ucred;
40826f9a767SRodney W. Grimes 
409670cb89bSRobert Watson #ifdef MAC
410eca8a663SRobert Watson 	error = mac_execve_enter(imgp, mac_p);
411532c491bSJeff Roberson 	if (error)
412670cb89bSRobert Watson 		goto exec_fail;
413670cb89bSRobert Watson #endif
414670cb89bSRobert Watson 
41526f9a767SRodney W. Grimes 	/*
41626f9a767SRodney W. Grimes 	 * Translate the file name. namei() returns a vnode pointer
417e3043798SPedro F. Giffuni 	 *	in ni_vp among other things.
418ae1078d6SWayne Salamon 	 *
419ae1078d6SWayne Salamon 	 * XXXAUDIT: It would be desirable to also audit the name of the
420ae1078d6SWayne Salamon 	 * interpreter if this is an interpreted binary.
42126f9a767SRodney W. Grimes 	 */
422632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
42369c9eff8SEd Schouten 		NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME
4245050aa86SKonstantin Belousov 		    | AUDITVNODE1, UIO_SYSSPACE, args->fname, td);
425632dbc19SKonstantin Belousov 	}
42626f9a767SRodney W. Grimes 
42736160958SMark Johnston 	SDT_PROBE1(proc, , , exec, args->fname);
428e506f34bSCraig Rodrigues 
42926f9a767SRodney W. Grimes interpret:
430632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
43112bc222eSJonathan Anderson #ifdef CAPABILITY_MODE
43212bc222eSJonathan Anderson 		/*
43312bc222eSJonathan Anderson 		 * While capability mode can't reach this point via direct
43412bc222eSJonathan Anderson 		 * path arguments to execve(), we also don't allow
43512bc222eSJonathan Anderson 		 * interpreters to be used in capability mode (for now).
43612bc222eSJonathan Anderson 		 * Catch indirect lookups and return a permissions error.
43712bc222eSJonathan Anderson 		 */
43812bc222eSJonathan Anderson 		if (IN_CAPABILITY_MODE(td)) {
43912bc222eSJonathan Anderson 			error = ECAPMODE;
44012bc222eSJonathan Anderson 			goto exec_fail;
44112bc222eSJonathan Anderson 		}
44212bc222eSJonathan Anderson #endif
44369c9eff8SEd Schouten 		error = namei(&nd);
444610ecfe0SMaxim Sobolev 		if (error)
44526f9a767SRodney W. Grimes 			goto exec_fail;
44626f9a767SRodney W. Grimes 
44761617058SMateusz Guzik 		newtextvp = nd.ni_vp;
44861617058SMateusz Guzik 		imgp->vp = newtextvp;
449632dbc19SKonstantin Belousov 	} else {
45014961ba7SRobert Watson 		AUDIT_ARG_FD(args->fd);
451a9d2f8d8SRobert Watson 		/*
452c8e781f6SPawel Jakub Dawidek 		 * Descriptors opened only with O_EXEC or O_RDONLY are allowed.
453a9d2f8d8SRobert Watson 		 */
4547008be5bSPawel Jakub Dawidek 		error = fgetvp_exec(td, args->fd,
45561617058SMateusz Guzik 		    cap_rights_init(&rights, CAP_FEXECVE), &newtextvp);
456632dbc19SKonstantin Belousov 		if (error)
457632dbc19SKonstantin Belousov 			goto exec_fail;
45861617058SMateusz Guzik 		vn_lock(newtextvp, LK_EXCLUSIVE | LK_RETRY);
45961617058SMateusz Guzik 		AUDIT_ARG_VNODE1(newtextvp);
46061617058SMateusz Guzik 		imgp->vp = newtextvp;
461632dbc19SKonstantin Belousov 	}
46226f9a767SRodney W. Grimes 
46326f9a767SRodney W. Grimes 	/*
4649022e4adSDavid Greenman 	 * Check file permissions (also 'opens' file)
4659022e4adSDavid Greenman 	 */
466c52007c2SDavid Greenman 	error = exec_check_permissions(imgp);
467619eb6e5SJeff Roberson 	if (error)
46826f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
469619eb6e5SJeff Roberson 
4708516dd18SPoul-Henning Kamp 	imgp->object = imgp->vp->v_object;
4718516dd18SPoul-Henning Kamp 	if (imgp->object != NULL)
4720b2ed1aeSJeff Roberson 		vm_object_reference(imgp->object);
47326f9a767SRodney W. Grimes 
474619eb6e5SJeff Roberson 	/*
475619eb6e5SJeff Roberson 	 * Set VV_TEXT now so no one can write to the executable while we're
476619eb6e5SJeff Roberson 	 * activating it.
477619eb6e5SJeff Roberson 	 *
478619eb6e5SJeff Roberson 	 * Remember if this was set before and unset it in case this is not
479619eb6e5SJeff Roberson 	 * actually an executable image.
480619eb6e5SJeff Roberson 	 */
481877d24acSKonstantin Belousov 	textset = VOP_IS_TEXT(imgp->vp);
482877d24acSKonstantin Belousov 	VOP_SET_TEXT(imgp->vp);
483619eb6e5SJeff Roberson 
4841616db3cSJohn Dyson 	error = exec_map_first_page(imgp);
4856d5a0a8cSDavid Greenman 	if (error)
48626f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
48726f9a767SRodney W. Grimes 
488f231de47SKonstantin Belousov 	imgp->proc->p_osrel = 0;
489881010f0SBryan Drewery 
490881010f0SBryan Drewery 	/*
491881010f0SBryan Drewery 	 * Implement image setuid/setgid.
492881010f0SBryan Drewery 	 *
493881010f0SBryan Drewery 	 * Determine new credentials before attempting image activators
494881010f0SBryan Drewery 	 * so that it can be used by process_exec handlers to determine
495881010f0SBryan Drewery 	 * credential/setid changes.
496881010f0SBryan Drewery 	 *
497881010f0SBryan Drewery 	 * Don't honor setuid/setgid if the filesystem prohibits it or if
498881010f0SBryan Drewery 	 * the process is being traced.
499881010f0SBryan Drewery 	 *
500881010f0SBryan Drewery 	 * We disable setuid/setgid/etc in capability mode on the basis
501881010f0SBryan Drewery 	 * that most setugid applications are not written with that
502881010f0SBryan Drewery 	 * environment in mind, and will therefore almost certainly operate
503881010f0SBryan Drewery 	 * incorrectly. In principle there's no reason that setugid
504881010f0SBryan Drewery 	 * applications might not be useful in capability mode, so we may want
505881010f0SBryan Drewery 	 * to reconsider this conservative design choice in the future.
506881010f0SBryan Drewery 	 *
507881010f0SBryan Drewery 	 * XXXMAC: For the time being, use NOSUID to also prohibit
508881010f0SBryan Drewery 	 * transitions on the file system.
509881010f0SBryan Drewery 	 */
510881010f0SBryan Drewery 	credential_changing = 0;
511881010f0SBryan Drewery 	credential_changing |= (attr.va_mode & S_ISUID) &&
512881010f0SBryan Drewery 	    oldcred->cr_uid != attr.va_uid;
513881010f0SBryan Drewery 	credential_changing |= (attr.va_mode & S_ISGID) &&
514881010f0SBryan Drewery 	    oldcred->cr_gid != attr.va_gid;
515881010f0SBryan Drewery #ifdef MAC
516881010f0SBryan Drewery 	will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp,
517881010f0SBryan Drewery 	    interpvplabel, imgp);
518881010f0SBryan Drewery 	credential_changing |= will_transition;
519881010f0SBryan Drewery #endif
520881010f0SBryan Drewery 
521881010f0SBryan Drewery 	if (credential_changing &&
522881010f0SBryan Drewery #ifdef CAPABILITY_MODE
523881010f0SBryan Drewery 	    ((oldcred->cr_flags & CRED_FLAG_CAPMODE) == 0) &&
524881010f0SBryan Drewery #endif
525881010f0SBryan Drewery 	    (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
526881010f0SBryan Drewery 	    (p->p_flag & P_TRACED) == 0) {
527881010f0SBryan Drewery 		imgp->credential_setid = true;
528881010f0SBryan Drewery 		VOP_UNLOCK(imgp->vp, 0);
529881010f0SBryan Drewery 		imgp->newcred = crdup(oldcred);
530881010f0SBryan Drewery 		if (attr.va_mode & S_ISUID) {
531881010f0SBryan Drewery 			euip = uifind(attr.va_uid);
532881010f0SBryan Drewery 			change_euid(imgp->newcred, euip);
533881010f0SBryan Drewery 		}
534881010f0SBryan Drewery 		vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
535881010f0SBryan Drewery 		if (attr.va_mode & S_ISGID)
536881010f0SBryan Drewery 			change_egid(imgp->newcred, attr.va_gid);
537881010f0SBryan Drewery 		/*
538881010f0SBryan Drewery 		 * Implement correct POSIX saved-id behavior.
539881010f0SBryan Drewery 		 *
540881010f0SBryan Drewery 		 * XXXMAC: Note that the current logic will save the
541881010f0SBryan Drewery 		 * uid and gid if a MAC domain transition occurs, even
542881010f0SBryan Drewery 		 * though maybe it shouldn't.
543881010f0SBryan Drewery 		 */
544881010f0SBryan Drewery 		change_svuid(imgp->newcred, imgp->newcred->cr_uid);
545881010f0SBryan Drewery 		change_svgid(imgp->newcred, imgp->newcred->cr_gid);
546881010f0SBryan Drewery 	} else {
547881010f0SBryan Drewery 		/*
548881010f0SBryan Drewery 		 * Implement correct POSIX saved-id behavior.
549881010f0SBryan Drewery 		 *
550881010f0SBryan Drewery 		 * XXX: It's not clear that the existing behavior is
551881010f0SBryan Drewery 		 * POSIX-compliant.  A number of sources indicate that the
552881010f0SBryan Drewery 		 * saved uid/gid should only be updated if the new ruid is
553881010f0SBryan Drewery 		 * not equal to the old ruid, or the new euid is not equal
554881010f0SBryan Drewery 		 * to the old euid and the new euid is not equal to the old
555881010f0SBryan Drewery 		 * ruid.  The FreeBSD code always updates the saved uid/gid.
556881010f0SBryan Drewery 		 * Also, this code uses the new (replaced) euid and egid as
557881010f0SBryan Drewery 		 * the source, which may or may not be the right ones to use.
