xref: /freebsd/sys/kern/kern_exec.c (revision 907b59d76938e654f0d040a888e8dfca3de1e222)
1 /*-
2  * Copyright (c) 1993, David Greenman
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include "opt_capsicum.h"
31 #include "opt_hwpmc_hooks.h"
32 #include "opt_ktrace.h"
33 #include "opt_vm.h"
34 
35 #include <sys/param.h>
36 #include <sys/capsicum.h>
37 #include <sys/systm.h>
38 #include <sys/eventhandler.h>
39 #include <sys/lock.h>
40 #include <sys/mutex.h>
41 #include <sys/sysproto.h>
42 #include <sys/signalvar.h>
43 #include <sys/kernel.h>
44 #include <sys/mount.h>
45 #include <sys/filedesc.h>
46 #include <sys/fcntl.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/imgact.h>
50 #include <sys/imgact_elf.h>
51 #include <sys/wait.h>
52 #include <sys/malloc.h>
53 #include <sys/priv.h>
54 #include <sys/proc.h>
55 #include <sys/pioctl.h>
56 #include <sys/ptrace.h>
57 #include <sys/namei.h>
58 #include <sys/resourcevar.h>
59 #include <sys/rwlock.h>
60 #include <sys/sched.h>
61 #include <sys/sdt.h>
62 #include <sys/sf_buf.h>
63 #include <sys/syscallsubr.h>
64 #include <sys/sysent.h>
65 #include <sys/shm.h>
66 #include <sys/sysctl.h>
67 #include <sys/vnode.h>
68 #include <sys/stat.h>
69 #ifdef KTRACE
70 #include <sys/ktrace.h>
71 #endif
72 
73 #include <vm/vm.h>
74 #include <vm/vm_param.h>
75 #include <vm/pmap.h>
76 #include <vm/vm_page.h>
77 #include <vm/vm_map.h>
78 #include <vm/vm_kern.h>
79 #include <vm/vm_extern.h>
80 #include <vm/vm_object.h>
81 #include <vm/vm_pager.h>
82 
83 #ifdef	HWPMC_HOOKS
84 #include <sys/pmckern.h>
85 #endif
86 
87 #include <machine/reg.h>
88 
89 #include <security/audit/audit.h>
90 #include <security/mac/mac_framework.h>
91 
92 #ifdef KDTRACE_HOOKS
93 #include <sys/dtrace_bsd.h>
94 dtrace_execexit_func_t	dtrace_fasttrap_exec;
95 #endif
96 
97 SDT_PROVIDER_DECLARE(proc);
98 SDT_PROBE_DEFINE1(proc, , , exec, "char *");
99 SDT_PROBE_DEFINE1(proc, , , exec__failure, "int");
100 SDT_PROBE_DEFINE1(proc, , , exec__success, "char *");
101 
102 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
103 
104 int coredump_pack_fileinfo = 1;
105 SYSCTL_INT(_kern, OID_AUTO, coredump_pack_fileinfo, CTLFLAG_RWTUN,
106     &coredump_pack_fileinfo, 0,
107     "Enable file path packing in 'procstat -f' coredump notes");
108 
109 int coredump_pack_vmmapinfo = 1;
110 SYSCTL_INT(_kern, OID_AUTO, coredump_pack_vmmapinfo, CTLFLAG_RWTUN,
111     &coredump_pack_vmmapinfo, 0,
112     "Enable file path packing in 'procstat -v' coredump notes");
113 
114 static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS);
115 static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS);
116 static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS);
117 static int do_execve(struct thread *td, struct image_args *args,
118     struct mac *mac_p);
119 
120 /* XXX This should be vm_size_t. */
121 SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD,
122     NULL, 0, sysctl_kern_ps_strings, "LU", "");
123 
124 /* XXX This should be vm_size_t. */
125 SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD|
126     CTLFLAG_CAPRD, NULL, 0, sysctl_kern_usrstack, "LU", "");
127 
128 SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD,
129     NULL, 0, sysctl_kern_stackprot, "I", "");
130 
131 u_long ps_arg_cache_limit = PAGE_SIZE / 16;
132 SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
133     &ps_arg_cache_limit, 0, "");
134 
135 static int disallow_high_osrel;
136 SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW,
137     &disallow_high_osrel, 0,
138     "Disallow execution of binaries built for higher version of the world");
139 
140 static int map_at_zero = 0;
141 SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RWTUN, &map_at_zero, 0,
142     "Permit processes to map an object at virtual address 0.");
143 
144 static int
145 sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
146 {
147 	struct proc *p;
148 	int error;
149 
150 	p = curproc;
151 #ifdef SCTL_MASK32
152 	if (req->flags & SCTL_MASK32) {
153 		unsigned int val;
154 		val = (unsigned int)p->p_sysent->sv_psstrings;
155 		error = SYSCTL_OUT(req, &val, sizeof(val));
156 	} else
157 #endif
158 		error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings,
159 		   sizeof(p->p_sysent->sv_psstrings));
160 	return error;
161 }
162 
163 static int
164 sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS)
165 {
166 	struct proc *p;
167 	int error;
168 
169 	p = curproc;
170 #ifdef SCTL_MASK32
171 	if (req->flags & SCTL_MASK32) {
172 		unsigned int val;
173 		val = (unsigned int)p->p_sysent->sv_usrstack;
174 		error = SYSCTL_OUT(req, &val, sizeof(val));
175 	} else
176 #endif
177 		error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack,
178 		    sizeof(p->p_sysent->sv_usrstack));
179 	return error;
180 }
181 
182 static int
183 sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS)
184 {
185 	struct proc *p;
186 
187 	p = curproc;
188 	return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot,
189 	    sizeof(p->p_sysent->sv_stackprot)));
190 }
191 
192 /*
193  * Each of the items is a pointer to a `const struct execsw', hence the
194  * double pointer here.
