xref: /freebsd/sys/kern/kern_exec.c (revision 17ee9d00bc1ae1e598c38f25826f861e4bc6c3ce) 
1 /*
2  * Copyright (c) 1993, David Greenman
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by David Greenman
16  * 4. The name of the developer may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	$Id: kern_exec.c,v 1.12 1995/02/14 19:22:28 sos Exp $
32  */
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/signalvar.h>
37 #include <sys/resourcevar.h>
38 #include <sys/kernel.h>
39 #include <sys/mount.h>
40 #include <sys/filedesc.h>
41 #include <sys/file.h>
42 #include <sys/acct.h>
43 #include <sys/exec.h>
44 #include <sys/imgact.h>
45 #include <sys/stat.h>
46 #include <sys/wait.h>
47 #include <sys/mman.h>
48 #include <sys/malloc.h>
49 #include <sys/sysent.h>
50 #include <sys/syslog.h>
51 #include <sys/shm.h>
52 
53 #include <vm/vm.h>
54 #include <vm/vm_kern.h>
55 
56 #include <machine/reg.h>
57 
58 int *exec_copyout_strings __P((struct image_params *));
59 
60 static int exec_check_permissions(struct image_params *);
61 
62 /*
63  * execsw_set is constructed for us by the linker.  Each of the items
64  * is a pointer to a `const struct execsw', hence the double pointer here.
65  */
66 extern const struct linker_set execsw_set;
67 const struct execsw **execsw = (const struct execsw **)&execsw_set.ls_items[0];
68 
69 /*
70  * execve() system call.
71  */
72 int
73 execve(p, uap, retval)
74 	struct proc *p;
75 	register struct execve_args *uap;
76 	int *retval;
77 {
78 	struct nameidata nd, *ndp;
79 	int *stack_base;
80 	int error, len, i;
81 	struct image_params image_params, *iparams;
82 	struct vnode *vnodep;
83 	struct vattr attr;
84 	char *image_header;
85 
86 	iparams = &image_params;
87 	bzero((caddr_t)iparams, sizeof(struct image_params));
88 	image_header = (char *)0;
89 
90 	/*
91 	 * Initialize a few constants in the common area
92 	 */
93 	iparams->proc = p;
94 	iparams->uap = uap;
95 	iparams->attr = &attr;
96 
97 	/*
98 	 * Allocate temporary demand zeroed space for argument and
99 	 *	environment strings
100 	 */
101 	iparams->stringbase = (char *)vm_map_min(exec_map);
102 	error = vm_map_find(exec_map, NULL, 0, (vm_offset_t *)&iparams->stringbase,
103 	    ARG_MAX, TRUE);
104 	if (error) {
105 		log(LOG_WARNING, "execve: failed to allocate string space\n");
106 		return (error);
107 	}
108 
109 	if (!iparams->stringbase) {
110 		error = ENOMEM;
111 		goto exec_fail;
112 	}
113 	iparams->stringp = iparams->stringbase;
114 	iparams->stringspace = ARG_MAX;
115 
116 	/*
117 	 * Translate the file name. namei() returns a vnode pointer
118 	 *	in ni_vp amoung other things.