558881010f0SBryan Drewery 		 */
559881010f0SBryan Drewery 		if (oldcred->cr_svuid != oldcred->cr_uid ||
560881010f0SBryan Drewery 		    oldcred->cr_svgid != oldcred->cr_gid) {
561881010f0SBryan Drewery 			VOP_UNLOCK(imgp->vp, 0);
562881010f0SBryan Drewery 			imgp->newcred = crdup(oldcred);
563881010f0SBryan Drewery 			vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
564881010f0SBryan Drewery 			change_svuid(imgp->newcred, imgp->newcred->cr_uid);
565881010f0SBryan Drewery 			change_svgid(imgp->newcred, imgp->newcred->cr_gid);
566881010f0SBryan Drewery 		}
567881010f0SBryan Drewery 	}
568881010f0SBryan Drewery 	/* The new credentials are installed into the process later. */
569881010f0SBryan Drewery 
57026f9a767SRodney W. Grimes 	/*
5711afd78b3SBryan Drewery 	 * Do the best to calculate the full path to the image file.
5721afd78b3SBryan Drewery 	 */
5731afd78b3SBryan Drewery 	if (args->fname != NULL && args->fname[0] == '/')
5741afd78b3SBryan Drewery 		imgp->execpath = args->fname;
5751afd78b3SBryan Drewery 	else {
5761afd78b3SBryan Drewery 		VOP_UNLOCK(imgp->vp, 0);
5771afd78b3SBryan Drewery 		if (vn_fullpath(td, imgp->vp, &imgp->execpath,
5781afd78b3SBryan Drewery 		    &imgp->freepath) != 0)
5791afd78b3SBryan Drewery 			imgp->execpath = args->fname;
5801afd78b3SBryan Drewery 		vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
5811afd78b3SBryan Drewery 	}
5821afd78b3SBryan Drewery 
5831afd78b3SBryan Drewery 	/*
584d323ddf3SMatthew Dillon 	 *	If the current process has a special image activator it
585d323ddf3SMatthew Dillon 	 *	wants to try first, call it.   For example, emulating shell
586d323ddf3SMatthew Dillon 	 *	scripts differently.
58726f9a767SRodney W. Grimes 	 */
588d323ddf3SMatthew Dillon 	error = -1;
589d323ddf3SMatthew Dillon 	if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
590d323ddf3SMatthew Dillon 		error = img_first(imgp);
591d323ddf3SMatthew Dillon 
592d323ddf3SMatthew Dillon 	/*
593d323ddf3SMatthew Dillon 	 *	Loop through the list of image activators, calling each one.
594d323ddf3SMatthew Dillon 	 *	An activator returns -1 if there is no match, 0 on success,
595d323ddf3SMatthew Dillon 	 *	and an error otherwise.
596d323ddf3SMatthew Dillon 	 */
597d323ddf3SMatthew Dillon 	for (i = 0; error == -1 && execsw[i]; ++i) {
598d323ddf3SMatthew Dillon 		if (execsw[i]->ex_imgact == NULL ||
599d323ddf3SMatthew Dillon 		    execsw[i]->ex_imgact == img_first) {
600d323ddf3SMatthew Dillon 			continue;
601d323ddf3SMatthew Dillon 		}
602c52007c2SDavid Greenman 		error = (*execsw[i]->ex_imgact)(imgp);
603d323ddf3SMatthew Dillon 	}
604d323ddf3SMatthew Dillon 
605d323ddf3SMatthew Dillon 	if (error) {
606619eb6e5SJeff Roberson 		if (error == -1) {
607877d24acSKonstantin Belousov 			if (textset == 0)
608877d24acSKonstantin Belousov 				VOP_UNSET_TEXT(imgp->vp);
609d323ddf3SMatthew Dillon 			error = ENOEXEC;
610619eb6e5SJeff Roberson 		}
61126f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
612d323ddf3SMatthew Dillon 	}
613d323ddf3SMatthew Dillon 
614d323ddf3SMatthew Dillon 	/*
615d323ddf3SMatthew Dillon 	 * Special interpreter operation, cleanup and loop up to try to
616d323ddf3SMatthew Dillon 	 * activate the interpreter.
617d323ddf3SMatthew Dillon 	 */
618c52007c2SDavid Greenman 	if (imgp->interpreted) {
6191616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
620619eb6e5SJeff Roberson 		/*
621619eb6e5SJeff Roberson 		 * VV_TEXT needs to be unset for scripts.  There is a short
622619eb6e5SJeff Roberson 		 * period before we determine that something is a script where
623619eb6e5SJeff Roberson 		 * VV_TEXT will be set. The vnode lock is held over this
624619eb6e5SJeff Roberson 		 * entire period so nothing should illegitimately be blocked.
625619eb6e5SJeff Roberson 		 */
626877d24acSKonstantin Belousov 		VOP_UNSET_TEXT(imgp->vp);
627762e6b85SEivind Eklund 		/* free name buffer and old vnode */
628632dbc19SKonstantin Belousov 		if (args->fname != NULL)
62969c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
630670cb89bSRobert Watson #ifdef MAC
63161617058SMateusz Guzik 		mac_execve_interpreter_enter(newtextvp, &interpvplabel);
632670cb89bSRobert Watson #endif
6339a75ea23SKonstantin Belousov 		if (imgp->opened) {
63461617058SMateusz Guzik 			VOP_CLOSE(newtextvp, FREAD, td->td_ucred, td);
6359a75ea23SKonstantin Belousov 			imgp->opened = 0;
6369a75ea23SKonstantin Belousov 		}
63761617058SMateusz Guzik 		vput(newtextvp);
6380b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
6390b2ed1aeSJeff Roberson 		imgp->object = NULL;
640881010f0SBryan Drewery 		imgp->credential_setid = false;
641881010f0SBryan Drewery 		if (imgp->newcred != NULL) {
642881010f0SBryan Drewery 			crfree(imgp->newcred);
643881010f0SBryan Drewery 			imgp->newcred = NULL;
644881010f0SBryan Drewery 		}
6451afd78b3SBryan Drewery 		imgp->execpath = NULL;
6461afd78b3SBryan Drewery 		free(imgp->freepath, M_TEMP);
6471afd78b3SBryan Drewery 		imgp->freepath = NULL;
64826f9a767SRodney W. Grimes 		/* set new name to that of the interpreter */
6495050aa86SKonstantin Belousov 		NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
650b40ce416SJulian Elischer 		    UIO_SYSSPACE, imgp->interpreter_name, td);
651632dbc19SKonstantin Belousov 		args->fname = imgp->interpreter_name;
65226f9a767SRodney W. Grimes 		goto interpret;
65326f9a767SRodney W. Grimes 	}
65426f9a767SRodney W. Grimes 
65526f9a767SRodney W. Grimes 	/*
656ded7d39cSChristian S.J. Peron 	 * NB: We unlock the vnode here because it is believed that none
657ded7d39cSChristian S.J. Peron 	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
658ded7d39cSChristian S.J. Peron 	 */
659ded7d39cSChristian S.J. Peron 	VOP_UNLOCK(imgp->vp, 0);
6603ff06357SKonstantin Belousov 
661eda6009cSKonstantin Belousov 	if (disallow_high_osrel &&
662eda6009cSKonstantin Belousov 	    P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) {
663eda6009cSKonstantin Belousov 		error = ENOEXEC;
664eda6009cSKonstantin Belousov 		uprintf("Osrel %d for image %s too high\n", p->p_osrel,
665eda6009cSKonstantin Belousov 		    imgp->execpath != NULL ? imgp->execpath : "<unresolved>");
666eda6009cSKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
667eda6009cSKonstantin Belousov 		goto exec_fail_dealloc;
668eda6009cSKonstantin Belousov 	}
669eda6009cSKonstantin Belousov 
67039f5ebb7SEd Schouten 	/* ABI enforces the use of Capsicum. Switch into capabilities mode. */
67139f5ebb7SEd Schouten 	if (SV_PROC_FLAG(p, SV_CAPSICUM))
67239f5ebb7SEd Schouten 		sys_cap_enter(td, NULL);
67339f5ebb7SEd Schouten 
674ded7d39cSChristian S.J. Peron 	/*
67526f9a767SRodney W. Grimes 	 * Copy out strings (args and env) and initialize stack base
67626f9a767SRodney W. Grimes 	 */
6773ebc1248SPeter Wemm 	if (p->p_sysent->sv_copyout_strings)
6783ebc1248SPeter Wemm 		stack_base = (*p->p_sysent->sv_copyout_strings)(imgp);
6793ebc1248SPeter Wemm 	else
680c52007c2SDavid Greenman 		stack_base = exec_copyout_strings(imgp);
68126f9a767SRodney W. Grimes 
68226f9a767SRodney W. Grimes 	/*
6831e1e0b44SSøren Schmidt 	 * If custom stack fixup routine present for this process
6841e1e0b44SSøren Schmidt 	 * let it do the stack setup.
6851e1e0b44SSøren Schmidt 	 * Else stuff argument count as first item on stack
68626f9a767SRodney W. Grimes 	 */
687d6c847f3SBruce Evans 	if (p->p_sysent->sv_fixup != NULL)
688c52007c2SDavid Greenman 		(*p->p_sysent->sv_fixup)(&stack_base, imgp);
6891e1e0b44SSøren Schmidt 	else
690610ecfe0SMaxim Sobolev 		suword(--stack_base, imgp->args->argc);
69126f9a767SRodney W. Grimes 
692457f7e23SEd Schouten 	if (args->fdp != NULL) {
693457f7e23SEd Schouten 		/* Install a brand new file descriptor table. */
694457f7e23SEd Schouten 		fdinstall_remapped(td, args->fdp);
695457f7e23SEd Schouten 		args->fdp = NULL;
696457f7e23SEd Schouten 	} else {
697a78e8d2aSDavid Greenman 		/*
698457f7e23SEd Schouten 		 * Keep on using the existing file descriptor table. For
699457f7e23SEd Schouten 		 * security and other reasons, the file descriptor table
700457f7e23SEd Schouten 		 * cannot be shared after an exec.
701a78e8d2aSDavid Greenman 		 */
702b9d32c36SMateusz Guzik 		fdunshare(td);
703b0bc0cadSMateusz Guzik 		/* close files on exec */
704b0bc0cadSMateusz Guzik 		fdcloseexec(td);
705457f7e23SEd Schouten 	}
706a78e8d2aSDavid Greenman 
707333ea485SGuido van Rooij 	/*
7089b3b1c5fSJohn Baldwin 	 * Malloc things before we need locks.
