xref: /freebsd/sys/kern/kern_exec.c (revision 952d112864d8008aa87278a30a539d888a8493cd) 
1 /*
2  * Copyright (c) 1993, David Greenman
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  *	$Id: kern_exec.c,v 1.56 1997/04/04 07:30:06 davidg Exp $
27  */
28 
29 #include <sys/param.h>
30 #include <sys/systm.h>
31 #include <sys/sysproto.h>
32 #include <sys/signalvar.h>
33 #include <sys/kernel.h>
34 #include <sys/mount.h>
35 #include <sys/filedesc.h>
36 #include <sys/fcntl.h>
37 #include <sys/acct.h>
38 #include <sys/exec.h>
39 #include <sys/imgact.h>
40 #include <sys/imgact_elf.h>
41 #include <sys/wait.h>
42 #include <sys/proc.h>
43 #include <sys/malloc.h>
44 #include <sys/namei.h>
45 #include <sys/sysent.h>
46 #include <sys/syslog.h>
47 #include <sys/shm.h>
48 #include <sys/sysctl.h>
49 #include <sys/vnode.h>
50 #include <sys/buf.h>
51 
52 #include <vm/vm.h>
53 #include <vm/vm_param.h>
54 #include <vm/vm_prot.h>
55 #include <sys/lock.h>
56 #include <vm/pmap.h>
57 #include <vm/vm_map.h>
58 #include <vm/vm_kern.h>
59 #include <vm/vm_extern.h>
60 
61 #include <machine/reg.h>
62 
63 static int *exec_copyout_strings __P((struct image_params *));
64 
65 static int exec_check_permissions(struct image_params *);
66 
67 /*
68  * XXX trouble here if sizeof(caddr_t) != sizeof(int), other parts
69  * of the sysctl code also assumes this, and sizeof(int) == sizeof(long).
70  */
71 static struct ps_strings *ps_strings = PS_STRINGS;
72 SYSCTL_INT(_kern, KERN_PS_STRINGS, ps_strings, 0, &ps_strings, 0, "");
73 
74 static caddr_t usrstack = (caddr_t)USRSTACK;
75 SYSCTL_INT(_kern, KERN_USRSTACK, usrstack, 0, &usrstack, 0, "");
76 
77 /*
78  * execsw_set is constructed for us by the linker.  Each of the items
79  * is a pointer to a `const struct execsw', hence the double pointer here.
80  */
81 static const struct execsw **execsw =
82 	(const struct execsw **)&execsw_set.ls_items[0];
83 
84 #ifndef _SYS_SYSPROTO_H_
85 struct execve_args {
86         char    *fname;
87         char    **argv;
88         char    **envv;
89 };
90 #endif
91 
92 /*
93  * execve() system call.
94  */
95 int
96 execve(p, uap, retval)
97 	struct proc *p;
98 	register struct execve_args *uap;
99 	int *retval;
100 {
101 	struct nameidata nd, *ndp;
102 	int *stack_base;
103 	int error, len, i;
104 	struct image_params image_params, *imgp;
105 	struct vattr attr;
106 	struct buf *bp = NULL;
107 
108 	imgp = &image_params;
109 
110 	/*
111 	 * Initialize part of the common data
112 	 */
113 	imgp->proc = p;
114 	imgp->uap = uap;
115 	imgp->attr = &attr;
116 	imgp->image_header = NULL;
117 	imgp->argc = imgp->envc = 0;
118 	imgp->entry_addr = 0;
119 	imgp->vmspace_destroyed = 0;
120 	imgp->interpreted = 0;
121 	imgp->interpreter_name[0] = '\0';
122 	imgp->auxargs = NULL;
123 
124 	/*
125 	 * Allocate temporary demand zeroed space for argument and
126 	 *	environment strings
127 	 */
128 	imgp->stringbase = (char *)kmem_alloc_wait(exec_map, ARG_MAX);
129 	if (imgp->stringbase == NULL) {
130 		error = ENOMEM;
131 		goto exec_fail;
132 	}
133 	imgp->stringp = imgp->stringbase;
134 	imgp->stringspace = ARG_MAX;
135 
136 	/*
137 	 * Translate the file name. namei() returns a vnode pointer
138 	 *	in ni_vp amoung other things.