195  */
196 static const struct execsw **execsw;
197 
198 #ifndef _SYS_SYSPROTO_H_
199 struct execve_args {
200 	char    *fname;
201 	char    **argv;
202 	char    **envv;
203 };
204 #endif
205 
206 int
207 sys_execve(struct thread *td, struct execve_args *uap)
208 {
209 	struct image_args args;
210 	struct vmspace *oldvmspace;
211 	int error;
212 
213 	error = pre_execve(td, &oldvmspace);
214 	if (error != 0)
215 		return (error);
216 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
217 	    uap->argv, uap->envv);
218 	if (error == 0)
219 		error = kern_execve(td, &args, NULL);
220 	post_execve(td, error, oldvmspace);
221 	return (error);
222 }
223 
224 #ifndef _SYS_SYSPROTO_H_
225 struct fexecve_args {
226 	int	fd;
227 	char	**argv;
228 	char	**envv;
229 }
230 #endif
231 int
232 sys_fexecve(struct thread *td, struct fexecve_args *uap)
233 {
234 	struct image_args args;
235 	struct vmspace *oldvmspace;
236 	int error;
237 
238 	error = pre_execve(td, &oldvmspace);
239 	if (error != 0)
240 		return (error);
241 	error = exec_copyin_args(&args, NULL, UIO_SYSSPACE,
242 	    uap->argv, uap->envv);
243 	if (error == 0) {
244 		args.fd = uap->fd;
245 		error = kern_execve(td, &args, NULL);
246 	}
247 	post_execve(td, error, oldvmspace);
248 	return (error);
249 }
250 
251 #ifndef _SYS_SYSPROTO_H_
252 struct __mac_execve_args {
253 	char	*fname;
254 	char	**argv;
255 	char	**envv;
256 	struct mac	*mac_p;
257 };
258 #endif
259 
260 int
261 sys___mac_execve(struct thread *td, struct __mac_execve_args *uap)
262 {
263 #ifdef MAC
264 	struct image_args args;
265 	struct vmspace *oldvmspace;
266 	int error;
267 
268 	error = pre_execve(td, &oldvmspace);
269 	if (error != 0)
270 		return (error);
271 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
272 	    uap->argv, uap->envv);
273 	if (error == 0)
274 		error = kern_execve(td, &args, uap->mac_p);
275 	post_execve(td, error, oldvmspace);
276 	return (error);
277 #else
278 	return (ENOSYS);
279 #endif
280 }
281 
282 int
283 pre_execve(struct thread *td, struct vmspace **oldvmspace)
284 {
285 	struct proc *p;
286 	int error;
287 
288 	KASSERT(td == curthread, ("non-current thread %p", td));
289 	error = 0;
290 	p = td->td_proc;
291 	if ((p->p_flag & P_HADTHREADS) != 0) {
292 		PROC_LOCK(p);
293 		if (thread_single(p, SINGLE_BOUNDARY) != 0)
294 			error = ERESTART;
295 		PROC_UNLOCK(p);
296 	}
297 	KASSERT(error != 0 || (td->td_pflags & TDP_EXECVMSPC) == 0,
298 	    ("nested execve"));
299 	*oldvmspace = p->p_vmspace;
300 	return (error);
301 }
302 
303 void
304 post_execve(struct thread *td, int error, struct vmspace *oldvmspace)
305 {
306 	struct proc *p;
307 
308 	KASSERT(td == curthread, ("non-current thread %p", td));
309 	p = td->td_proc;
310 	if ((p->p_flag & P_HADTHREADS) != 0) {
311 		PROC_LOCK(p);
312 		/*
313 		 * If success, we upgrade to SINGLE_EXIT state to
314 		 * force other threads to suicide.
315 		 */
316 		if (error == 0)
317 			thread_single(p, SINGLE_EXIT);
318 		else
319 			thread_single_end(p, SINGLE_BOUNDARY);
320 		PROC_UNLOCK(p);
321 	}
322 	if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
323 		KASSERT(p->p_vmspace != oldvmspace,
324 		    ("oldvmspace still used"));
325 		vmspace_free(oldvmspace);
326 		td->td_pflags &= ~TDP_EXECVMSPC;
327 	}
328 }
329 
330 /*
331  * XXX: kern_execve has the astonishing property of not always returning to
332  * the caller.  If sufficiently bad things happen during the call to
333  * do_execve(), it can end up calling exit1(); as a result, callers must
334  * avoid doing anything which they might need to undo (e.g., allocating
335  * memory).
336  */
337 int
338 kern_execve(struct thread *td, struct image_args *args, struct mac *mac_p)
339 {
340 
341 	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
342 	    args->begin_envv - args->begin_argv);
343 	AUDIT_ARG_ENVV(args->begin_envv, args->envc,
344 	    args->endp - args->begin_envv);
345 	return (do_execve(td, args, mac_p));
346 }
347 
348 /*
349  * In-kernel implementation of execve().  All arguments are assumed to be
350  * userspace pointers from the passed thread.
351  */
352 static int
353 do_execve(td, args, mac_p)
354 	struct thread *td;
355 	struct image_args *args;
356 	struct mac *mac_p;
357 {
358 	struct proc *p = td->td_proc;
359 	struct nameidata nd;
360 	struct ucred *oldcred;
361 	struct uidinfo *euip = NULL;
362 	register_t *stack_base;
363 	int error, i;
364 	struct image_params image_params, *imgp;
365 	struct vattr attr;
366 	int (*img_first)(struct image_params *);
367 	struct pargs *oldargs = NULL, *newargs = NULL;
368 	struct sigacts *oldsigacts = NULL, *newsigacts = NULL;
369 #ifdef KTRACE
370 	struct vnode *tracevp = NULL;
371 	struct ucred *tracecred = NULL;
372 #endif
373 	struct vnode *oldtextvp = NULL, *newtextvp;
374 	cap_rights_t rights;
375 	int credential_changing;
376 	int textset;
377 #ifdef MAC
378 	struct label *interpvplabel = NULL;
379 	int will_transition;
380 #endif
381 #ifdef HWPMC_HOOKS
382 	struct pmckern_procexec pe;
383 #endif
384 	static const char fexecv_proc_title[] = "(fexecv)";
385 
386 	imgp = &image_params;
387 
388 	/*
389 	 * Lock the process and set the P_INEXEC flag to indicate that
390 	 * it should be left alone until we're done here.  This is
391 	 * necessary to avoid race conditions - e.g. in ptrace() -
392 	 * that might allow a local user to illicitly obtain elevated
393 	 * privileges.
394 	 */
395 	PROC_LOCK(p);
396 	KASSERT((p->p_flag & P_INEXEC) == 0,
397 	    ("%s(): process already has P_INEXEC flag", __func__));
398 	p->p_flag |= P_INEXEC;
399 	PROC_UNLOCK(p);
400 
401 	/*
402 	 * Initialize part of the common data
403 	 */
404 	bzero(imgp, sizeof(*imgp));
405 	imgp->proc = p;
406 	imgp->attr = &attr;
407 	imgp->args = args;
408 	oldcred = p->p_ucred;
409 
410 #ifdef MAC
411 	error = mac_execve_enter(imgp, mac_p);
412 	if (error)
413 		goto exec_fail;
414 #endif
415 
416 	/*
417 	 * Translate the file name. namei() returns a vnode pointer
418 	 *	in ni_vp among other things.
419 	 *
420 	 * XXXAUDIT: It would be desirable to also audit the name of the
421 	 * interpreter if this is an interpreted binary.
422 	 */
423 	if (args->fname != NULL) {
424 		NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME
425 		    | AUDITVNODE1, UIO_SYSSPACE, args->fname, td);
426 	}
427 
428 	SDT_PROBE1(proc, , , exec, args->fname);
429 
430 interpret:
431 	if (args->fname != NULL) {
432 #ifdef CAPABILITY_MODE
433 		/*
434 		 * While capability mode can't reach this point via direct
435 		 * path arguments to execve(), we also don't allow
436 		 * interpreters to be used in capability mode (for now).
437 		 * Catch indirect lookups and return a permissions error.
438 		 */
439 		if (IN_CAPABILITY_MODE(td)) {
440 			error = ECAPMODE;
441 			goto exec_fail;
442 		}
443 #endif
444 		error = namei(&nd);
445 		if (error)
446 			goto exec_fail;
447 
448 		newtextvp = nd.ni_vp;
449 		imgp->vp = newtextvp;
450 	} else {
451 		AUDIT_ARG_FD(args->fd);
452 		/*
453 		 * Descriptors opened only with O_EXEC or O_RDONLY are allowed.