7099b3b1c5fSJohn Baldwin 	 */
710610ecfe0SMaxim Sobolev 	i = imgp->args->begin_envv - imgp->args->begin_argv;
7115997cae9SDon Lewis 	/* Cache arguments if they fit inside our allowance */
7125997cae9SDon Lewis 	if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
7139b3b1c5fSJohn Baldwin 		newargs = pargs_alloc(i);
7145997cae9SDon Lewis 		bcopy(imgp->args->begin_argv, newargs->ar_args, i);
7155997cae9SDon Lewis 	}
7169b3b1c5fSJohn Baldwin 
7179b3b1c5fSJohn Baldwin 	/*
718333ea485SGuido van Rooij 	 * For security and other reasons, signal handlers cannot
7198688bb93SJohn Baldwin 	 * be shared after an exec. The new process gets a copy of the old
720b2c3fa70SDima Dorfman 	 * handlers. In execsigs(), the new process will have its signals
721333ea485SGuido van Rooij 	 * reset.
722333ea485SGuido van Rooij 	 */
72390af4afaSJohn Baldwin 	if (sigacts_shared(p->p_sigacts)) {
72490af4afaSJohn Baldwin 		oldsigacts = p->p_sigacts;
72590af4afaSJohn Baldwin 		newsigacts = sigacts_alloc();
72690af4afaSJohn Baldwin 		sigacts_copy(newsigacts, oldsigacts);
727a6bad85eSMateusz Guzik 	}
728333ea485SGuido van Rooij 
729*cda68844SMateusz Guzik 	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
730*cda68844SMateusz Guzik 
731d00c8ea4SMateusz Guzik 	PROC_LOCK(p);
732d00c8ea4SMateusz Guzik 	if (oldsigacts)
733d00c8ea4SMateusz Guzik 		p->p_sigacts = newsigacts;
734fdf4e8b3SWarner Losh 	/* Stop profiling */
735fdf4e8b3SWarner Losh 	stopprofclock(p);
736fdf4e8b3SWarner Losh 
73726f9a767SRodney W. Grimes 	/* reset caught signals */
73826f9a767SRodney W. Grimes 	execsigs(p);
73926f9a767SRodney W. Grimes 
74026f9a767SRodney W. Grimes 	/* name this process - nameiexec(p, ndp) */
7415ca4819dSJohn Baldwin 	bzero(p->p_comm, sizeof(p->p_comm));
7425ca4819dSJohn Baldwin 	if (args->fname)
7435ca4819dSJohn Baldwin 		bcopy(nd.ni_cnd.cn_nameptr, p->p_comm,
7445ca4819dSJohn Baldwin 		    min(nd.ni_cnd.cn_namelen, MAXCOMLEN));
74561617058SMateusz Guzik 	else if (vn_commname(newtextvp, p->p_comm, sizeof(p->p_comm)) != 0)
7465ca4819dSJohn Baldwin 		bcopy(fexecv_proc_title, p->p_comm, sizeof(fexecv_proc_title));
747ca081fdbSJulian Elischer 	bcopy(p->p_comm, td->td_name, sizeof(td->td_name));
74844ad5475SJohn Baldwin #ifdef KTR
74944ad5475SJohn Baldwin 	sched_clear_tdname(td);
75044ad5475SJohn Baldwin #endif
75126f9a767SRodney W. Grimes 
75226f9a767SRodney W. Grimes 	/*
75324b34f09SSujal Patel 	 * mark as execed, wakeup the process that vforked (if any) and tell
754dc733423SDag-Erling Smørgrav 	 * it that it now has its own resources back
75526f9a767SRodney W. Grimes 	 */
75626f9a767SRodney W. Grimes 	p->p_flag |= P_EXEC;
757677258f7SKonstantin Belousov 	if ((p->p_flag2 & P2_NOTRACE_EXEC) == 0)
758677258f7SKonstantin Belousov 		p->p_flag2 &= ~P2_NOTRACE;
759965d0860SMateusz Guzik 	if (p->p_flag & P_PPWAIT) {
760888d4d4fSKonstantin Belousov 		p->p_flag &= ~(P_PPWAIT | P_PPTRACE);
761aeb32571SKonstantin Belousov 		cv_broadcast(&p->p_pwait);
76226f9a767SRodney W. Grimes 	}
76326f9a767SRodney W. Grimes 
76426f9a767SRodney W. Grimes 	/*
765881010f0SBryan Drewery 	 * Implement image setuid/setgid installation.
766c52007c2SDavid Greenman 	 */
767881010f0SBryan Drewery 	if (imgp->credential_setid) {
768c52007c2SDavid Greenman 		/*
769c52007c2SDavid Greenman 		 * Turn off syscall tracing for set-id programs, except for
770b85db196SPeter Wemm 		 * root.  Record any set-id flags first to make sure that
771b85db196SPeter Wemm 		 * we do not regain any tracing during a possible block.
77226f9a767SRodney W. Grimes 		 */
773b85db196SPeter Wemm 		setsugid(p);
774acd3428bSRobert Watson 
7756c84de02SJohn Baldwin #ifdef KTRACE
776c331c970SAndriy Gapon 		if (p->p_tracecred != NULL &&
777c331c970SAndriy Gapon 		    priv_check_cred(p->p_tracecred, PRIV_DEBUG_DIFFCRED, 0))
778d680caabSJohn Baldwin 			ktrprocexec(p, &tracecred, &tracevp);
7796c84de02SJohn Baldwin #endif
78028b325aaSDon Lewis 		/*
781c1e2d386SNate Lawson 		 * Close any file descriptors 0..2 that reference procfs,
782c1e2d386SNate Lawson 		 * then make sure file descriptors 0..2 are in use.
78328b325aaSDon Lewis 		 *
7848a5177ccSMateusz Guzik 		 * Both fdsetugidsafety() and fdcheckstd() may call functions
7858a5177ccSMateusz Guzik 		 * taking sleepable locks, so temporarily drop our locks.
78628b325aaSDon Lewis 		 */
78728b325aaSDon Lewis 		PROC_UNLOCK(p);
78822db15c0SAttilio Rao 		VOP_UNLOCK(imgp->vp, 0);
78911888da8SMateusz Guzik 		fdsetugidsafety(td);
790e983a376SJacques Vidrine 		error = fdcheckstd(td);
7915e2554b7SMateusz Guzik 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
792*cda68844SMateusz Guzik 		if (error != 0)
793*cda68844SMateusz Guzik 			goto exec_fail_dealloc;
794e1b1aa3bSJohn Baldwin 		PROC_LOCK(p);
795ccafe7ebSRobert Watson #ifdef MAC
796670cb89bSRobert Watson 		if (will_transition) {
797881010f0SBryan Drewery 			mac_vnode_execve_transition(oldcred, imgp->newcred,
798881010f0SBryan Drewery 			    imgp->vp, interpvplabel, imgp);
799670cb89bSRobert Watson 		}
800ccafe7ebSRobert Watson #endif
801c52007c2SDavid Greenman 	} else {
802b1fc0ec1SRobert Watson 		if (oldcred->cr_uid == oldcred->cr_ruid &&
803b1fc0ec1SRobert Watson 		    oldcred->cr_gid == oldcred->cr_rgid)
804c52007c2SDavid Greenman 			p->p_flag &= ~P_SUGID;
805881010f0SBryan Drewery 	}
80626f9a767SRodney W. Grimes 	/*
807881010f0SBryan Drewery 	 * Set the new credentials.
80826f9a767SRodney W. Grimes 	 */
809881010f0SBryan Drewery 	if (imgp->newcred != NULL)
810881010f0SBryan Drewery 		proc_set_cred(p, imgp->newcred);
81126f9a767SRodney W. Grimes 
81226f9a767SRodney W. Grimes 	/*
813853be5ffSMateusz Guzik 	 * Store the vp for use in procfs.  This vnode was referenced by namei
814853be5ffSMateusz Guzik 	 * or fgetvp_exec.
8152a531c80SDavid Greenman 	 */
81661617058SMateusz Guzik 	oldtextvp = p->p_textvp;
81761617058SMateusz Guzik 	p->p_textvp = newtextvp;
8182a531c80SDavid Greenman 
8195d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
8205d217f17SJohn Birrell 	/*
8215d217f17SJohn Birrell 	 * Tell the DTrace fasttrap provider about the exec if it
8225d217f17SJohn Birrell 	 * has declared an interest.
8235d217f17SJohn Birrell 	 */
8245d217f17SJohn Birrell 	if (dtrace_fasttrap_exec)
8255d217f17SJohn Birrell 		dtrace_fasttrap_exec(p);
8265d217f17SJohn Birrell #endif
8275d217f17SJohn Birrell 
8282a531c80SDavid Greenman 	/*
8299ca45e81SDag-Erling Smørgrav 	 * Notify others that we exec'd, and clear the P_INEXEC flag
8309ca45e81SDag-Erling Smørgrav 	 * as we're now a bona fide freshly-execed process.
831cb679c38SJonathan Lemon 	 */
832ad3b9257SJohn-Mark Gurney 	KNOTE_LOCKED(&p->p_klist, NOTE_EXEC);
8339ca45e81SDag-Erling Smørgrav 	p->p_flag &= ~P_INEXEC;
834cb679c38SJonathan Lemon 
83526f9a767SRodney W. Grimes 	/* clear "fork but no exec" flag, as we _are_ execing */
83626f9a767SRodney W. Grimes 	p->p_acflag &= ~AFORK;
83726f9a767SRodney W. Grimes 
8385997cae9SDon Lewis 	/*
83934ea500bSDon Lewis 	 * Free any previous argument cache and replace it with
8405997cae9SDon Lewis 	 * the new argument cache, if any.
8415997cae9SDon Lewis 	 */
8429b3b1c5fSJohn Baldwin 	oldargs = p->p_args;
843e1b1aa3bSJohn Baldwin 	p->p_args = newargs;
844e1b1aa3bSJohn Baldwin 	newargs = NULL;
845ebccf1e3SJoseph Koshy 
846ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
847ebccf1e3SJoseph Koshy 	/*
848f263522aSJoseph Koshy 	 * Check if system-wide sampling is in effect or if the
849f263522aSJoseph Koshy 	 * current process is using PMCs.  If so, do exec() time
850ebccf1e3SJoseph Koshy 	 * processing.  This processing needs to happen AFTER the
851ebccf1e3SJoseph Koshy 	 * P_INEXEC flag is cleared.