119 	 */
120 	ndp = &nd;
121 	ndp->ni_cnd.cn_nameiop = LOOKUP;
122 	ndp->ni_cnd.cn_flags = LOCKLEAF | FOLLOW | SAVENAME;
123 	ndp->ni_cnd.cn_proc = curproc;
124 	ndp->ni_cnd.cn_cred = curproc->p_cred->pc_ucred;
125 	ndp->ni_segflg = UIO_USERSPACE;
126 	ndp->ni_dirp = uap->fname;
127 
128 interpret:
129 
130 	error = namei(ndp);
131 	if (error) {
132 		vm_map_remove(exec_map, (vm_offset_t)iparams->stringbase,
133 		    (vm_offset_t)iparams->stringbase + ARG_MAX);
134 		goto exec_fail;
135 	}
136 
137 	iparams->vnodep = vnodep = ndp->ni_vp;
138 
139 	if (vnodep == NULL) {
140 		error = ENOEXEC;
141 		goto exec_fail_dealloc;
142 	}
143 
144 	/*
145 	 * Check file permissions (also 'opens' file)
146 	 */
147 	error = exec_check_permissions(iparams);
148 	if (error)
149 		goto exec_fail_dealloc;
150 
151 	/*
152 	 * Map the image header (first page) of the file into
153 	 *	kernel address space
154 	 */
155 	error = vm_mmap(kernel_map,			/* map */
156 			(vm_offset_t *)&image_header,	/* address */
157 			PAGE_SIZE,			/* size */
158 			VM_PROT_READ, 			/* protection */
159 			VM_PROT_READ, 			/* max protection */
160 			0,	 			/* flags */
161 			(caddr_t)vnodep,		/* vnode */
162 			0);				/* offset */
163 	if (error) {
164 		uprintf("mmap failed: %d\n",error);
165 		goto exec_fail_dealloc;
166 	}
167 	iparams->image_header = image_header;
168 
169 	/*
170 	 * Loop through list of image activators, calling each one.
171 	 *	If there is no match, the activator returns -1. If there
172 	 *	is a match, but there was an error during the activation,
173 	 *	the error is returned. Otherwise 0 means success. If the
174 	 *	image is interpreted, loop back up and try activating
175 	 *	the interpreter.
176 	 */
177 	for (i = 0; execsw[i]; ++i) {
178 		if (execsw[i]->ex_imgact)
179 			error = (*execsw[i]->ex_imgact)(iparams);
180 		else
181 			continue;
182 
183 		if (error == -1)
184 			continue;
185 		if (error)
186 			goto exec_fail_dealloc;
187 		if (iparams->interpreted) {
188 			/* free old vnode and name buffer */
189 			vput(ndp->ni_vp);
190 			FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
191 			if (vm_map_remove(kernel_map, (vm_offset_t)image_header,
192 			    (vm_offset_t)image_header + PAGE_SIZE))
193 				panic("execve: header dealloc failed (1)");
194 
195 			/* set new name to that of the interpreter */
196 			ndp->ni_segflg = UIO_SYSSPACE;
197 			ndp->ni_dirp = iparams->interpreter_name;
198 			ndp->ni_cnd.cn_nameiop = LOOKUP;
199 			ndp->ni_cnd.cn_flags = LOCKLEAF | FOLLOW | SAVENAME;
200 			ndp->ni_cnd.cn_proc = curproc;
201 			ndp->ni_cnd.cn_cred = curproc->p_cred->pc_ucred;
202 			goto interpret;
203 		}
204 		break;
205 	}
206 	/* If we made it through all the activators and none matched, exit. */
207 	if (error == -1) {
208 		error = ENOEXEC;
209 		goto exec_fail_dealloc;
210 	}
211 
212 	/*
213 	 * Copy out strings (args and env) and initialize stack base
214 	 */
215 	stack_base = exec_copyout_strings(iparams);
216 	p->p_vmspace->vm_minsaddr = (char *)stack_base;
217 
218 	/*
219 	 * If custom stack fixup routine present for this process
220 	 * let it do the stack setup.
221 	 * Else stuff argument count as first item on stack
222 	 */
223 	if (p->p_sysent->sv_fixup)
224 		(*p->p_sysent->sv_fixup)(&stack_base, iparams);
225 	else
226 		*(--stack_base) = iparams->argc;
227 
228 	/* close files on exec */
229 	fdcloseexec(p);
230 
231 	/* reset caught signals */
232 	execsigs(p);
233 
234 	/* name this process - nameiexec(p, ndp) */
235 	len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN);
236 	bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len);
237 	p->p_comm[len] = 0;
238 
239 	/*
240 	 * mark as executable, wakeup any process that was vforked and tell
241 	 * it that it now has it's own resources back
242 	 */
243 	p->p_flag |= P_EXEC;
244 	if (p->p_pptr && (p->p_flag & P_PPWAIT)) {
245 		p->p_flag &= ~P_PPWAIT;
246 		wakeup((caddr_t)p->p_pptr);
247 	}
248 
249 	/* implement set userid/groupid */
250 	p->p_flag &= ~P_SUGID;
251 
252 	/*
253 	 * Turn off kernel tracing for set-id programs, except for
254 	 * root.