139 	 */
140 	ndp = &nd;
141 	NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
142 	    UIO_USERSPACE, uap->fname, p);
143 
144 interpret:
145 
146 	error = namei(ndp);
147 	if (error) {
148 		kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX);
149 		goto exec_fail;
150 	}
151 
152 	imgp->vp = ndp->ni_vp;
153 
154 	/*
155 	 * Check file permissions (also 'opens' file)
156 	 */
157 	error = exec_check_permissions(imgp);
158 	if (error) {
159 		VOP_UNLOCK(imgp->vp, 0, p);
160 		goto exec_fail_dealloc;
161 	}
162 
163 	/*
164 	 * Get the image header, which we define here as meaning the first
165 	 * page of the executable.
166 	 */
167 	if (imgp->vp->v_mount && imgp->vp->v_mount->mnt_stat.f_iosize >= PAGE_SIZE) {
168 		/*
169 		 * Get a buffer with (at least) the first page.
170 		 */
171 		error = bread(imgp->vp, 0, imgp->vp->v_mount->mnt_stat.f_iosize,
172 		     p->p_ucred, &bp);
173 		imgp->image_header = bp->b_data;
174 	} else {
175 		/*
176 		 * The filesystem block size is too small, so do this the hard
177 		 * way. Malloc some space and read PAGE_SIZE worth of the image
178 		 * header into it.
179 		 */
180 		imgp->image_header = malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
181 		error = vn_rdwr(UIO_READ, imgp->vp, (void *)imgp->image_header, PAGE_SIZE, 0,
182 		    UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, NULL, p);
183 	}
184 	VOP_UNLOCK(imgp->vp, 0, p);
185 	if (error)
186 		goto exec_fail_dealloc;
187 
188 	/*
189 	 * Loop through list of image activators, calling each one.
190 	 *	If there is no match, the activator returns -1. If there
191 	 *	is a match, but there was an error during the activation,
192 	 *	the error is returned. Otherwise 0 means success. If the
193 	 *	image is interpreted, loop back up and try activating
194 	 *	the interpreter.
195 	 */
196 	for (i = 0; execsw[i]; ++i) {
197 		if (execsw[i]->ex_imgact)
198 			error = (*execsw[i]->ex_imgact)(imgp);
199 		else
200 			continue;
201 		if (error == -1)
202 			continue;
203 		if (error)
204 			goto exec_fail_dealloc;
205 		if (imgp->interpreted) {
206 			/* free old bp/image_header */
207 			if (bp != NULL) {
208 				brelse(bp);
209 				bp = NULL;
210 			} else {
211 				free((void *)imgp->image_header, M_TEMP);
212 				imgp->image_header = NULL;
213 			}
214 			/* free old vnode and name buffer */
215 			vrele(ndp->ni_vp);
216 			FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
217 			/* set new name to that of the interpreter */
218 			NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
219 			    UIO_SYSSPACE, imgp->interpreter_name, p);
220 			goto interpret;
221 		}
222 		break;
223 	}
224 	/* If we made it through all the activators and none matched, exit. */
225 	if (error == -1) {
226 		error = ENOEXEC;
227 		goto exec_fail_dealloc;
228 	}
229 
230 	/*
231 	 * Copy out strings (args and env) and initialize stack base
232 	 */
233 	stack_base = exec_copyout_strings(imgp);
234 	p->p_vmspace->vm_minsaddr = (char *)stack_base;
235 
236 	/*
237 	 * If custom stack fixup routine present for this process
238 	 * let it do the stack setup.
239 	 * Else stuff argument count as first item on stack
240 	 */
241 	if (p->p_sysent->sv_fixup)
242 		(*p->p_sysent->sv_fixup)(&stack_base, imgp);
243 	else
244 		suword(--stack_base, imgp->argc);
245 
246 	/* close files on exec */
247 	fdcloseexec(p);
248 
249 	/* reset caught signals */
250 	execsigs(p);
251 
252 	/* name this process - nameiexec(p, ndp) */
253 	len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN);
254 	bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len);
255 	p->p_comm[len] = 0;
256 
257 	/*
258 	 * mark as execed, wakeup the process that vforked (if any) and tell
259 	 * it that it now has it's own resources back
260 	 */
261 	p->p_flag |= P_EXEC;
262 	if (p->p_pptr && (p->p_flag & P_PPWAIT)) {
263 		p->p_flag &= ~P_PPWAIT;
264 		wakeup((caddr_t)p->p_pptr);
265 	}
266 
267 	/*
268 	 * Implement image setuid/setgid. Disallow if the process is
269 	 * being traced.