852ebccf1e3SJoseph Koshy 	 *
853ebccf1e3SJoseph Koshy 	 * The proc lock needs to be released before taking the PMC
854ebccf1e3SJoseph Koshy 	 * SX.
855ebccf1e3SJoseph Koshy 	 */
856f263522aSJoseph Koshy 	if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
857e1b1aa3bSJohn Baldwin 		PROC_UNLOCK(p);
8581ef6ea9bSKonstantin Belousov 		VOP_UNLOCK(imgp->vp, 0);
85915139246SJoseph Koshy 		pe.pm_credentialschanged = credential_changing;
86015139246SJoseph Koshy 		pe.pm_entryaddr = imgp->entry_addr;
86115139246SJoseph Koshy 
86215139246SJoseph Koshy 		PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
8632974cc36SKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
864ebccf1e3SJoseph Koshy 	} else
865ebccf1e3SJoseph Koshy 		PROC_UNLOCK(p);
866ebccf1e3SJoseph Koshy #else  /* !HWPMC_HOOKS */
867ebccf1e3SJoseph Koshy 	PROC_UNLOCK(p);
868ebccf1e3SJoseph Koshy #endif
869e1b1aa3bSJohn Baldwin 
870e913ca22SDoug Rabson 	/* Set values passed into the program in registers. */
8713ebc1248SPeter Wemm 	if (p->p_sysent->sv_setregs)
872a107d8aaSNathan Whitehorn 		(*p->p_sysent->sv_setregs)(td, imgp,
873a107d8aaSNathan Whitehorn 		    (u_long)(uintptr_t)stack_base);
8743ebc1248SPeter Wemm 	else
875a107d8aaSNathan Whitehorn 		exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base);
876e913ca22SDoug Rabson 
8770359a12eSAttilio Rao 	vfs_mark_atime(imgp->vp, td->td_ucred);
8786341095eSKen Smith 
87936160958SMark Johnston 	SDT_PROBE1(proc, , , exec__success, args->fname);
8805d217f17SJohn Birrell 
8811616db3cSJohn Dyson exec_fail_dealloc:
882d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
8831616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
88426f9a767SRodney W. Grimes 
885d6c847f3SBruce Evans 	if (imgp->vp != NULL) {
886632dbc19SKonstantin Belousov 		if (args->fname)
88769c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
8889a75ea23SKonstantin Belousov 		if (imgp->opened)
8899a75ea23SKonstantin Belousov 			VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td);
890853be5ffSMateusz Guzik 		if (error != 0)
891619eb6e5SJeff Roberson 			vput(imgp->vp);
892853be5ffSMateusz Guzik 		else
893853be5ffSMateusz Guzik 			VOP_UNLOCK(imgp->vp, 0);
894a3cf6ebaSDavid Greenman 	}
89526f9a767SRodney W. Grimes 
896d6c847f3SBruce Evans 	if (imgp->object != NULL)
8970b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
8980b2ed1aeSJeff Roberson 
8993ff06357SKonstantin Belousov 	free(imgp->freepath, M_TEMP);
9003ff06357SKonstantin Belousov 
901d1989db5SRobert Drehmel 	if (error == 0) {
902afe1a688SKonstantin Belousov 		PROC_LOCK(p);
903afe1a688SKonstantin Belousov 		td->td_dbgflags |= TDB_EXEC;
904afe1a688SKonstantin Belousov 		PROC_UNLOCK(p);
905afe1a688SKonstantin Belousov 
906d1989db5SRobert Drehmel 		/*
907d1989db5SRobert Drehmel 		 * Stop the process here if its stop event mask has
908d1989db5SRobert Drehmel 		 * the S_EXEC bit set.
909d1989db5SRobert Drehmel 		 */
910d1989db5SRobert Drehmel 		STOPEVENT(p, S_EXEC, 0);
911*cda68844SMateusz Guzik 	} else {
91226f9a767SRodney W. Grimes exec_fail:
9139ca45e81SDag-Erling Smørgrav 		/* we're done here, clear P_INEXEC */
9149ca45e81SDag-Erling Smørgrav 		PROC_LOCK(p);
9159ca45e81SDag-Erling Smørgrav 		p->p_flag &= ~P_INEXEC;
9169ca45e81SDag-Erling Smørgrav 		PROC_UNLOCK(p);
9179ca45e81SDag-Erling Smørgrav 
91836160958SMark Johnston 		SDT_PROBE1(proc, , , exec__failure, error);
919*cda68844SMateusz Guzik 	}
9205d217f17SJohn Birrell 
921881010f0SBryan Drewery 	if (imgp->newcred != NULL)
922881010f0SBryan Drewery 		crfree(oldcred);
923670cb89bSRobert Watson #ifdef MAC
924670cb89bSRobert Watson 	mac_execve_exit(imgp);
9256356dba0SRobert Watson 	mac_execve_interpreter_exit(interpvplabel);
926670cb89bSRobert Watson #endif
9278917b8d2SJohn Baldwin 	exec_free_args(args);
9288917b8d2SJohn Baldwin 
929*cda68844SMateusz Guzik 	/*
930*cda68844SMateusz Guzik 	 * Handle deferred decrement of ref counts.
931*cda68844SMateusz Guzik 	 */
932*cda68844SMateusz Guzik 	if (oldtextvp != NULL)
933*cda68844SMateusz Guzik 		vrele(oldtextvp);
934*cda68844SMateusz Guzik #ifdef KTRACE
935*cda68844SMateusz Guzik 	if (tracevp != NULL)
936*cda68844SMateusz Guzik 		vrele(tracevp);
937*cda68844SMateusz Guzik 	if (tracecred != NULL)
938*cda68844SMateusz Guzik 		crfree(tracecred);
939*cda68844SMateusz Guzik #endif
940*cda68844SMateusz Guzik 	pargs_drop(oldargs);
941*cda68844SMateusz Guzik 	pargs_drop(newargs);
942*cda68844SMateusz Guzik 	if (oldsigacts != NULL)
943*cda68844SMateusz Guzik 		sigacts_free(oldsigacts);
944*cda68844SMateusz Guzik 	if (euip != NULL)
945*cda68844SMateusz Guzik 		uifree(euip);
946*cda68844SMateusz Guzik 
9478917b8d2SJohn Baldwin 	if (error && imgp->vmspace_destroyed) {
9488917b8d2SJohn Baldwin 		/* sorry, no more process anymore. exit gracefully */
949b4490c6eSKonstantin Belousov 		exit1(td, 0, SIGABRT);
9508917b8d2SJohn Baldwin 		/* NOT REACHED */
9518917b8d2SJohn Baldwin 	}
9527705d4b2SDmitry Chagin 
9537705d4b2SDmitry Chagin #ifdef KTRACE
9547705d4b2SDmitry Chagin 	if (error == 0)
9557705d4b2SDmitry Chagin 		ktrprocctor(p);
9567705d4b2SDmitry Chagin #endif
9577705d4b2SDmitry Chagin 
958116734c4SMatthew Dillon 	return (error);
95926f9a767SRodney W. Grimes }
96026f9a767SRodney W. Grimes 
9611616db3cSJohn Dyson int
9621616db3cSJohn Dyson exec_map_first_page(imgp)
9631616db3cSJohn Dyson 	struct image_params *imgp;
9641616db3cSJohn Dyson {
965b0cd2017SGleb Smirnoff 	int rv, i, after, initial_pagein;
96695461b45SJohn Dyson 	vm_page_t ma[VM_INITIAL_PAGEIN];
9671616db3cSJohn Dyson 	vm_object_t object;
9681616db3cSJohn Dyson 
969d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
9701616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
9711616db3cSJohn Dyson 
9728516dd18SPoul-Henning Kamp 	object = imgp->vp->v_object;
9734d7d2993SJeff Roberson 	if (object == NULL)
9744d7d2993SJeff Roberson 		return (EACCES);
97589f6b863SAttilio Rao 	VM_OBJECT_WLOCK(object);
976f8a47341SAlan Cox #if VM_NRESERVLEVEL > 0
9773d653db0SAlan Cox 	vm_object_color(object, 0);
978f8a47341SAlan Cox #endif
9795944de8eSKonstantin Belousov 	ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL);
9800a2e596aSAlan Cox 	if (ma[0]->valid != VM_PAGE_BITS_ALL) {
981b0cd2017SGleb Smirnoff 		if (!vm_pager_has_page(object, 0, NULL, &after)) {
982b0cd2017SGleb Smirnoff 			vm_page_lock(ma[0]);
983b0cd2017SGleb Smirnoff 			vm_page_free(ma[0]);
984b0cd2017SGleb Smirnoff 			vm_page_unlock(ma[0]);
985b0cd2017SGleb Smirnoff 			vm_page_xunbusy(ma[0]);
986b0cd2017SGleb Smirnoff 			VM_OBJECT_WUNLOCK(object);
987b0cd2017SGleb Smirnoff 			return (EIO);
988b0cd2017SGleb Smirnoff 		}
989b0cd2017SGleb Smirnoff 		initial_pagein = min(after, VM_INITIAL_PAGEIN);
990b0cd2017SGleb Smirnoff 		KASSERT(initial_pagein <= object->size,
991b0cd2017SGleb Smirnoff 		    ("%s: initial_pagein %d object->size %ju",
992b0cd2017SGleb Smirnoff 		    __func__, initial_pagein, (uintmax_t )object->size));
99395461b45SJohn Dyson 		for (i = 1; i < initial_pagein; i++) {
99441890423SAlan Cox 			if ((ma[i] = vm_page_next(ma[i - 1])) != NULL) {
9956ec2fca5SAlan Cox 				if (ma[i]->valid)
9966ec2fca5SAlan Cox 					break;
997c7aebda8SAttilio Rao 				if (vm_page_tryxbusy(ma[i]))
99806fa71cdSAlan Cox 					break;
99995461b45SJohn Dyson 			} else {
1000ca0387efSJake Burkholder 				ma[i] = vm_page_alloc(object, i,
10017bfda801SAlan Cox 				    VM_ALLOC_NORMAL | VM_ALLOC_IFNOTCACHED);
100295461b45SJohn Dyson 				if (ma[i] == NULL)
100395461b45SJohn Dyson 					break;
100495461b45SJohn Dyson 			}
100595461b45SJohn Dyson 		}
100695461b45SJohn Dyson 		initial_pagein = i;
1007b0cd2017SGleb Smirnoff 		rv = vm_pager_get_pages(object, ma, initial_pagein, NULL, NULL);