454 		 */
455 		error = fgetvp_exec(td, args->fd,
456 		    cap_rights_init(&rights, CAP_FEXECVE), &newtextvp);
457 		if (error)
458 			goto exec_fail;
459 		vn_lock(newtextvp, LK_EXCLUSIVE | LK_RETRY);
460 		AUDIT_ARG_VNODE1(newtextvp);
461 		imgp->vp = newtextvp;
462 	}
463 
464 	/*
465 	 * Check file permissions (also 'opens' file)
466 	 */
467 	error = exec_check_permissions(imgp);
468 	if (error)
469 		goto exec_fail_dealloc;
470 
471 	imgp->object = imgp->vp->v_object;
472 	if (imgp->object != NULL)
473 		vm_object_reference(imgp->object);
474 
475 	/*
476 	 * Set VV_TEXT now so no one can write to the executable while we're
477 	 * activating it.
478 	 *
479 	 * Remember if this was set before and unset it in case this is not
480 	 * actually an executable image.
481 	 */
482 	textset = VOP_IS_TEXT(imgp->vp);
483 	VOP_SET_TEXT(imgp->vp);
484 
485 	error = exec_map_first_page(imgp);
486 	if (error)
487 		goto exec_fail_dealloc;
488 
489 	imgp->proc->p_osrel = 0;
490 
491 	/*
492 	 * Implement image setuid/setgid.
493 	 *
494 	 * Determine new credentials before attempting image activators
495 	 * so that it can be used by process_exec handlers to determine
496 	 * credential/setid changes.
497 	 *
498 	 * Don't honor setuid/setgid if the filesystem prohibits it or if
499 	 * the process is being traced.
500 	 *
501 	 * We disable setuid/setgid/etc in capability mode on the basis
502 	 * that most setugid applications are not written with that
503 	 * environment in mind, and will therefore almost certainly operate
504 	 * incorrectly. In principle there's no reason that setugid
505 	 * applications might not be useful in capability mode, so we may want
506 	 * to reconsider this conservative design choice in the future.
507 	 *
508 	 * XXXMAC: For the time being, use NOSUID to also prohibit
509 	 * transitions on the file system.
510 	 */
511 	credential_changing = 0;
512 	credential_changing |= (attr.va_mode & S_ISUID) &&
513 	    oldcred->cr_uid != attr.va_uid;
514 	credential_changing |= (attr.va_mode & S_ISGID) &&
515 	    oldcred->cr_gid != attr.va_gid;
516 #ifdef MAC
517 	will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp,
518 	    interpvplabel, imgp);
519 	credential_changing |= will_transition;
520 #endif
521 
522 	if (credential_changing &&
523 #ifdef CAPABILITY_MODE
524 	    ((oldcred->cr_flags & CRED_FLAG_CAPMODE) == 0) &&
525 #endif
526 	    (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
527 	    (p->p_flag & P_TRACED) == 0) {
528 		imgp->credential_setid = true;
529 		VOP_UNLOCK(imgp->vp, 0);
530 		imgp->newcred = crdup(oldcred);
531 		if (attr.va_mode & S_ISUID) {
532 			euip = uifind(attr.va_uid);
533 			change_euid(imgp->newcred, euip);
534 		}
535 		vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
536 		if (attr.va_mode & S_ISGID)
537 			change_egid(imgp->newcred, attr.va_gid);
538 		/*
539 		 * Implement correct POSIX saved-id behavior.
540 		 *
541 		 * XXXMAC: Note that the current logic will save the
542 		 * uid and gid if a MAC domain transition occurs, even
543 		 * though maybe it shouldn't.
544 		 */
545 		change_svuid(imgp->newcred, imgp->newcred->cr_uid);
546 		change_svgid(imgp->newcred, imgp->newcred->cr_gid);
547 	} else {
548 		/*
549 		 * Implement correct POSIX saved-id behavior.
550 		 *
551 		 * XXX: It's not clear that the existing behavior is
552 		 * POSIX-compliant.  A number of sources indicate that the
553 		 * saved uid/gid should only be updated if the new ruid is
554 		 * not equal to the old ruid, or the new euid is not equal
555 		 * to the old euid and the new euid is not equal to the old
556 		 * ruid.  The FreeBSD code always updates the saved uid/gid.
557 		 * Also, this code uses the new (replaced) euid and egid as
558 		 * the source, which may or may not be the right ones to use.
559 		 */
560 		if (oldcred->cr_svuid != oldcred->cr_uid ||
561 		    oldcred->cr_svgid != oldcred->cr_gid) {
562 			VOP_UNLOCK(imgp->vp, 0);
563 			imgp->newcred = crdup(oldcred);
564 			vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
565 			change_svuid(imgp->newcred, imgp->newcred->cr_uid);
566 			change_svgid(imgp->newcred, imgp->newcred->cr_gid);
567 		}
568 	}
569 	/* The new credentials are installed into the process later. */
570 
571 	/*
572 	 * Do the best to calculate the full path to the image file.
573 	 */
574 	if (args->fname != NULL && args->fname[0] == '/')
575 		imgp->execpath = args->fname;
576 	else {
577 		VOP_UNLOCK(imgp->vp, 0);
578 		if (vn_fullpath(td, imgp->vp, &imgp->execpath,
579 		    &imgp->freepath) != 0)
580 			imgp->execpath = args->fname;
581 		vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
582 	}
583 
584 	/*
585 	 *	If the current process has a special image activator it
586 	 *	wants to try first, call it.   For example, emulating shell
587 	 *	scripts differently.
588 	 */
589 	error = -1;
590 	if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
591 		error = img_first(imgp);
592 
593 	/*
594 	 *	Loop through the list of image activators, calling each one.
595 	 *	An activator returns -1 if there is no match, 0 on success,
596 	 *	and an error otherwise.
597 	 */
598 	for (i = 0; error == -1 && execsw[i]; ++i) {
599 		if (execsw[i]->ex_imgact == NULL ||
600 		    execsw[i]->ex_imgact == img_first) {
601 			continue;
602 		}
603 		error = (*execsw[i]->ex_imgact)(imgp);
604 	}
605 
606 	if (error) {
607 		if (error == -1) {
608 			if (textset == 0)
609 				VOP_UNSET_TEXT(imgp->vp);
610 			error = ENOEXEC;
611 		}
612 		goto exec_fail_dealloc;
613 	}
614 
615 	/*
616 	 * Special interpreter operation, cleanup and loop up to try to
617 	 * activate the interpreter.
618 	 */
619 	if (imgp->interpreted) {
620 		exec_unmap_first_page(imgp);
621 		/*
622 		 * VV_TEXT needs to be unset for scripts.  There is a short
623 		 * period before we determine that something is a script where
624 		 * VV_TEXT will be set. The vnode lock is held over this
625 		 * entire period so nothing should illegitimately be blocked.