270 	 */
271 	if ((attr.va_mode & (VSUID | VSGID)) &&
272 	    (p->p_flag & P_TRACED) == 0) {
273 		/*
274 		 * Turn off syscall tracing for set-id programs, except for
275 		 * root.
276 		 */
277 		if (p->p_tracep && suser(p->p_ucred, &p->p_acflag)) {
278 			p->p_traceflag = 0;
279 			vrele(p->p_tracep);
280 			p->p_tracep = NULL;
281 		}
282 		/*
283 		 * Set the new credentials.
284 		 */
285 		p->p_ucred = crcopy(p->p_ucred);
286 		if (attr.va_mode & VSUID)
287 			p->p_ucred->cr_uid = attr.va_uid;
288 		if (attr.va_mode & VSGID)
289 			p->p_ucred->cr_groups[0] = attr.va_gid;
290 		p->p_flag |= P_SUGID;
291 	} else {
292 	        if (p->p_ucred->cr_uid == p->p_cred->p_ruid &&
293 		    p->p_ucred->cr_gid == p->p_cred->p_rgid)
294 			p->p_flag &= ~P_SUGID;
295 	}
296 
297 	/*
298 	 * Implement correct POSIX saved-id behavior.
299 	 */
300 	p->p_cred->p_svuid = p->p_ucred->cr_uid;
301 	p->p_cred->p_svgid = p->p_ucred->cr_gid;
302 
303 	/*
304 	 * Store the vp for use in procfs
305 	 */
306 	if (p->p_textvp)		/* release old reference */
307 		vrele(p->p_textvp);
308 	VREF(ndp->ni_vp);
309 	p->p_textvp = ndp->ni_vp;
310 
311 	/*
312 	 * If tracing the process, trap to debugger so breakpoints
313 	 * 	can be set before the program executes.
314 	 */
315 	if (p->p_flag & P_TRACED)
316 		psignal(p, SIGTRAP);
317 
318 	/* clear "fork but no exec" flag, as we _are_ execing */
319 	p->p_acflag &= ~AFORK;
320 
321 	/* Set entry address */
322 	setregs(p, imgp->entry_addr, (u_long)stack_base);
323 
324 	/*
325 	 * free various allocated resources
326 	 */
327 	kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX);
328 	if (bp != NULL)
329 		brelse(bp);
330 	else if (imgp->image_header != NULL)
331 		free((void *)imgp->image_header, M_TEMP);
332 	vrele(ndp->ni_vp);
333 	FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
334 
335 	return (0);
336 
337 exec_fail_dealloc:
338 	if (imgp->stringbase != NULL)
339 		kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX);
340 	if (bp != NULL)
341 		brelse(bp);
342 	else if (imgp->image_header != NULL)
343 		free((void *)imgp->image_header, M_TEMP);
344 	if (ndp->ni_vp) {
345 		vrele(ndp->ni_vp);
346 		FREE(ndp->ni_cnd.cn_pnbuf, M_NAMEI);
347 	}
348 
349 exec_fail:
350 	if (imgp->vmspace_destroyed) {
351 		/* sorry, no more process anymore. exit gracefully */
352 		exit1(p, W_EXITCODE(0, SIGABRT));
353 		/* NOT REACHED */
354 		return(0);
355 	} else {
356 		return(error);
357 	}
358 }
359 
360 /*
361  * Destroy old address space, and allocate a new stack
362  *	The new stack is only SGROWSIZ large because it is grown
363  *	automatically in trap.c.