1008093c7f39SGleb Smirnoff 		if (rv != VM_PAGER_OK) {
1009b0cd2017SGleb Smirnoff 			for (i = 0; i < initial_pagein; i++) {
1010b0cd2017SGleb Smirnoff 				vm_page_lock(ma[i]);
1011b0cd2017SGleb Smirnoff 				vm_page_free(ma[i]);
1012b0cd2017SGleb Smirnoff 				vm_page_unlock(ma[i]);
1013b0cd2017SGleb Smirnoff 				vm_page_xunbusy(ma[i]);
1014b0cd2017SGleb Smirnoff 			}
101589f6b863SAttilio Rao 			VM_OBJECT_WUNLOCK(object);
1016a7cddfedSJake Burkholder 			return (EIO);
10171616db3cSJohn Dyson 		}
1018b0cd2017SGleb Smirnoff 		for (i = 1; i < initial_pagein; i++)
1019b0cd2017SGleb Smirnoff 			vm_page_readahead_finish(ma[i]);
10201616db3cSJohn Dyson 	}
1021c7aebda8SAttilio Rao 	vm_page_xunbusy(ma[0]);
10222965a453SKip Macy 	vm_page_lock(ma[0]);
1023be996836SAttilio Rao 	vm_page_hold(ma[0]);
102470978c93SKonstantin Belousov 	vm_page_activate(ma[0]);
10252965a453SKip Macy 	vm_page_unlock(ma[0]);
102689f6b863SAttilio Rao 	VM_OBJECT_WUNLOCK(object);
10271616db3cSJohn Dyson 
102859c8bc40SAlan Cox 	imgp->firstpage = sf_buf_alloc(ma[0], 0);
102959c8bc40SAlan Cox 	imgp->image_header = (char *)sf_buf_kva(imgp->firstpage);
10301616db3cSJohn Dyson 
1031a7cddfedSJake Burkholder 	return (0);
10321616db3cSJohn Dyson }
10331616db3cSJohn Dyson 
10341616db3cSJohn Dyson void
10351616db3cSJohn Dyson exec_unmap_first_page(imgp)
10361616db3cSJohn Dyson 	struct image_params *imgp;
10371616db3cSJohn Dyson {
103859c8bc40SAlan Cox 	vm_page_t m;
103923955314SAlfred Perlstein 
1040d6c847f3SBruce Evans 	if (imgp->firstpage != NULL) {
104159c8bc40SAlan Cox 		m = sf_buf_page(imgp->firstpage);
104259c8bc40SAlan Cox 		sf_buf_free(imgp->firstpage);
10431616db3cSJohn Dyson 		imgp->firstpage = NULL;
10442965a453SKip Macy 		vm_page_lock(m);
1045be996836SAttilio Rao 		vm_page_unhold(m);
10462965a453SKip Macy 		vm_page_unlock(m);
10471616db3cSJohn Dyson 	}
10481616db3cSJohn Dyson }
10491616db3cSJohn Dyson 
105026f9a767SRodney W. Grimes /*
105126f9a767SRodney W. Grimes  * Destroy old address space, and allocate a new stack
105226f9a767SRodney W. Grimes  *	The new stack is only SGROWSIZ large because it is grown
105326f9a767SRodney W. Grimes  *	automatically in trap.c.
105426f9a767SRodney W. Grimes  */
105526f9a767SRodney W. Grimes int
105605ba50f5SJake Burkholder exec_new_vmspace(imgp, sv)
1057c52007c2SDavid Greenman 	struct image_params *imgp;
105805ba50f5SJake Burkholder 	struct sysentvec *sv;
105926f9a767SRodney W. Grimes {
106026f9a767SRodney W. Grimes 	int error;
10615e20c11fSAlan Cox 	struct proc *p = imgp->proc;
10625e20c11fSAlan Cox 	struct vmspace *vmspace = p->p_vmspace;
10636297a3d8SKonstantin Belousov 	vm_object_t obj;
1064316b3843SKonstantin Belousov 	struct rlimit rlim_stack;
1065878adb85SBjoern A. Zeeb 	vm_offset_t sv_minuser, stack_addr;
106605ba50f5SJake Burkholder 	vm_map_t map;
106759d8f3ffSJohn Baldwin 	u_long ssiz;
106826f9a767SRodney W. Grimes 
1069c52007c2SDavid Greenman 	imgp->vmspace_destroyed = 1;
1070993182e5SAlexander Leidinger 	imgp->sysent = sv;
107126f9a767SRodney W. Grimes 
1072bd37fd72SKris Kennaway 	/* May be called with Giant held */
1073993182e5SAlexander Leidinger 	EVENTHANDLER_INVOKE(process_exec, p, imgp);
10746f5dafeaSAlan Cox 
10756f5dafeaSAlan Cox 	/*
1076af9ec885SJohn Dyson 	 * Blow away entire process VM, if address space not shared,
1077af9ec885SJohn Dyson 	 * otherwise, create a new VM space so that other threads are
1078af9ec885SJohn Dyson 	 * not disrupted
1079af9ec885SJohn Dyson 	 */
108005ba50f5SJake Burkholder 	map = &vmspace->vm_map;
1081878adb85SBjoern A. Zeeb 	if (map_at_zero)
1082878adb85SBjoern A. Zeeb 		sv_minuser = sv->sv_minuser;
1083878adb85SBjoern A. Zeeb 	else
1084878adb85SBjoern A. Zeeb 		sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
1085878adb85SBjoern A. Zeeb 	if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser &&
108605ba50f5SJake Burkholder 	    vm_map_max(map) == sv->sv_maxuser) {
10873db161e0SMatthew Dillon 		shmexit(vmspace);
1088b9eee07eSPeter Wemm 		pmap_remove_pages(vmspace_pmap(vmspace));
108905ba50f5SJake Burkholder 		vm_map_remove(map, vm_map_min(map), vm_map_max(map));
1090af9ec885SJohn Dyson 	} else {
1091878adb85SBjoern A. Zeeb 		error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
109289b57fcfSKonstantin Belousov 		if (error)
109389b57fcfSKonstantin Belousov 			return (error);
10945e20c11fSAlan Cox 		vmspace = p->p_vmspace;
109505ba50f5SJake Burkholder 		map = &vmspace->vm_map;
1096af9ec885SJohn Dyson 	}
109726f9a767SRodney W. Grimes 
10986297a3d8SKonstantin Belousov 	/* Map a shared page */
10996297a3d8SKonstantin Belousov 	obj = sv->sv_shared_page_obj;
11006297a3d8SKonstantin Belousov 	if (obj != NULL) {
11016297a3d8SKonstantin Belousov 		vm_object_reference(obj);
11026297a3d8SKonstantin Belousov 		error = vm_map_fixed(map, obj, 0,
11036297a3d8SKonstantin Belousov 		    sv->sv_shared_page_base, sv->sv_shared_page_len,
11041e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
11051e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
11061e65d73cSKonstantin Belousov 		    MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE);
11076297a3d8SKonstantin Belousov 		if (error) {
11086297a3d8SKonstantin Belousov 			vm_object_deallocate(obj);
11096297a3d8SKonstantin Belousov 			return (error);
11106297a3d8SKonstantin Belousov 		}
11116297a3d8SKonstantin Belousov 	}
11126297a3d8SKonstantin Belousov 
111326f9a767SRodney W. Grimes 	/* Allocate a new stack */
1114316b3843SKonstantin Belousov 	if (imgp->stack_sz != 0) {
1115fe8a824cSKonstantin Belousov 		ssiz = trunc_page(imgp->stack_sz);
1116316b3843SKonstantin Belousov 		PROC_LOCK(p);
1117f6f6d240SMateusz Guzik 		lim_rlimit_proc(p, RLIMIT_STACK, &rlim_stack);
1118316b3843SKonstantin Belousov 		PROC_UNLOCK(p);
1119316b3843SKonstantin Belousov 		if (ssiz > rlim_stack.rlim_max)
1120316b3843SKonstantin Belousov 			ssiz = rlim_stack.rlim_max;
1121316b3843SKonstantin Belousov 		if (ssiz > rlim_stack.rlim_cur) {
1122316b3843SKonstantin Belousov 			rlim_stack.rlim_cur = ssiz;
1123316b3843SKonstantin Belousov 			kern_setrlimit(curthread, RLIMIT_STACK, &rlim_stack);
1124316b3843SKonstantin Belousov 		}
1125316b3843SKonstantin Belousov 	} else if (sv->sv_maxssiz != NULL) {
112659d8f3ffSJohn Baldwin 		ssiz = *sv->sv_maxssiz;
1127316b3843SKonstantin Belousov 	} else {
112859d8f3ffSJohn Baldwin 		ssiz = maxssiz;
1129316b3843SKonstantin Belousov 	}
113059d8f3ffSJohn Baldwin 	stack_addr = sv->sv_usrstack - ssiz;
113159d8f3ffSJohn Baldwin 	error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz,
11326297a3d8SKonstantin Belousov 	    obj != NULL && imgp->stack_prot != 0 ? imgp->stack_prot :
11336297a3d8SKonstantin Belousov 		sv->sv_stackprot,
11346297a3d8SKonstantin Belousov 	    VM_PROT_ALL, MAP_STACK_GROWS_DOWN);
11352267af78SJulian Elischer 	if (error)
11362267af78SJulian Elischer 		return (error);
11372267af78SJulian Elischer 
113878960940SAlan Cox 	/*
113978960940SAlan Cox 	 * vm_ssize and vm_maxsaddr are somewhat antiquated concepts, but they
114078960940SAlan Cox 	 * are still used to enforce the stack rlimit on the process stack.
11412267af78SJulian Elischer 	 */
1142cbc89bfbSPaul Saab 	vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT;
11436ef12002SKonstantin Belousov 	vmspace->vm_maxsaddr = (char *)stack_addr;
114426f9a767SRodney W. Grimes 
114526f9a767SRodney W. Grimes 	return (0);
114626f9a767SRodney W. Grimes }
114726f9a767SRodney W. Grimes 
114826f9a767SRodney W. Grimes /*
1149873fbcd7SRobert Watson  * Copy out argument and environment strings from the old process address
1150873fbcd7SRobert Watson  * space into the temporary string buffer.