626 		 */
627 		VOP_UNSET_TEXT(imgp->vp);
628 		/* free name buffer and old vnode */
629 		if (args->fname != NULL)
630 			NDFREE(&nd, NDF_ONLY_PNBUF);
631 #ifdef MAC
632 		mac_execve_interpreter_enter(newtextvp, &interpvplabel);
633 #endif
634 		if (imgp->opened) {
635 			VOP_CLOSE(newtextvp, FREAD, td->td_ucred, td);
636 			imgp->opened = 0;
637 		}
638 		vput(newtextvp);
639 		vm_object_deallocate(imgp->object);
640 		imgp->object = NULL;
641 		imgp->credential_setid = false;
642 		if (imgp->newcred != NULL) {
643 			crfree(imgp->newcred);
644 			imgp->newcred = NULL;
645 		}
646 		imgp->execpath = NULL;
647 		free(imgp->freepath, M_TEMP);
648 		imgp->freepath = NULL;
649 		/* set new name to that of the interpreter */
650 		NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
651 		    UIO_SYSSPACE, imgp->interpreter_name, td);
652 		args->fname = imgp->interpreter_name;
653 		goto interpret;
654 	}
655 
656 	/*
657 	 * NB: We unlock the vnode here because it is believed that none
658 	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
659 	 */
660 	VOP_UNLOCK(imgp->vp, 0);
661 
662 	if (disallow_high_osrel &&
663 	    P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) {
664 		error = ENOEXEC;
665 		uprintf("Osrel %d for image %s too high\n", p->p_osrel,
666 		    imgp->execpath != NULL ? imgp->execpath : "<unresolved>");
667 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
668 		goto exec_fail_dealloc;
669 	}
670 
671 	/* ABI enforces the use of Capsicum. Switch into capabilities mode. */
672 	if (SV_PROC_FLAG(p, SV_CAPSICUM))
673 		sys_cap_enter(td, NULL);
674 
675 	/*
676 	 * Copy out strings (args and env) and initialize stack base
677 	 */
678 	if (p->p_sysent->sv_copyout_strings)
679 		stack_base = (*p->p_sysent->sv_copyout_strings)(imgp);
680 	else
681 		stack_base = exec_copyout_strings(imgp);
682 
683 	/*
684 	 * If custom stack fixup routine present for this process
685 	 * let it do the stack setup.
686 	 * Else stuff argument count as first item on stack
687 	 */
688 	if (p->p_sysent->sv_fixup != NULL)
689 		(*p->p_sysent->sv_fixup)(&stack_base, imgp);
690 	else
691 		suword(--stack_base, imgp->args->argc);
692 
693 	if (args->fdp != NULL) {
694 		/* Install a brand new file descriptor table. */
695 		fdinstall_remapped(td, args->fdp);
696 		args->fdp = NULL;
697 	} else {
698 		/*
699 		 * Keep on using the existing file descriptor table. For
700 		 * security and other reasons, the file descriptor table
701 		 * cannot be shared after an exec.
702 		 */
703 		fdunshare(td);
704 		/* close files on exec */
705 		fdcloseexec(td);
706 	}
707 
708 	/*
709 	 * Malloc things before we need locks.
710 	 */
711 	i = imgp->args->begin_envv - imgp->args->begin_argv;
712 	/* Cache arguments if they fit inside our allowance */
713 	if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
714 		newargs = pargs_alloc(i);
715 		bcopy(imgp->args->begin_argv, newargs->ar_args, i);
716 	}
717 
718 	/*
719 	 * For security and other reasons, signal handlers cannot
720 	 * be shared after an exec. The new process gets a copy of the old
721 	 * handlers. In execsigs(), the new process will have its signals
722 	 * reset.
723 	 */
724 	if (sigacts_shared(p->p_sigacts)) {
725 		oldsigacts = p->p_sigacts;
726 		newsigacts = sigacts_alloc();
727 		sigacts_copy(newsigacts, oldsigacts);
728 	}
729 
730 	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
731 
732 	PROC_LOCK(p);
733 	if (oldsigacts)
734 		p->p_sigacts = newsigacts;
735 	/* Stop profiling */
736 	stopprofclock(p);
737 
738 	/* reset caught signals */
739 	execsigs(p);
740 
741 	/* name this process - nameiexec(p, ndp) */
742 	bzero(p->p_comm, sizeof(p->p_comm));
743 	if (args->fname)
744 		bcopy(nd.ni_cnd.cn_nameptr, p->p_comm,
745 		    min(nd.ni_cnd.cn_namelen, MAXCOMLEN));
746 	else if (vn_commname(newtextvp, p->p_comm, sizeof(p->p_comm)) != 0)
747 		bcopy(fexecv_proc_title, p->p_comm, sizeof(fexecv_proc_title));
748 	bcopy(p->p_comm, td->td_name, sizeof(td->td_name));
749 #ifdef KTR
750 	sched_clear_tdname(td);
751 #endif
752 
753 	/*
754 	 * mark as execed, wakeup the process that vforked (if any) and tell
755 	 * it that it now has its own resources back
756 	 */
757 	p->p_flag |= P_EXEC;
758 	if ((p->p_flag2 & P2_NOTRACE_EXEC) == 0)
759 		p->p_flag2 &= ~P2_NOTRACE;
760 	if (p->p_flag & P_PPWAIT) {
761 		p->p_flag &= ~(P_PPWAIT | P_PPTRACE);
762 		cv_broadcast(&p->p_pwait);
763 		/* STOPs are no longer ignored, arrange for AST */
764 		signotify(td);
765 	}
766 
767 	/*
768 	 * Implement image setuid/setgid installation.
769 	 */
770 	if (imgp->credential_setid) {
771 		/*
772 		 * Turn off syscall tracing for set-id programs, except for
773 		 * root.  Record any set-id flags first to make sure that
774 		 * we do not regain any tracing during a possible block.
775 		 */
776 		setsugid(p);
777 
778 #ifdef KTRACE
779 		if (p->p_tracecred != NULL &&
780 		    priv_check_cred(p->p_tracecred, PRIV_DEBUG_DIFFCRED, 0))
781 			ktrprocexec(p, &tracecred, &tracevp);
782 #endif
783 		/*
784 		 * Close any file descriptors 0..2 that reference procfs,
785 		 * then make sure file descriptors 0..2 are in use.
786 		 *
787 		 * Both fdsetugidsafety() and fdcheckstd() may call functions
788 		 * taking sleepable locks, so temporarily drop our locks.
789 		 */
790 		PROC_UNLOCK(p);
791 		VOP_UNLOCK(imgp->vp, 0);
792 		fdsetugidsafety(td);
793 		error = fdcheckstd(td);
794 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
795 		if (error != 0)
796 			goto exec_fail_dealloc;
797 		PROC_LOCK(p);
798 #ifdef MAC
799 		if (will_transition) {
800 			mac_vnode_execve_transition(oldcred, imgp->newcred,
801 			    imgp->vp, interpvplabel, imgp);
802 		}
803 #endif
804 	} else {
805 		if (oldcred->cr_uid == oldcred->cr_ruid &&
806 		    oldcred->cr_gid == oldcred->cr_rgid)
807 			p->p_flag &= ~P_SUGID;
808 	}
809 	/*
810 	 * Set the new credentials.
811 	 */
812 	if (imgp->newcred != NULL) {
813 		proc_set_cred(p, imgp->newcred);
814 		crfree(oldcred);
815 		oldcred = NULL;
816 	}
817 
818 	/*
819 	 * Store the vp for use in procfs.  This vnode was referenced by namei
820 	 * or fgetvp_exec.