364  */
365 int
366 exec_new_vmspace(imgp)
367 	struct image_params *imgp;
368 {
369 	int error;
370 	struct vmspace *vmspace = imgp->proc->p_vmspace;
371 	caddr_t	stack_addr = (caddr_t) (USRSTACK - SGROWSIZ);
372 
373 	imgp->vmspace_destroyed = 1;
374 
375 	/* Blow away entire process VM */
376 	if (vmspace->vm_shm)
377 		shmexit(imgp->proc);
378 	pmap_remove_pages(&vmspace->vm_pmap, 0, USRSTACK);
379 	vm_map_remove(&vmspace->vm_map, 0, USRSTACK);
380 
381 	/* Allocate a new stack */
382 	error = vm_map_find(&vmspace->vm_map, NULL, 0, (vm_offset_t *)&stack_addr,
383 	    SGROWSIZ, FALSE, VM_PROT_ALL, VM_PROT_ALL, 0);
384 	if (error)
385 		return(error);
386 
387 	vmspace->vm_ssize = SGROWSIZ >> PAGE_SHIFT;
388 
389 	/* Initialize maximum stack address */
390 	vmspace->vm_maxsaddr = (char *)USRSTACK - MAXSSIZ;
391 
392 	return(0);
393 }
394 
395 /*
396  * Copy out argument and environment strings from the old process
397  *	address space into the temporary string buffer.
398  */
399 int
400 exec_extract_strings(imgp)
401 	struct image_params *imgp;
402 {
403 	char	**argv, **envv;
404 	char	*argp, *envp;
405 	int	error, length;
406 
407 	/*
408 	 * extract arguments first
409 	 */
410 
411 	argv = imgp->uap->argv;
412 
413 	if (argv) {
414 		while ((argp = (caddr_t) fuword(argv++))) {
415 			if (argp == (caddr_t) -1)
416 				return (EFAULT);
417 			if ((error = copyinstr(argp, imgp->stringp,
418 			    imgp->stringspace, &length))) {
419 				if (error == ENAMETOOLONG)
420 					return(E2BIG);
421 				return (error);
422 			}
423 			imgp->stringspace -= length;
424 			imgp->stringp += length;
425 			imgp->argc++;
426 		}
427 	}
428 
429 	/*
430 	 * extract environment strings
431 	 */
432 
433 	envv = imgp->uap->envv;
434 
435 	if (envv) {
436 		while ((envp = (caddr_t) fuword(envv++))) {
437 			if (envp == (caddr_t) -1)
438 				return (EFAULT);
439 			if ((error = copyinstr(envp, imgp->stringp,
440 			    imgp->stringspace, &length))) {
441 				if (error == ENAMETOOLONG)
442 					return(E2BIG);
443 				return (error);
444 			}
445 			imgp->stringspace -= length;
446 			imgp->stringp += length;
447 			imgp->envc++;
448 		}
449 	}
450 
451 	return (0);
452 }
453 
454 /*
455  * Copy strings out to the new process address space, constructing
456  *	new arg and env vector tables. Return a pointer to the base
457  *	so that it can be used as the initial stack pointer.
458  */
459 int *
460 exec_copyout_strings(imgp)
461 	struct image_params *imgp;
462 {
463 	int argc, envc;
464 	char **vectp;
465 	char *stringp, *destp;
466 	int *stack_base;
467 	struct ps_strings *arginfo;
468 	int szsigcode;
469 
470 	/*
471 	 * Calculate string base and vector table pointers.
472 	 * Also deal with signal trampoline code for this exec type.
473 	 */
474 	arginfo = PS_STRINGS;
475 	szsigcode = *(imgp->proc->p_sysent->sv_szsigcode);
476 	destp =	(caddr_t)arginfo - szsigcode - SPARE_USRSPACE -
477 		roundup((ARG_MAX - imgp->stringspace), sizeof(char *));
478 
479 	/*
480 	 * install sigcode
481 	 */
482 	if (szsigcode)
483 		copyout(imgp->proc->p_sysent->sv_sigcode,
484 			((caddr_t)arginfo - szsigcode), szsigcode);
485 
486 	/*
487 	 * If we have a valid auxargs ptr, prepare some room
488 	 * on the stack.