115126f9a767SRodney W. Grimes  */
115226f9a767SRodney W. Grimes int
1153610ecfe0SMaxim Sobolev exec_copyin_args(struct image_args *args, char *fname,
1154610ecfe0SMaxim Sobolev     enum uio_seg segflg, char **argv, char **envv)
115526f9a767SRodney W. Grimes {
11560a2c94b8SKonstantin Belousov 	u_long argp, envp;
1157ecbb00a2SDoug Rabson 	int error;
1158ecbb00a2SDoug Rabson 	size_t length;
115926f9a767SRodney W. Grimes 
1160610ecfe0SMaxim Sobolev 	bzero(args, sizeof(*args));
1161610ecfe0SMaxim Sobolev 	if (argv == NULL)
1162610ecfe0SMaxim Sobolev 		return (EFAULT);
11632af6e14dSAlan Cox 
116426f9a767SRodney W. Grimes 	/*
11652af6e14dSAlan Cox 	 * Allocate demand-paged memory for the file name, argument, and
11662af6e14dSAlan Cox 	 * environment strings.
116726f9a767SRodney W. Grimes 	 */
11682af6e14dSAlan Cox 	error = exec_alloc_args(args);
11692af6e14dSAlan Cox 	if (error != 0)
11702af6e14dSAlan Cox 		return (error);
11719e4e5114SAlan Cox 
1172610ecfe0SMaxim Sobolev 	/*
1173610ecfe0SMaxim Sobolev 	 * Copy the file name.
1174610ecfe0SMaxim Sobolev 	 */
1175632dbc19SKonstantin Belousov 	if (fname != NULL) {
11762af6e14dSAlan Cox 		args->fname = args->buf;
1177610ecfe0SMaxim Sobolev 		error = (segflg == UIO_SYSSPACE) ?
1178610ecfe0SMaxim Sobolev 		    copystr(fname, args->fname, PATH_MAX, &length) :
1179610ecfe0SMaxim Sobolev 		    copyinstr(fname, args->fname, PATH_MAX, &length);
1180c30af532SMaxim Sobolev 		if (error != 0)
118168ff3c24SStephan Uphoff 			goto err_exit;
1182632dbc19SKonstantin Belousov 	} else
11839e4e5114SAlan Cox 		length = 0;
11849e4e5114SAlan Cox 
11852af6e14dSAlan Cox 	args->begin_argv = args->buf + length;
11869e4e5114SAlan Cox 	args->endp = args->begin_argv;
11879e4e5114SAlan Cox 	args->stringspace = ARG_MAX;
118826f9a767SRodney W. Grimes 
1189610ecfe0SMaxim Sobolev 	/*
1190610ecfe0SMaxim Sobolev 	 * extract arguments first
1191610ecfe0SMaxim Sobolev 	 */
11920a2c94b8SKonstantin Belousov 	for (;;) {
11930a2c94b8SKonstantin Belousov 		error = fueword(argv++, &argp);
11940a2c94b8SKonstantin Belousov 		if (error == -1) {
119568ff3c24SStephan Uphoff 			error = EFAULT;
119668ff3c24SStephan Uphoff 			goto err_exit;
119768ff3c24SStephan Uphoff 		}
11980a2c94b8SKonstantin Belousov 		if (argp == 0)
11990a2c94b8SKonstantin Belousov 			break;
12000a2c94b8SKonstantin Belousov 		error = copyinstr((void *)(uintptr_t)argp, args->endp,
12010a2c94b8SKonstantin Belousov 		    args->stringspace, &length);
12020a2c94b8SKonstantin Belousov 		if (error != 0) {
1203610ecfe0SMaxim Sobolev 			if (error == ENAMETOOLONG)
120468ff3c24SStephan Uphoff 				error = E2BIG;
120568ff3c24SStephan Uphoff 			goto err_exit;
1206610ecfe0SMaxim Sobolev 		}
1207610ecfe0SMaxim Sobolev 		args->stringspace -= length;
1208610ecfe0SMaxim Sobolev 		args->endp += length;
1209610ecfe0SMaxim Sobolev 		args->argc++;
1210610ecfe0SMaxim Sobolev 	}
1211610ecfe0SMaxim Sobolev 
1212610ecfe0SMaxim Sobolev 	args->begin_envv = args->endp;
1213b9df5231SPoul-Henning Kamp 
121426f9a767SRodney W. Grimes 	/*
121526f9a767SRodney W. Grimes 	 * extract environment strings
121626f9a767SRodney W. Grimes 	 */
12170fd1a014SDavid Greenman 	if (envv) {
12180a2c94b8SKonstantin Belousov 		for (;;) {
12190a2c94b8SKonstantin Belousov 			error = fueword(envv++, &envp);
12200a2c94b8SKonstantin Belousov 			if (error == -1) {
122168ff3c24SStephan Uphoff 				error = EFAULT;
122268ff3c24SStephan Uphoff 				goto err_exit;
122368ff3c24SStephan Uphoff 			}
12240a2c94b8SKonstantin Belousov 			if (envp == 0)
12250a2c94b8SKonstantin Belousov 				break;
12260a2c94b8SKonstantin Belousov 			error = copyinstr((void *)(uintptr_t)envp,
12270a2c94b8SKonstantin Belousov 			    args->endp, args->stringspace, &length);
12280a2c94b8SKonstantin Belousov 			if (error != 0) {
12290fd1a014SDavid Greenman 				if (error == ENAMETOOLONG)
123068ff3c24SStephan Uphoff 					error = E2BIG;
123168ff3c24SStephan Uphoff 				goto err_exit;
12320fd1a014SDavid Greenman 			}
1233610ecfe0SMaxim Sobolev 			args->stringspace -= length;
1234610ecfe0SMaxim Sobolev 			args->endp += length;
1235610ecfe0SMaxim Sobolev 			args->envc++;
123626f9a767SRodney W. Grimes 		}
12370fd1a014SDavid Greenman 	}
123826f9a767SRodney W. Grimes 
123926f9a767SRodney W. Grimes 	return (0);
124068ff3c24SStephan Uphoff 
124168ff3c24SStephan Uphoff err_exit:
124268ff3c24SStephan Uphoff 	exec_free_args(args);
124368ff3c24SStephan Uphoff 	return (error);
124426f9a767SRodney W. Grimes }
124526f9a767SRodney W. Grimes 
1246457f7e23SEd Schouten int
1247457f7e23SEd Schouten exec_copyin_data_fds(struct thread *td, struct image_args *args,
1248457f7e23SEd Schouten     const void *data, size_t datalen, const int *fds, size_t fdslen)
1249457f7e23SEd Schouten {
1250457f7e23SEd Schouten 	struct filedesc *ofdp;
1251457f7e23SEd Schouten 	const char *p;
1252457f7e23SEd Schouten 	int *kfds;
1253457f7e23SEd Schouten 	int error;
1254457f7e23SEd Schouten 
1255457f7e23SEd Schouten 	memset(args, '\0', sizeof(*args));
1256457f7e23SEd Schouten 	ofdp = td->td_proc->p_fd;
1257457f7e23SEd Schouten 	if (datalen >= ARG_MAX || fdslen > ofdp->fd_lastfile + 1)
1258457f7e23SEd Schouten 		return (E2BIG);
1259457f7e23SEd Schouten 	error = exec_alloc_args(args);
1260457f7e23SEd Schouten 	if (error != 0)
1261457f7e23SEd Schouten 		return (error);
1262457f7e23SEd Schouten 
1263457f7e23SEd Schouten 	args->begin_argv = args->buf;
1264457f7e23SEd Schouten 	args->stringspace = ARG_MAX;
1265457f7e23SEd Schouten 
1266457f7e23SEd Schouten 	if (datalen > 0) {
1267457f7e23SEd Schouten 		/*
1268457f7e23SEd Schouten 		 * Argument buffer has been provided. Copy it into the
1269457f7e23SEd Schouten 		 * kernel as a single string and add a terminating null
1270457f7e23SEd Schouten 		 * byte.
1271457f7e23SEd Schouten 		 */
1272457f7e23SEd Schouten 		error = copyin(data, args->begin_argv, datalen);
1273457f7e23SEd Schouten 		if (error != 0)
1274457f7e23SEd Schouten 			goto err_exit;
1275457f7e23SEd Schouten 		args->begin_argv[datalen] = '\0';
1276457f7e23SEd Schouten 		args->endp = args->begin_argv + datalen + 1;
1277457f7e23SEd Schouten 		args->stringspace -= datalen + 1;
1278457f7e23SEd Schouten 
1279457f7e23SEd Schouten 		/*
1280457f7e23SEd Schouten 		 * Traditional argument counting. Count the number of
1281457f7e23SEd Schouten 		 * null bytes.
1282457f7e23SEd Schouten 		 */
1283457f7e23SEd Schouten 		for (p = args->begin_argv; p < args->endp; ++p)
1284457f7e23SEd Schouten 			if (*p == '\0')
1285457f7e23SEd Schouten 				++args->argc;
1286457f7e23SEd Schouten 	} else {
1287457f7e23SEd Schouten 		/* No argument buffer provided. */
1288457f7e23SEd Schouten 		args->endp = args->begin_argv;
1289457f7e23SEd Schouten 	}
1290457f7e23SEd Schouten 	/* There are no environment variables. */
1291457f7e23SEd Schouten 	args->begin_envv = args->endp;
1292457f7e23SEd Schouten 
1293457f7e23SEd Schouten 	/* Create new file descriptor table. */
1294457f7e23SEd Schouten 	kfds = malloc(fdslen * sizeof(int), M_TEMP, M_WAITOK);
1295457f7e23SEd Schouten 	error = copyin(fds, kfds, fdslen * sizeof(int));
1296457f7e23SEd Schouten 	if (error != 0) {
1297457f7e23SEd Schouten 		free(kfds, M_TEMP);
1298457f7e23SEd Schouten 		goto err_exit;
1299457f7e23SEd Schouten 	}
1300457f7e23SEd Schouten 	error = fdcopy_remapped(ofdp, kfds, fdslen, &args->fdp);
1301457f7e23SEd Schouten 	free(kfds, M_TEMP);
1302457f7e23SEd Schouten 	if (error != 0)
1303457f7e23SEd Schouten 		goto err_exit;
1304457f7e23SEd Schouten 
1305457f7e23SEd Schouten 	return (0);
1306457f7e23SEd Schouten err_exit:
1307457f7e23SEd Schouten 	exec_free_args(args);
1308457f7e23SEd Schouten 	return (error);
1309457f7e23SEd Schouten }
1310457f7e23SEd Schouten 
13112af6e14dSAlan Cox /*
13122af6e14dSAlan Cox  * Allocate temporary demand-paged, zero-filled memory for the file name,
13132af6e14dSAlan Cox  * argument, and environment strings.  Returns zero if the allocation succeeds
13142af6e14dSAlan Cox  * and ENOMEM otherwise.