821 	 */
822 	oldtextvp = p->p_textvp;
823 	p->p_textvp = newtextvp;
824 
825 #ifdef KDTRACE_HOOKS
826 	/*
827 	 * Tell the DTrace fasttrap provider about the exec if it
828 	 * has declared an interest.
829 	 */
830 	if (dtrace_fasttrap_exec)
831 		dtrace_fasttrap_exec(p);
832 #endif
833 
834 	/*
835 	 * Notify others that we exec'd, and clear the P_INEXEC flag
836 	 * as we're now a bona fide freshly-execed process.
837 	 */
838 	KNOTE_LOCKED(p->p_klist, NOTE_EXEC);
839 	p->p_flag &= ~P_INEXEC;
840 
841 	/* clear "fork but no exec" flag, as we _are_ execing */
842 	p->p_acflag &= ~AFORK;
843 
844 	/*
845 	 * Free any previous argument cache and replace it with
846 	 * the new argument cache, if any.
847 	 */
848 	oldargs = p->p_args;
849 	p->p_args = newargs;
850 	newargs = NULL;
851 
852 #ifdef	HWPMC_HOOKS
853 	/*
854 	 * Check if system-wide sampling is in effect or if the
855 	 * current process is using PMCs.  If so, do exec() time
856 	 * processing.  This processing needs to happen AFTER the
857 	 * P_INEXEC flag is cleared.
858 	 *
859 	 * The proc lock needs to be released before taking the PMC
860 	 * SX.
861 	 */
862 	if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
863 		PROC_UNLOCK(p);
864 		VOP_UNLOCK(imgp->vp, 0);
865 		pe.pm_credentialschanged = credential_changing;
866 		pe.pm_entryaddr = imgp->entry_addr;
867 
868 		PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
869 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
870 	} else
871 		PROC_UNLOCK(p);
872 #else  /* !HWPMC_HOOKS */
873 	PROC_UNLOCK(p);
874 #endif
875 
876 	/* Set values passed into the program in registers. */
877 	if (p->p_sysent->sv_setregs)
878 		(*p->p_sysent->sv_setregs)(td, imgp,
879 		    (u_long)(uintptr_t)stack_base);
880 	else
881 		exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base);
882 
883 	vfs_mark_atime(imgp->vp, td->td_ucred);
884 
885 	SDT_PROBE1(proc, , , exec__success, args->fname);
886 
887 exec_fail_dealloc:
888 	if (imgp->firstpage != NULL)
889 		exec_unmap_first_page(imgp);
890 
891 	if (imgp->vp != NULL) {
892 		if (args->fname)
893 			NDFREE(&nd, NDF_ONLY_PNBUF);
894 		if (imgp->opened)
895 			VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td);
896 		if (error != 0)
897 			vput(imgp->vp);
898 		else
899 			VOP_UNLOCK(imgp->vp, 0);
900 	}
901 
902 	if (imgp->object != NULL)
903 		vm_object_deallocate(imgp->object);
904 
905 	free(imgp->freepath, M_TEMP);
906 
907 	if (error == 0) {
908 		PROC_LOCK(p);
909 		if (p->p_ptevents & PTRACE_EXEC)
910 			td->td_dbgflags |= TDB_EXEC;
911 		PROC_UNLOCK(p);
912 
913 		/*
914 		 * Stop the process here if its stop event mask has
915 		 * the S_EXEC bit set.
916 		 */
917 		STOPEVENT(p, S_EXEC, 0);
918 	} else {
919 exec_fail:
920 		/* we're done here, clear P_INEXEC */
921 		PROC_LOCK(p);
922 		p->p_flag &= ~P_INEXEC;
923 		PROC_UNLOCK(p);
924 
925 		SDT_PROBE1(proc, , , exec__failure, error);
926 	}
927 
928 	if (imgp->newcred != NULL && oldcred != NULL)
929 		crfree(imgp->newcred);
930 
931 #ifdef MAC
932 	mac_execve_exit(imgp);
933 	mac_execve_interpreter_exit(interpvplabel);
934 #endif
935 	exec_free_args(args);
936 
937 	/*
938 	 * Handle deferred decrement of ref counts.
939 	 */
940 	if (oldtextvp != NULL)
941 		vrele(oldtextvp);
942 #ifdef KTRACE
943 	if (tracevp != NULL)
944 		vrele(tracevp);
945 	if (tracecred != NULL)
946 		crfree(tracecred);
947 #endif
948 	pargs_drop(oldargs);
949 	pargs_drop(newargs);
950 	if (oldsigacts != NULL)
951 		sigacts_free(oldsigacts);
952 	if (euip != NULL)
953 		uifree(euip);
954 
955 	if (error && imgp->vmspace_destroyed) {
956 		/* sorry, no more process anymore. exit gracefully */
957 		exit1(td, 0, SIGABRT);
958 		/* NOT REACHED */
959 	}
960 
961 #ifdef KTRACE
962 	if (error == 0)
963 		ktrprocctor(p);
964 #endif
965 
966 	return (error);
967 }
968 
969 int
970 exec_map_first_page(imgp)
971 	struct image_params *imgp;
972 {
973 	int rv, i, after, initial_pagein;
974 	vm_page_t ma[VM_INITIAL_PAGEIN];
975 	vm_object_t object;
976 
977 	if (imgp->firstpage != NULL)
978 		exec_unmap_first_page(imgp);
979 
980 	object = imgp->vp->v_object;
981 	if (object == NULL)
982 		return (EACCES);
983 	VM_OBJECT_WLOCK(object);
984 #if VM_NRESERVLEVEL > 0
985 	vm_object_color(object, 0);
986 #endif
987 	ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL);
988 	if (ma[0]->valid != VM_PAGE_BITS_ALL) {
989 		if (!vm_pager_has_page(object, 0, NULL, &after)) {
990 			vm_page_lock(ma[0]);
991 			vm_page_free(ma[0]);
992 			vm_page_unlock(ma[0]);
993 			vm_page_xunbusy(ma[0]);
994 			VM_OBJECT_WUNLOCK(object);
995 			return (EIO);
996 		}
997 		initial_pagein = min(after, VM_INITIAL_PAGEIN);
998 		KASSERT(initial_pagein <= object->size,
999 		    ("%s: initial_pagein %d object->size %ju",
1000 		    __func__, initial_pagein, (uintmax_t )object->size));
1001 		for (i = 1; i < initial_pagein; i++) {
1002 			if ((ma[i] = vm_page_next(ma[i - 1])) != NULL) {
1003 				if (ma[i]->valid)
1004 					break;
1005 				if (vm_page_tryxbusy(ma[i]))
1006 					break;
1007 			} else {
1008 				ma[i] = vm_page_alloc(object, i,
1009 				    VM_ALLOC_NORMAL | VM_ALLOC_IFNOTCACHED);
1010 				if (ma[i] == NULL)
1011 					break;
1012 			}
1013 		}
1014 		initial_pagein = i;
1015 		rv = vm_pager_get_pages(object, ma, initial_pagein, NULL, NULL);
1016 		if (rv != VM_PAGER_OK) {
1017 			for (i = 0; i < initial_pagein; i++) {
1018 				vm_page_lock(ma[i]);
1019 				vm_page_free(ma[i]);
1020 				vm_page_unlock(ma[i]);
1021 				vm_page_xunbusy(ma[i]);
1022 			}
1023 			VM_OBJECT_WUNLOCK(object);
1024 			return (EIO);
1025 		}
1026 		for (i = 1; i < initial_pagein; i++)
1027 			vm_page_readahead_finish(ma[i]);
1028 	}
1029 	vm_page_xunbusy(ma[0]);
1030 	vm_page_lock(ma[0]);
1031 	vm_page_hold(ma[0]);
1032 	vm_page_activate(ma[0]);
1033 	vm_page_unlock(ma[0]);
1034 	VM_OBJECT_WUNLOCK(object);
1035 
1036 	imgp->firstpage = sf_buf_alloc(ma[0], 0);
1037 	imgp->image_header = (char *)sf_buf_kva(imgp->firstpage);
1038 
1039 	return (0);
1040 }
1041 
1042 void
1043 exec_unmap_first_page(imgp)
1044 	struct image_params *imgp;
1045 {
1046 	vm_page_t m;
1047 
1048 	if (imgp->firstpage != NULL) {
1049 		m = sf_buf_page(imgp->firstpage);
1050 		sf_buf_free(imgp->firstpage);
1051 		imgp->firstpage = NULL;
1052 		vm_page_lock(m);
1053 		vm_page_unhold(m);
1054 		vm_page_unlock(m);
1055 	}
1056 }
1057 
1058 /*
1059  * Destroy old address space, and allocate a new stack
1060  *	The new stack is only SGROWSIZ large because it is grown
1061  *	automatically in trap.c.