255 	 */
256 	if (p->p_tracep && (attr.va_mode & (VSUID | VSGID)) &&
257 	    suser(p->p_ucred, &p->p_acflag)) {
258 		p->p_traceflag = 0;
259 		vrele(p->p_tracep);
260 		p->p_tracep = 0;
261 	}
262 	if ((attr.va_mode & VSUID) && (p->p_flag & P_TRACED) == 0) {
263 		p->p_ucred = crcopy(p->p_ucred);
264 		p->p_ucred->cr_uid = attr.va_uid;
265 		p->p_flag |= P_SUGID;
266 	}
267 	if ((attr.va_mode & VSGID) && (p->p_flag & P_TRACED) == 0) {
268 		p->p_ucred = crcopy(p->p_ucred);
269 		p->p_ucred->cr_groups[0] = attr.va_gid;
270 		p->p_flag |= P_SUGID;
271 	}
272 
273 	/*
274 	 * Implement correct POSIX saved uid behavior.
275 	 */
276 	p->p_cred->p_svuid = p->p_ucred->cr_uid;
277 	p->p_cred->p_svgid = p->p_ucred->cr_gid;
278 
279 	/* mark vnode pure text */
280  	ndp->ni_vp->v_flag |= VTEXT;
281 
282 	/*
283 	 * Store the vp for use in procfs
284 	 */
285 	if (p->p_textvp)		/* release old reference */
286 		vrele(p->p_textvp);
287 	VREF(ndp->ni_vp);
288 	p->p_textvp = ndp->ni_vp;
289 
290 	/*
291 	 * If tracing the process, trap to debugger so breakpoints
292 	 * 	can be set before the program executes.
293 	 */
294 	if (p->p_flag & P_TRACED)
295 		psignal(p, SIGTRAP);
296 
297 	/* clear "fork but no exec" flag, as we _are_ execing */
298 	p->p_acflag &= ~AFORK;
299 
300 	/* Set entry address */
301 	setregs(p, iparams->entry_addr, (u_long)stack_base);
302 
303 	/*
304 	 * free various allocated resources
305 	 */
306 	if (vm_map_remove(exec_map, (vm_offset_t)iparams->stringbase,
307 	    (vm_offset_t)iparams->stringbase + ARG_MAX))
308 		panic("execve: string buffer dealloc failed (1)");
309 	if (vm_map_remove(kernel_map, (vm_offset_t)image_header,
310 	    (vm_offset_t)image_header + PAGE_SIZE))
311 		panic("execve: header dealloc failed (2)");
312 	vput(ndp->ni_vp);
313 	FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
314 
315 	return (0);
316 
317 exec_fail_dealloc:
318 	if (iparams->stringbase && iparams->stringbase != (char *)-1)
319 		if (vm_map_remove(exec_map, (vm_offset_t)iparams->stringbase,
320 		    (vm_offset_t)iparams->stringbase + ARG_MAX))
321 			panic("execve: string buffer dealloc failed (2)");
322 	if (iparams->image_header && iparams->image_header != (char *)-1)
323 		if (vm_map_remove(kernel_map, (vm_offset_t)image_header,
324 		    (vm_offset_t)image_header + PAGE_SIZE))
325 			panic("execve: header dealloc failed (3)");
326 	vput(ndp->ni_vp);
327 	FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
328 
329 exec_fail:
330 	if (iparams->vmspace_destroyed) {
331 		/* sorry, no more process anymore. exit gracefully */
332 		exit1(p, W_EXITCODE(0, SIGABRT));
333 		/* NOT REACHED */
334 		return(0);
335 	} else {
336 		return(error);
337 	}
338 }
339 
340 /*
341  * Destroy old address space, and allocate a new stack
342  *	The new stack is only SGROWSIZ large because it is grown
343  *	automatically in trap.c.