13152af6e14dSAlan Cox  */
13162af6e14dSAlan Cox int
13172af6e14dSAlan Cox exec_alloc_args(struct image_args *args)
13182af6e14dSAlan Cox {
13192af6e14dSAlan Cox 
13205df87b21SJeff Roberson 	args->buf = (char *)kmap_alloc_wait(exec_map, PATH_MAX + ARG_MAX);
13212af6e14dSAlan Cox 	return (args->buf != NULL ? 0 : ENOMEM);
13222af6e14dSAlan Cox }
13232af6e14dSAlan Cox 
132469a8f9e3SAlan Cox void
1325610ecfe0SMaxim Sobolev exec_free_args(struct image_args *args)
1326610ecfe0SMaxim Sobolev {
1327610ecfe0SMaxim Sobolev 
132869a8f9e3SAlan Cox 	if (args->buf != NULL) {
13295df87b21SJeff Roberson 		kmap_free_wakeup(exec_map, (vm_offset_t)args->buf,
13302af6e14dSAlan Cox 		    PATH_MAX + ARG_MAX);
1331610ecfe0SMaxim Sobolev 		args->buf = NULL;
1332610ecfe0SMaxim Sobolev 	}
1333a14a9498SAlan Cox 	if (args->fname_buf != NULL) {
1334a14a9498SAlan Cox 		free(args->fname_buf, M_TEMP);
1335a14a9498SAlan Cox 		args->fname_buf = NULL;
1336a14a9498SAlan Cox 	}
1337457f7e23SEd Schouten 	if (args->fdp != NULL)
1338457f7e23SEd Schouten 		fdescfree_remapped(args->fdp);
1339610ecfe0SMaxim Sobolev }
1340610ecfe0SMaxim Sobolev 
134126f9a767SRodney W. Grimes /*
1342873fbcd7SRobert Watson  * Copy strings out to the new process address space, constructing new arg
1343873fbcd7SRobert Watson  * and env vector tables. Return a pointer to the base so that it can be used
1344873fbcd7SRobert Watson  * as the initial stack pointer.
134526f9a767SRodney W. Grimes  */
1346654f6be1SBruce Evans register_t *
1347c52007c2SDavid Greenman exec_copyout_strings(imgp)
1348c52007c2SDavid Greenman 	struct image_params *imgp;
134926f9a767SRodney W. Grimes {
135026f9a767SRodney W. Grimes 	int argc, envc;
135126f9a767SRodney W. Grimes 	char **vectp;
135288b124ceSKonstantin Belousov 	char *stringp;
135388b124ceSKonstantin Belousov 	uintptr_t destp;
1354654f6be1SBruce Evans 	register_t *stack_base;
135593f6448cSDavid Greenman 	struct ps_strings *arginfo;
1356f3bec5d7SJake Burkholder 	struct proc *p;
13573ff06357SKonstantin Belousov 	size_t execpath_len;
1358ee235befSKonstantin Belousov 	int szsigcode, szps;
1359ee235befSKonstantin Belousov 	char canary[sizeof(long) * 8];
136026f9a767SRodney W. Grimes 
1361ee235befSKonstantin Belousov 	szps = sizeof(pagesizes[0]) * MAXPAGESIZES;
136226f9a767SRodney W. Grimes 	/*
136326f9a767SRodney W. Grimes 	 * Calculate string base and vector table pointers.
1364d66a5066SPeter Wemm 	 * Also deal with signal trampoline code for this exec type.
136526f9a767SRodney W. Grimes 	 */
13663ff06357SKonstantin Belousov 	if (imgp->execpath != NULL && imgp->auxargs != NULL)
13673ff06357SKonstantin Belousov 		execpath_len = strlen(imgp->execpath) + 1;
13683ff06357SKonstantin Belousov 	else
13693ff06357SKonstantin Belousov 		execpath_len = 0;
1370f3bec5d7SJake Burkholder 	p = imgp->proc;
1371f3bec5d7SJake Burkholder 	szsigcode = 0;
137205ba50f5SJake Burkholder 	arginfo = (struct ps_strings *)p->p_sysent->sv_psstrings;
13736297a3d8SKonstantin Belousov 	if (p->p_sysent->sv_sigcode_base == 0) {
1374f3bec5d7SJake Burkholder 		if (p->p_sysent->sv_szsigcode != NULL)
1375f3bec5d7SJake Burkholder 			szsigcode = *(p->p_sysent->sv_szsigcode);
13766297a3d8SKonstantin Belousov 	}
137788b124ceSKonstantin Belousov 	destp =	(uintptr_t)arginfo;
13781ed012f9SPeter Wemm 
137926f9a767SRodney W. Grimes 	/*
1380d66a5066SPeter Wemm 	 * install sigcode
1381d66a5066SPeter Wemm 	 */
138288b124ceSKonstantin Belousov 	if (szsigcode != 0) {
138388b124ceSKonstantin Belousov 		destp -= szsigcode;
138488b124ceSKonstantin Belousov 		destp = rounddown2(destp, sizeof(void *));
138588b124ceSKonstantin Belousov 		copyout(p->p_sysent->sv_sigcode, (void *)destp, szsigcode);
138688b124ceSKonstantin Belousov 	}
1387d66a5066SPeter Wemm 
1388d66a5066SPeter Wemm 	/*
13893ff06357SKonstantin Belousov 	 * Copy the image path for the rtld.
13903ff06357SKonstantin Belousov 	 */
13913ff06357SKonstantin Belousov 	if (execpath_len != 0) {
139288b124ceSKonstantin Belousov 		destp -= execpath_len;
139388b124ceSKonstantin Belousov 		imgp->execpathp = destp;
139488b124ceSKonstantin Belousov 		copyout(imgp->execpath, (void *)destp, execpath_len);
13953ff06357SKonstantin Belousov 	}
13963ff06357SKonstantin Belousov 
13973ff06357SKonstantin Belousov 	/*
1398ee235befSKonstantin Belousov 	 * Prepare the canary for SSP.
1399ee235befSKonstantin Belousov 	 */
1400ee235befSKonstantin Belousov 	arc4rand(canary, sizeof(canary), 0);
140188b124ceSKonstantin Belousov 	destp -= sizeof(canary);
140288b124ceSKonstantin Belousov 	imgp->canary = destp;
140388b124ceSKonstantin Belousov 	copyout(canary, (void *)destp, sizeof(canary));
1404ee235befSKonstantin Belousov 	imgp->canarylen = sizeof(canary);
1405ee235befSKonstantin Belousov 
1406ee235befSKonstantin Belousov 	/*
1407ee235befSKonstantin Belousov 	 * Prepare the pagesizes array.
1408ee235befSKonstantin Belousov 	 */
140988b124ceSKonstantin Belousov 	destp -= szps;
141088b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
141188b124ceSKonstantin Belousov 	imgp->pagesizes = destp;
141288b124ceSKonstantin Belousov 	copyout(pagesizes, (void *)destp, szps);
1413ee235befSKonstantin Belousov 	imgp->pagesizeslen = szps;
1414ee235befSKonstantin Belousov 
141588b124ceSKonstantin Belousov 	destp -= ARG_MAX - imgp->args->stringspace;
141688b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
141788b124ceSKonstantin Belousov 
1418ee235befSKonstantin Belousov 	/*
1419e1743d02SSøren Schmidt 	 * If we have a valid auxargs ptr, prepare some room
1420e1743d02SSøren Schmidt 	 * on the stack.
1421e1743d02SSøren Schmidt 	 */
1422b9a22da4STakanori Watanabe 	if (imgp->auxargs) {
1423e1743d02SSøren Schmidt 		/*
1424b9a22da4STakanori Watanabe 		 * 'AT_COUNT*2' is size for the ELF Auxargs data. This is for
1425b9a22da4STakanori Watanabe 		 * lower compatibility.
1426b9a22da4STakanori Watanabe 		 */
1427ca0387efSJake Burkholder 		imgp->auxarg_size = (imgp->auxarg_size) ? imgp->auxarg_size :
1428ca0387efSJake Burkholder 		    (AT_COUNT * 2);
1429b9a22da4STakanori Watanabe 		/*
1430b9a22da4STakanori Watanabe 		 * The '+ 2' is for the null pointers at the end of each of
1431b9a22da4STakanori Watanabe 		 * the arg and env vector sets,and imgp->auxarg_size is room
1432b9a22da4STakanori Watanabe 		 * for argument of Runtime loader.
1433e1743d02SSøren Schmidt 		 */
1434610ecfe0SMaxim Sobolev 		vectp = (char **)(destp - (imgp->args->argc +
1435ee235befSKonstantin Belousov 		    imgp->args->envc + 2 + imgp->auxarg_size)
1436ee235befSKonstantin Belousov 		    * sizeof(char *));
1437610ecfe0SMaxim Sobolev 	} else {
1438e1743d02SSøren Schmidt 		/*
1439b9a22da4STakanori Watanabe 		 * The '+ 2' is for the null pointers at the end of each of
1440b9a22da4STakanori Watanabe 		 * the arg and env vector sets
144126f9a767SRodney W. Grimes 		 */
144288b124ceSKonstantin Belousov 		vectp = (char **)(destp - (imgp->args->argc + imgp->args->envc
144388b124ceSKonstantin Belousov 		    + 2) * sizeof(char *));
1444610ecfe0SMaxim Sobolev 	}
144526f9a767SRodney W. Grimes 
144626f9a767SRodney W. Grimes 	/*
144726f9a767SRodney W. Grimes 	 * vectp also becomes our initial stack base
144826f9a767SRodney W. Grimes 	 */
1449654f6be1SBruce Evans 	stack_base = (register_t *)vectp;
145026f9a767SRodney W. Grimes 
1451610ecfe0SMaxim Sobolev 	stringp = imgp->args->begin_argv;
1452610ecfe0SMaxim Sobolev 	argc = imgp->args->argc;
1453610ecfe0SMaxim Sobolev 	envc = imgp->args->envc;
145426f9a767SRodney W. Grimes 
145593f6448cSDavid Greenman 	/*
14563aed948bSDavid Greenman 	 * Copy out strings - arguments and environment.