1062  */
1063 int
1064 exec_new_vmspace(imgp, sv)
1065 	struct image_params *imgp;
1066 	struct sysentvec *sv;
1067 {
1068 	int error;
1069 	struct proc *p = imgp->proc;
1070 	struct vmspace *vmspace = p->p_vmspace;
1071 	vm_object_t obj;
1072 	struct rlimit rlim_stack;
1073 	vm_offset_t sv_minuser, stack_addr;
1074 	vm_map_t map;
1075 	u_long ssiz;
1076 
1077 	imgp->vmspace_destroyed = 1;
1078 	imgp->sysent = sv;
1079 
1080 	/* May be called with Giant held */
1081 	EVENTHANDLER_INVOKE(process_exec, p, imgp);
1082 
1083 	/*
1084 	 * Blow away entire process VM, if address space not shared,
1085 	 * otherwise, create a new VM space so that other threads are
1086 	 * not disrupted
1087 	 */
1088 	map = &vmspace->vm_map;
1089 	if (map_at_zero)
1090 		sv_minuser = sv->sv_minuser;
1091 	else
1092 		sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
1093 	if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser &&
1094 	    vm_map_max(map) == sv->sv_maxuser) {
1095 		shmexit(vmspace);
1096 		pmap_remove_pages(vmspace_pmap(vmspace));
1097 		vm_map_remove(map, vm_map_min(map), vm_map_max(map));
1098 	} else {
1099 		error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
1100 		if (error)
1101 			return (error);
1102 		vmspace = p->p_vmspace;
1103 		map = &vmspace->vm_map;
1104 	}
1105 
1106 	/* Map a shared page */
1107 	obj = sv->sv_shared_page_obj;
1108 	if (obj != NULL) {
1109 		vm_object_reference(obj);
1110 		error = vm_map_fixed(map, obj, 0,
1111 		    sv->sv_shared_page_base, sv->sv_shared_page_len,
1112 		    VM_PROT_READ | VM_PROT_EXECUTE,
1113 		    VM_PROT_READ | VM_PROT_EXECUTE,
1114 		    MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE);
1115 		if (error) {
1116 			vm_object_deallocate(obj);
1117 			return (error);
1118 		}
1119 	}
1120 
1121 	/* Allocate a new stack */
1122 	if (imgp->stack_sz != 0) {
1123 		ssiz = trunc_page(imgp->stack_sz);
1124 		PROC_LOCK(p);
1125 		lim_rlimit_proc(p, RLIMIT_STACK, &rlim_stack);
1126 		PROC_UNLOCK(p);
1127 		if (ssiz > rlim_stack.rlim_max)
1128 			ssiz = rlim_stack.rlim_max;
1129 		if (ssiz > rlim_stack.rlim_cur) {
1130 			rlim_stack.rlim_cur = ssiz;
1131 			kern_setrlimit(curthread, RLIMIT_STACK, &rlim_stack);
1132 		}
1133 	} else if (sv->sv_maxssiz != NULL) {
1134 		ssiz = *sv->sv_maxssiz;
1135 	} else {
1136 		ssiz = maxssiz;
1137 	}
1138 	stack_addr = sv->sv_usrstack - ssiz;
1139 	error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz,
1140 	    obj != NULL && imgp->stack_prot != 0 ? imgp->stack_prot :
1141 		sv->sv_stackprot,
1142 	    VM_PROT_ALL, MAP_STACK_GROWS_DOWN);
1143 	if (error)
1144 		return (error);
1145 
1146 	/*
1147 	 * vm_ssize and vm_maxsaddr are somewhat antiquated concepts, but they
1148 	 * are still used to enforce the stack rlimit on the process stack.
1149 	 */
1150 	vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT;
1151 	vmspace->vm_maxsaddr = (char *)stack_addr;
1152 
1153 	return (0);
1154 }
1155 
1156 /*
1157  * Copy out argument and environment strings from the old process address
1158  * space into the temporary string buffer.
1159  */
1160 int
1161 exec_copyin_args(struct image_args *args, char *fname,
1162     enum uio_seg segflg, char **argv, char **envv)
1163 {
1164 	u_long argp, envp;
1165 	int error;
1166 	size_t length;
1167 
1168 	bzero(args, sizeof(*args));
1169 	if (argv == NULL)
1170 		return (EFAULT);
1171 
1172 	/*
1173 	 * Allocate demand-paged memory for the file name, argument, and
1174 	 * environment strings.
1175 	 */
1176 	error = exec_alloc_args(args);
1177 	if (error != 0)
1178 		return (error);
1179 
1180 	/*
1181 	 * Copy the file name.
1182 	 */
1183 	if (fname != NULL) {
1184 		args->fname = args->buf;
1185 		error = (segflg == UIO_SYSSPACE) ?