344  */
345 int
346 exec_new_vmspace(iparams)
347 	struct image_params *iparams;
348 {
349 	int error;
350 	struct vmspace *vmspace = iparams->proc->p_vmspace;
351 	caddr_t	stack_addr = (caddr_t) (USRSTACK - SGROWSIZ);
352 
353 	iparams->vmspace_destroyed = 1;
354 
355 	/* Blow away entire process VM */
356 #ifdef SYSVSHM
357 	if (vmspace->vm_shm)
358 		shmexit(iparams->proc);
359 #endif
360 	vm_map_remove(&vmspace->vm_map, 0, USRSTACK);
361 
362 	/* Allocate a new stack */
363 	error = vm_map_find(&vmspace->vm_map, NULL, 0, (vm_offset_t *)&stack_addr,
364 	    SGROWSIZ, FALSE);
365 	if (error)
366 		return(error);
367 
368 	vmspace->vm_ssize = SGROWSIZ >> PAGE_SHIFT;
369 
370 	/* Initialize maximum stack address */
371 	vmspace->vm_maxsaddr = (char *)USRSTACK - MAXSSIZ;
372 
373 	return(0);
374 }
375 
376 /*
377  * Copy out argument and environment strings from the old process
378  *	address space into the temporary string buffer.
379  */
380 int
381 exec_extract_strings(iparams)
382 	struct image_params *iparams;
383 {
384 	char	**argv, **envv;
385 	char	*argp, *envp;
386 	int	error, length;
387 
388 	/*
389 	 * extract arguments first
390 	 */
391 
392 	argv = iparams->uap->argv;
393 
394 	if (argv) {
395 		while ((argp = (caddr_t) fuword(argv++))) {
396 			if (argp == (caddr_t) -1)
397 				return (EFAULT);
398 			if ((error = copyinstr(argp, iparams->stringp,
399 			    iparams->stringspace, &length))) {
400 				if (error == ENAMETOOLONG)
401 					return(E2BIG);
402 				return (error);
403 			}
404 			iparams->stringspace -= length;
405 			iparams->stringp += length;
406 			iparams->argc++;
407 		}
408 	}
409 
410 	/*
411 	 * extract environment strings
412 	 */
413 
414 	envv = iparams->uap->envv;
415 
416 	if (envv) {
417 		while ((envp = (caddr_t) fuword(envv++))) {
418 			if (envp == (caddr_t) -1)
419 				return (EFAULT);
420 			if ((error = copyinstr(envp, iparams->stringp,
421 			    iparams->stringspace, &length))) {
422 				if (error == ENAMETOOLONG)
423 					return(E2BIG);
424 				return (error);
425 			}
426 			iparams->stringspace -= length;
427 			iparams->stringp += length;
428 			iparams->envc++;
429 		}
430 	}
431 
432 	return (0);
433 }
434 
435 /*
436  * Copy strings out to the new process address space, constructing
437  *	new arg and env vector tables. Return a pointer to the base
438  *	so that it can be used as the initial stack pointer.
439  */
440 int *
441 exec_copyout_strings(iparams)
442 	struct image_params *iparams;
443 {
444 	int argc, envc;
445 	char **vectp;
446 	char *stringp, *destp;
447 	int *stack_base;
448 	struct ps_strings *arginfo;
449 
450 	/*
451 	 * Calculate string base and vector table pointers.