145793f6448cSDavid Greenman 	 */
145888b124ceSKonstantin Belousov 	copyout(stringp, (void *)destp, ARG_MAX - imgp->args->stringspace);
145993f6448cSDavid Greenman 
146093f6448cSDavid Greenman 	/*
14613aed948bSDavid Greenman 	 * Fill in "ps_strings" struct for ps, w, etc.
14623aed948bSDavid Greenman 	 */
1463aae0aa45SBruce Evans 	suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp);
1464f4e26adeSNathan Whitehorn 	suword32(&arginfo->ps_nargvstr, argc);
14653aed948bSDavid Greenman 
14663aed948bSDavid Greenman 	/*
14673aed948bSDavid Greenman 	 * Fill in argument portion of vector table.
146893f6448cSDavid Greenman 	 */
146926f9a767SRodney W. Grimes 	for (; argc > 0; --argc) {
1470aae0aa45SBruce Evans 		suword(vectp++, (long)(intptr_t)destp);
14713aed948bSDavid Greenman 		while (*stringp++ != 0)
14723aed948bSDavid Greenman 			destp++;
14733aed948bSDavid Greenman 		destp++;
147426f9a767SRodney W. Grimes 	}
147526f9a767SRodney W. Grimes 
14761a6e52d0SJeroen Ruigrok van der Werven 	/* a null vector table pointer separates the argp's from the envp's */
14776ab46d52SBruce Evans 	suword(vectp++, 0);
147826f9a767SRodney W. Grimes 
1479aae0aa45SBruce Evans 	suword(&arginfo->ps_envstr, (long)(intptr_t)vectp);
1480f4e26adeSNathan Whitehorn 	suword32(&arginfo->ps_nenvstr, envc);
148193f6448cSDavid Greenman 
148293f6448cSDavid Greenman 	/*
14833aed948bSDavid Greenman 	 * Fill in environment portion of vector table.
148493f6448cSDavid Greenman 	 */
148526f9a767SRodney W. Grimes 	for (; envc > 0; --envc) {
1486aae0aa45SBruce Evans 		suword(vectp++, (long)(intptr_t)destp);
14873aed948bSDavid Greenman 		while (*stringp++ != 0)
14883aed948bSDavid Greenman 			destp++;
14893aed948bSDavid Greenman 		destp++;
149026f9a767SRodney W. Grimes 	}
149126f9a767SRodney W. Grimes 
149226f9a767SRodney W. Grimes 	/* end of vector table is a null pointer */
14936ab46d52SBruce Evans 	suword(vectp, 0);
149426f9a767SRodney W. Grimes 
149526f9a767SRodney W. Grimes 	return (stack_base);
149626f9a767SRodney W. Grimes }
149726f9a767SRodney W. Grimes 
149826f9a767SRodney W. Grimes /*
149926f9a767SRodney W. Grimes  * Check permissions of file to execute.
1500cf64863aSRobert Watson  *	Called with imgp->vp locked.
150126f9a767SRodney W. Grimes  *	Return 0 for success or error code on failure.
150226f9a767SRodney W. Grimes  */
1503c8a79999SPeter Wemm int
1504c52007c2SDavid Greenman exec_check_permissions(imgp)
1505c52007c2SDavid Greenman 	struct image_params *imgp;
150626f9a767SRodney W. Grimes {
1507c52007c2SDavid Greenman 	struct vnode *vp = imgp->vp;
1508c52007c2SDavid Greenman 	struct vattr *attr = imgp->attr;
1509a854ed98SJohn Baldwin 	struct thread *td;
1510140dedb8SKonstantin Belousov 	int error, writecount;
151126f9a767SRodney W. Grimes 
15126617724cSJeff Roberson 	td = curthread;
1513339b79b9SRobert Watson 
1514ec35c2afSRobert Watson 	/* Get file attributes */
15150359a12eSAttilio Rao 	error = VOP_GETATTR(vp, attr, td->td_ucred);
1516ec35c2afSRobert Watson 	if (error)
1517ec35c2afSRobert Watson 		return (error);
1518ec35c2afSRobert Watson 
1519339b79b9SRobert Watson #ifdef MAC
152030d239bcSRobert Watson 	error = mac_vnode_check_exec(td->td_ucred, imgp->vp, imgp);
1521339b79b9SRobert Watson 	if (error)
1522339b79b9SRobert Watson 		return (error);
1523339b79b9SRobert Watson #endif
1524339b79b9SRobert Watson 
152526f9a767SRodney W. Grimes 	/*
1526de478dd4SJaakko Heinonen 	 * 1) Check if file execution is disabled for the filesystem that
1527de478dd4SJaakko Heinonen 	 *    this file resides on.
1528de478dd4SJaakko Heinonen 	 * 2) Ensure that at least one execute bit is on. Otherwise, a
1529de478dd4SJaakko Heinonen 	 *    privileged user will always succeed, and we don't want this
1530de478dd4SJaakko Heinonen 	 *    to happen unless the file really is executable.
1531de478dd4SJaakko Heinonen 	 * 3) Ensure that the file is a regular file.
153226f9a767SRodney W. Grimes 	 */
1533c52007c2SDavid Greenman 	if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
1534de478dd4SJaakko Heinonen 	    (attr->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0 ||
1535a854ed98SJohn Baldwin 	    (attr->va_type != VREG))
153626f9a767SRodney W. Grimes 		return (EACCES);
153726f9a767SRodney W. Grimes 
153826f9a767SRodney W. Grimes 	/*
153926f9a767SRodney W. Grimes 	 * Zero length files can't be exec'd
154026f9a767SRodney W. Grimes 	 */
154126f9a767SRodney W. Grimes 	if (attr->va_size == 0)
154226f9a767SRodney W. Grimes 		return (ENOEXEC);
154326f9a767SRodney W. Grimes 
154426f9a767SRodney W. Grimes 	/*
154526f9a767SRodney W. Grimes 	 *  Check for execute permission to file based on current credentials.
154626f9a767SRodney W. Grimes 	 */
1547a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td);
154826f9a767SRodney W. Grimes 	if (error)
154926f9a767SRodney W. Grimes 		return (error);
155026f9a767SRodney W. Grimes 
15516d5a0a8cSDavid Greenman 	/*
15526d5a0a8cSDavid Greenman 	 * Check number of open-for-writes on the file and deny execution
15536d5a0a8cSDavid Greenman 	 * if there are any.
15546d5a0a8cSDavid Greenman 	 */
1555140dedb8SKonstantin Belousov 	error = VOP_GET_WRITECOUNT(vp, &writecount);
1556140dedb8SKonstantin Belousov 	if (error != 0)
1557140dedb8SKonstantin Belousov 		return (error);
1558140dedb8SKonstantin Belousov 	if (writecount != 0)
15596d5a0a8cSDavid Greenman 		return (ETXTBSY);
15606d5a0a8cSDavid Greenman 
15616d5a0a8cSDavid Greenman 	/*
15626d5a0a8cSDavid Greenman 	 * Call filesystem specific open routine (which does nothing in the
15636d5a0a8cSDavid Greenman 	 * general case).
15646d5a0a8cSDavid Greenman 	 */
15659e223287SKonstantin Belousov 	error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL);
15669a75ea23SKonstantin Belousov 	if (error == 0)
15679a75ea23SKonstantin Belousov 		imgp->opened = 1;
156826f9a767SRodney W. Grimes 	return (error);
1569df8bae1dSRodney W. Grimes }
1570aa855a59SPeter Wemm 
1571aa855a59SPeter Wemm /*
1572aa855a59SPeter Wemm  * Exec handler registration
1573aa855a59SPeter Wemm  */
1574aa855a59SPeter Wemm int
1575aa855a59SPeter Wemm exec_register(execsw_arg)
1576aa855a59SPeter Wemm 	const struct execsw *execsw_arg;
1577aa855a59SPeter Wemm {
1578aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1579aa855a59SPeter Wemm 	int count = 2;	/* New slot and trailing NULL */
1580aa855a59SPeter Wemm 
1581aa855a59SPeter Wemm 	if (execsw)
1582aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1583aa855a59SPeter Wemm 			count++;
1584a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1585aa855a59SPeter Wemm 	xs = newexecsw;
1586aa855a59SPeter Wemm 	if (execsw)
1587aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1588aa855a59SPeter Wemm 			*xs++ = *es;
1589aa855a59SPeter Wemm 	*xs++ = execsw_arg;
1590aa855a59SPeter Wemm 	*xs = NULL;
1591aa855a59SPeter Wemm 	if (execsw)
1592aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1593aa855a59SPeter Wemm 	execsw = newexecsw;
1594a7cddfedSJake Burkholder 	return (0);
1595aa855a59SPeter Wemm }
1596aa855a59SPeter Wemm 
1597aa855a59SPeter Wemm int
1598aa855a59SPeter Wemm exec_unregister(execsw_arg)
1599aa855a59SPeter Wemm 	const struct execsw *execsw_arg;
1600aa855a59SPeter Wemm {
1601aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1602aa855a59SPeter Wemm 	int count = 1;
1603aa855a59SPeter Wemm 
1604aa855a59SPeter Wemm 	if (execsw == NULL)
1605aa855a59SPeter Wemm 		panic("unregister with no handlers left?\n");
1606aa855a59SPeter Wemm 
1607aa855a59SPeter Wemm 	for (es = execsw; *es; es++) {
1608aa855a59SPeter Wemm 		if (*es == execsw_arg)
1609aa855a59SPeter Wemm 			break;
1610aa855a59SPeter Wemm 	}
1611aa855a59SPeter Wemm 	if (*es == NULL)
1612a7cddfedSJake Burkholder 		return (ENOENT);
1613aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1614aa855a59SPeter Wemm 		if (*es != execsw_arg)
1615aa855a59SPeter Wemm 			count++;
1616a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1617aa855a59SPeter Wemm 	xs = newexecsw;
1618aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1619aa855a59SPeter Wemm 		if (*es != execsw_arg)
1620aa855a59SPeter Wemm 			*xs++ = *es;
1621aa855a59SPeter Wemm 	*xs = NULL;
1622aa855a59SPeter Wemm 	if (execsw)
1623aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1624aa855a59SPeter Wemm 	execsw = newexecsw;
1625a7cddfedSJake Burkholder 	return (0);
1626aa855a59SPeter Wemm }
1627