1186 		    copystr(fname, args->fname, PATH_MAX, &length) :
1187 		    copyinstr(fname, args->fname, PATH_MAX, &length);
1188 		if (error != 0)
1189 			goto err_exit;
1190 	} else
1191 		length = 0;
1192 
1193 	args->begin_argv = args->buf + length;
1194 	args->endp = args->begin_argv;
1195 	args->stringspace = ARG_MAX;
1196 
1197 	/*
1198 	 * extract arguments first
1199 	 */
1200 	for (;;) {
1201 		error = fueword(argv++, &argp);
1202 		if (error == -1) {
1203 			error = EFAULT;
1204 			goto err_exit;
1205 		}
1206 		if (argp == 0)
1207 			break;
1208 		error = copyinstr((void *)(uintptr_t)argp, args->endp,
1209 		    args->stringspace, &length);
1210 		if (error != 0) {
1211 			if (error == ENAMETOOLONG)
1212 				error = E2BIG;
1213 			goto err_exit;
1214 		}
1215 		args->stringspace -= length;
1216 		args->endp += length;
1217 		args->argc++;
1218 	}
1219 
1220 	args->begin_envv = args->endp;
1221 
1222 	/*
1223 	 * extract environment strings
1224 	 */
1225 	if (envv) {
1226 		for (;;) {
1227 			error = fueword(envv++, &envp);
1228 			if (error == -1) {
1229 				error = EFAULT;
1230 				goto err_exit;
1231 			}
1232 			if (envp == 0)
1233 				break;
1234 			error = copyinstr((void *)(uintptr_t)envp,
1235 			    args->endp, args->stringspace, &length);
1236 			if (error != 0) {
1237 				if (error == ENAMETOOLONG)
1238 					error = E2BIG;
1239 				goto err_exit;
1240 			}
1241 			args->stringspace -= length;
1242 			args->endp += length;
1243 			args->envc++;
1244 		}
1245 	}
1246 
1247 	return (0);
1248 
1249 err_exit:
1250 	exec_free_args(args);
1251 	return (error);
1252 }
1253 
1254 int
1255 exec_copyin_data_fds(struct thread *td, struct image_args *args,
1256     const void *data, size_t datalen, const int *fds, size_t fdslen)
1257 {
1258 	struct filedesc *ofdp;
1259 	const char *p;
1260 	int *kfds;
1261 	int error;
1262 
1263 	memset(args, '\0', sizeof(*args));
1264 	ofdp = td->td_proc->p_fd;
1265 	if (datalen >= ARG_MAX || fdslen > ofdp->fd_lastfile + 1)
1266 		return (E2BIG);
1267 	error = exec_alloc_args(args);
1268 	if (error != 0)
1269 		return (error);
1270 
1271 	args->begin_argv = args->buf;
1272 	args->stringspace = ARG_MAX;
1273 
1274 	if (datalen > 0) {
1275 		/*
1276 		 * Argument buffer has been provided. Copy it into the
1277 		 * kernel as a single string and add a terminating null
1278 		 * byte.
1279 		 */
1280 		error = copyin(data, args->begin_argv, datalen);
1281 		if (error != 0)
1282 			goto err_exit;
1283 		args->begin_argv[datalen] = '\0';
1284 		args->endp = args->begin_argv + datalen + 1;
1285 		args->stringspace -= datalen + 1;
1286 
1287 		/*
1288 		 * Traditional argument counting. Count the number of
1289 		 * null bytes.
1290 		 */
1291 		for (p = args->begin_argv; p < args->endp; ++p)
1292 			if (*p == '\0')
1293 				++args->argc;
1294 	} else {
1295 		/* No argument buffer provided. */
1296 		args->endp = args->begin_argv;
1297 	}
1298 	/* There are no environment variables. */
1299 	args->begin_envv = args->endp;
1300 
1301 	/* Create new file descriptor table. */
1302 	kfds = malloc(fdslen * sizeof(int), M_TEMP, M_WAITOK);
1303 	error = copyin(fds, kfds, fdslen * sizeof(int));
1304 	if (error != 0) {
1305 		free(kfds, M_TEMP);
1306 		goto err_exit;
1307 	}
1308 	error = fdcopy_remapped(ofdp, kfds, fdslen, &args->fdp);
1309 	free(kfds, M_TEMP);
1310 	if (error != 0)
1311 		goto err_exit;
1312 
1313 	return (0);
1314 err_exit:
1315 	exec_free_args(args);
1316 	return (error);
1317 }
1318 
1319 /*
1320  * Allocate temporary demand-paged, zero-filled memory for the file name,
1321  * argument, and environment strings.  Returns zero if the allocation succeeds
1322  * and ENOMEM otherwise.
1323  */
1324 int
1325 exec_alloc_args(struct image_args *args)
1326 {
1327 
1328 	args->buf = (char *)kmap_alloc_wait(exec_map, PATH_MAX + ARG_MAX);
1329 	return (args->buf != NULL ? 0 : ENOMEM);
1330 }
1331 
1332 void
1333 exec_free_args(struct image_args *args)
1334 {
1335 
1336 	if (args->buf != NULL) {
1337 		kmap_free_wakeup(exec_map, (vm_offset_t)args->buf,
1338 		    PATH_MAX + ARG_MAX);
1339 		args->buf = NULL;
1340 	}
1341 	if (args->fname_buf != NULL) {
1342 		free(args->fname_buf, M_TEMP);
1343 		args->fname_buf = NULL;
1344 	}
1345 	if (args->fdp != NULL)
1346 		fdescfree_remapped(args->fdp);
1347 }
1348 
1349 /*
1350  * Copy strings out to the new process address space, constructing new arg
1351  * and env vector tables. Return a pointer to the base so that it can be used
1352  * as the initial stack pointer.
1353  */
1354 register_t *
1355 exec_copyout_strings(imgp)
1356 	struct image_params *imgp;
1357 {
1358 	int argc, envc;
1359 	char **vectp;
1360 	char *stringp;
1361 	uintptr_t destp;
1362 	register_t *stack_base;
1363 	struct ps_strings *arginfo;
1364 	struct proc *p;
1365 	size_t execpath_len;
1366 	int szsigcode, szps;
1367 	char canary[sizeof(long) * 8];
1368 
1369 	szps = sizeof(pagesizes[0]) * MAXPAGESIZES;
1370 	/*
1371 	 * Calculate string base and vector table pointers.
1372 	 * Also deal with signal trampoline code for this exec type.
1373 	 */
1374 	if (imgp->execpath != NULL && imgp->auxargs != NULL)
1375 		execpath_len = strlen(imgp->execpath) + 1;
1376 	else
1377 		execpath_len = 0;
1378 	p = imgp->proc;
1379 	szsigcode = 0;
1380 	arginfo = (struct ps_strings *)p->p_sysent->sv_psstrings;
1381 	if (p->p_sysent->sv_sigcode_base == 0) {
1382 		if (p->p_sysent->sv_szsigcode != NULL)
1383 			szsigcode = *(p->p_sysent->sv_szsigcode);
1384 	}
1385 	destp =	(uintptr_t)arginfo;
1386 
1387 	/*
1388 	 * install sigcode
1389 	 */
1390 	if (szsigcode != 0) {
1391 		destp -= szsigcode;
1392 		destp = rounddown2(destp, sizeof(void *));
1393 		copyout(p->p_sysent->sv_sigcode, (void *)destp, szsigcode);
1394 	}
1395 
1396 	/*
1397 	 * Copy the image path for the rtld.
1398 	 */
1399 	if (execpath_len != 0) {
1400 		destp -= execpath_len;
1401 		imgp->execpathp = destp;
1402 		copyout(imgp->execpath, (void *)destp, execpath_len);
1403 	}
1404 
1405 	/*
1406 	 * Prepare the canary for SSP.
1407 	 */
1408 	arc4rand(canary, sizeof(canary), 0);
1409 	destp -= sizeof(canary);
1410 	imgp->canary = destp;
1411 	copyout(canary, (void *)destp, sizeof(canary));
1412 	imgp->canarylen = sizeof(canary);
1413 
1414 	/*
1415 	 * Prepare the pagesizes array.