452 	 */
453 	arginfo = PS_STRINGS;
454 	destp =	(caddr_t)arginfo - roundup((ARG_MAX - iparams->stringspace), sizeof(char *));
455 	/*
456 	 * The '+ 2' is for the null pointers at the end of each of the
457 	 *	arg and	env vector sets
458 	 */
459 	vectp = (char **) (destp -
460 		(iparams->argc + iparams->envc + 2) * sizeof(char *));
461 
462 	/*
463 	 * vectp also becomes our initial stack base
464 	 */
465 	stack_base = (int *)vectp;
466 
467 	stringp = iparams->stringbase;
468 	argc = iparams->argc;
469 	envc = iparams->envc;
470 
471 	/*
472 	 * Fill in "ps_strings" struct for ps, w, etc.
473 	 */
474 	arginfo->ps_argvstr = destp;
475 	arginfo->ps_nargvstr = argc;
476 
477 	/*
478 	 * Copy the arg strings and fill in vector table as we go.
479 	 */
480 	for (; argc > 0; --argc) {
481 		*(vectp++) = destp;
482 		while ((*destp++ = *stringp++));
483 	}
484 
485 	/* a null vector table pointer seperates the argp's from the envp's */
486 	*(vectp++) = NULL;
487 
488 	arginfo->ps_envstr = destp;
489 	arginfo->ps_nenvstr = envc;
490 
491 	/*
492 	 * Copy the env strings and fill in vector table as we go.
493 	 */
494 	for (; envc > 0; --envc) {
495 		*(vectp++) = destp;
496 		while ((*destp++ = *stringp++));
497 	}
498 
499 	/* end of vector table is a null pointer */
500 	*vectp = NULL;
501 
502 	return (stack_base);
503 }
504 
505 /*
506  * Check permissions of file to execute.
507  *	Return 0 for success or error code on failure.
508  */
509 static int
510 exec_check_permissions(iparams)
511 	struct image_params *iparams;
512 {
513 	struct proc *p = iparams->proc;
514 	struct vnode *vnodep = iparams->vnodep;
515 	struct vattr *attr = iparams->attr;
516 	int error;
517 
518 	/*
519 	 * Check number of open-for-writes on the file and deny execution
520 	 *	if there are any.
521 	 */
522 	if (vnodep->v_writecount) {
523 		return (ETXTBSY);
524 	}
525 
526 	/* Get file attributes */
527 	error = VOP_GETATTR(vnodep, attr, p->p_ucred, p);
528 	if (error)
529 		return (error);
530 
531 	/*
532 	 * 1) Check if file execution is disabled for the filesystem that this
533 	 *	file resides on.
534 	 * 2) Insure that at least one execute bit is on - otherwise root
535 	 *	will always succeed, and we don't want to happen unless the
536 	 *	file really is executable.
537 	 * 3) Insure that the file is a regular file.
538 	 */
539 	if ((vnodep->v_mount->mnt_flag & MNT_NOEXEC) ||
540 	    ((attr->va_mode & 0111) == 0) ||
541 	    (attr->va_type != VREG)) {
542 		return (EACCES);
543 	}
544 
545 	/*
546 	 * Zero length files can't be exec'd
547 	 */
548 	if (attr->va_size == 0)
549 		return (ENOEXEC);
550 
551 	/*
552 	 * Disable setuid/setgid if the filesystem prohibits it or if
553 	 *	the process is being traced.
554 	 */
555         if ((vnodep->v_mount->mnt_flag & MNT_NOSUID) || (p->p_flag & P_TRACED))
556 		attr->va_mode &= ~(VSUID | VSGID);
557 
558 	/*
559 	 *  Check for execute permission to file based on current credentials.
560 	 *	Then call filesystem specific open routine (which does nothing
561 	 *	in the general case).
562 	 */
563 	error = VOP_ACCESS(vnodep, VEXEC, p->p_ucred, p);
564 	if (error)
565 		return (error);
566 
567 	error = VOP_OPEN(vnodep, FREAD, p->p_ucred, p);
568 	if (error)
569 		return (error);
570 
571 	return (0);
572 }
573