1416 	 */
1417 	destp -= szps;
1418 	destp = rounddown2(destp, sizeof(void *));
1419 	imgp->pagesizes = destp;
1420 	copyout(pagesizes, (void *)destp, szps);
1421 	imgp->pagesizeslen = szps;
1422 
1423 	destp -= ARG_MAX - imgp->args->stringspace;
1424 	destp = rounddown2(destp, sizeof(void *));
1425 
1426 	/*
1427 	 * If we have a valid auxargs ptr, prepare some room
1428 	 * on the stack.
1429 	 */
1430 	if (imgp->auxargs) {
1431 		/*
1432 		 * 'AT_COUNT*2' is size for the ELF Auxargs data. This is for
1433 		 * lower compatibility.
1434 		 */
1435 		imgp->auxarg_size = (imgp->auxarg_size) ? imgp->auxarg_size :
1436 		    (AT_COUNT * 2);
1437 		/*
1438 		 * The '+ 2' is for the null pointers at the end of each of
1439 		 * the arg and env vector sets,and imgp->auxarg_size is room
1440 		 * for argument of Runtime loader.
1441 		 */
1442 		vectp = (char **)(destp - (imgp->args->argc +
1443 		    imgp->args->envc + 2 + imgp->auxarg_size)
1444 		    * sizeof(char *));
1445 	} else {
1446 		/*
1447 		 * The '+ 2' is for the null pointers at the end of each of
1448 		 * the arg and env vector sets
1449 		 */
1450 		vectp = (char **)(destp - (imgp->args->argc + imgp->args->envc
1451 		    + 2) * sizeof(char *));
1452 	}
1453 
1454 	/*
1455 	 * vectp also becomes our initial stack base
1456 	 */
1457 	stack_base = (register_t *)vectp;
1458 
1459 	stringp = imgp->args->begin_argv;
1460 	argc = imgp->args->argc;
1461 	envc = imgp->args->envc;
1462 
1463 	/*
1464 	 * Copy out strings - arguments and environment.
1465 	 */
1466 	copyout(stringp, (void *)destp, ARG_MAX - imgp->args->stringspace);
1467 
1468 	/*
1469 	 * Fill in "ps_strings" struct for ps, w, etc.
1470 	 */
1471 	suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp);
1472 	suword32(&arginfo->ps_nargvstr, argc);
1473 
1474 	/*
1475 	 * Fill in argument portion of vector table.
1476 	 */
1477 	for (; argc > 0; --argc) {
1478 		suword(vectp++, (long)(intptr_t)destp);
1479 		while (*stringp++ != 0)
1480 			destp++;
1481 		destp++;
1482 	}
1483 
1484 	/* a null vector table pointer separates the argp's from the envp's */
1485 	suword(vectp++, 0);
1486 
1487 	suword(&arginfo->ps_envstr, (long)(intptr_t)vectp);
1488 	suword32(&arginfo->ps_nenvstr, envc);
1489 
1490 	/*
1491 	 * Fill in environment portion of vector table.
1492 	 */
1493 	for (; envc > 0; --envc) {
1494 		suword(vectp++, (long)(intptr_t)destp);
1495 		while (*stringp++ != 0)
1496 			destp++;
1497 		destp++;
1498 	}
1499 
1500 	/* end of vector table is a null pointer */
1501 	suword(vectp, 0);
1502 
1503 	return (stack_base);
1504 }
1505 
1506 /*
1507  * Check permissions of file to execute.
1508  *	Called with imgp->vp locked.
1509  *	Return 0 for success or error code on failure.
1510  */
1511 int
1512 exec_check_permissions(imgp)
1513 	struct image_params *imgp;
1514 {
1515 	struct vnode *vp = imgp->vp;
1516 	struct vattr *attr = imgp->attr;
1517 	struct thread *td;
1518 	int error, writecount;
1519 
1520 	td = curthread;
1521 
1522 	/* Get file attributes */
1523 	error = VOP_GETATTR(vp, attr, td->td_ucred);
1524 	if (error)
1525 		return (error);
1526 
1527 #ifdef MAC
1528 	error = mac_vnode_check_exec(td->td_ucred, imgp->vp, imgp);
1529 	if (error)
1530 		return (error);
1531 #endif
1532 
1533 	/*
1534 	 * 1) Check if file execution is disabled for the filesystem that
1535 	 *    this file resides on.
1536 	 * 2) Ensure that at least one execute bit is on. Otherwise, a
1537 	 *    privileged user will always succeed, and we don't want this
1538 	 *    to happen unless the file really is executable.
1539 	 * 3) Ensure that the file is a regular file.
1540 	 */
1541 	if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
1542 	    (attr->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0 ||
1543 	    (attr->va_type != VREG))
1544 		return (EACCES);
1545 
1546 	/*
1547 	 * Zero length files can't be exec'd
1548 	 */
1549 	if (attr->va_size == 0)
1550 		return (ENOEXEC);
1551 
1552 	/*
1553 	 *  Check for execute permission to file based on current credentials.
1554 	 */
1555 	error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td);
1556 	if (error)
1557 		return (error);
1558 
1559 	/*
1560 	 * Check number of open-for-writes on the file and deny execution
1561 	 * if there are any.
1562 	 */
1563 	error = VOP_GET_WRITECOUNT(vp, &writecount);
1564 	if (error != 0)
1565 		return (error);
1566 	if (writecount != 0)
1567 		return (ETXTBSY);
1568 
1569 	/*
1570 	 * Call filesystem specific open routine (which does nothing in the
1571 	 * general case).
1572 	 */
1573 	error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL);
1574 	if (error == 0)
1575 		imgp->opened = 1;
1576 	return (error);
1577 }
1578 
1579 /*
1580  * Exec handler registration
1581  */
1582 int
1583 exec_register(execsw_arg)
1584 	const struct execsw *execsw_arg;
1585 {
1586 	const struct execsw **es, **xs, **newexecsw;
1587 	int count = 2;	/* New slot and trailing NULL */
1588 
1589 	if (execsw)
1590 		for (es = execsw; *es; es++)
1591 			count++;
1592 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1593 	xs = newexecsw;
1594 	if (execsw)
1595 		for (es = execsw; *es; es++)
1596 			*xs++ = *es;
1597 	*xs++ = execsw_arg;
1598 	*xs = NULL;
1599 	if (execsw)
1600 		free(execsw, M_TEMP);
1601 	execsw = newexecsw;
1602 	return (0);
1603 }
1604 
1605 int
1606 exec_unregister(execsw_arg)
1607 	const struct execsw *execsw_arg;
1608 {
1609 	const struct execsw **es, **xs, **newexecsw;
1610 	int count = 1;
1611 
1612 	if (execsw == NULL)
1613 		panic("unregister with no handlers left?\n");
1614 
1615 	for (es = execsw; *es; es++) {
1616 		if (*es == execsw_arg)
1617 			break;
1618 	}
1619 	if (*es == NULL)
1620 		return (ENOENT);
1621 	for (es = execsw; *es; es++)
1622 		if (*es != execsw_arg)
1623 			count++;
1624 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1625 	xs = newexecsw;
1626 	for (es = execsw; *es; es++)
1627 		if (*es != execsw_arg)
1628 			*xs++ = *es;
1629 	*xs = NULL;
1630 	if (execsw)
1631 		free(execsw, M_TEMP);
1632 	execsw = newexecsw;
1633 	return (0);
1634 }
1635