489 	 */
490 	if (imgp->auxargs)
491 	/*
492 	 * The '+ 2' is for the null pointers at the end of each of the
493 	 * arg and env vector sets, and 'AT_COUNT*2' is room for the
494 	 * ELF Auxargs data.
495 	 */
496 		vectp = (char **)(destp - (imgp->argc + imgp->envc + 2 +
497 				  AT_COUNT*2) * sizeof(char*));
498 	else
499 	/*
500 	 * The '+ 2' is for the null pointers at the end of each of the
501 	 * arg and env vector sets
502 	 */
503 		vectp = (char **)
504 			(destp - (imgp->argc + imgp->envc + 2) * sizeof(char*));
505 
506 	/*
507 	 * vectp also becomes our initial stack base
508 	 */
509 	stack_base = (int *)vectp;
510 
511 	stringp = imgp->stringbase;
512 	argc = imgp->argc;
513 	envc = imgp->envc;
514 
515 	/*
516 	 * Copy out strings - arguments and environment.
517 	 */
518 	copyout(stringp, destp, ARG_MAX - imgp->stringspace);
519 
520 	/*
521 	 * Fill in "ps_strings" struct for ps, w, etc.
522 	 */
523 	suword(&arginfo->ps_argvstr, (int)vectp);
524 	suword(&arginfo->ps_nargvstr, argc);
525 
526 	/*
527 	 * Fill in argument portion of vector table.
528 	 */
529 	for (; argc > 0; --argc) {
530 		suword(vectp++, (int)destp);
531 		while (*stringp++ != 0)
532 			destp++;
533 		destp++;
534 	}
535 
536 	/* a null vector table pointer seperates the argp's from the envp's */
537 	suword(vectp++, 0);
538 
539 	suword(&arginfo->ps_envstr, (int)vectp);
540 	suword(&arginfo->ps_nenvstr, envc);
541 
542 	/*
543 	 * Fill in environment portion of vector table.
544 	 */
545 	for (; envc > 0; --envc) {
546 		suword(vectp++, (int)destp);
547 		while (*stringp++ != 0)
548 			destp++;
549 		destp++;
550 	}
551 
552 	/* end of vector table is a null pointer */
553 	suword(vectp, 0);
554 
555 	return (stack_base);
556 }
557 
558 /*
559  * Check permissions of file to execute.
560  *	Return 0 for success or error code on failure.
561  */
562 static int
563 exec_check_permissions(imgp)
564 	struct image_params *imgp;
565 {
566 	struct proc *p = imgp->proc;
567 	struct vnode *vp = imgp->vp;
568 	struct vattr *attr = imgp->attr;
569 	int error;
570 
571 	/* Get file attributes */
572 	error = VOP_GETATTR(vp, attr, p->p_ucred, p);
573 	if (error)
574 		return (error);
575 
576 	/*
577 	 * 1) Check if file execution is disabled for the filesystem that this
578 	 *	file resides on.
579 	 * 2) Insure that at least one execute bit is on - otherwise root
580 	 *	will always succeed, and we don't want to happen unless the
581 	 *	file really is executable.
582 	 * 3) Insure that the file is a regular file.
583 	 */
584 	if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
585 	    ((attr->va_mode & 0111) == 0) ||
586 	    (attr->va_type != VREG)) {
587 		return (EACCES);
588 	}
589 
590 	/*
591 	 * Zero length files can't be exec'd
592 	 */
593 	if (attr->va_size == 0)
594 		return (ENOEXEC);
595 
596 	/*
597 	 *  Check for execute permission to file based on current credentials.
598 	 */
599 	error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p);
600 	if (error)
601 		return (error);
602 
603 	/*
604 	 * Check number of open-for-writes on the file and deny execution
605 	 * if there are any.
606 	 */
607 	if (vp->v_writecount)
608 		return (ETXTBSY);
609 
610 	/*
611 	 * Call filesystem specific open routine (which does nothing in the
612 	 * general case).
613 	 */
614 	error = VOP_OPEN(vp, FREAD, p->p_ucred, p);
615 	if (error)
616 		return (error);
617 
618 	/*
619 	 * Disable setuid/setgid if the filesystem prohibits it or if
620 	 * the process is being traced.
621 	 */
622         if ((vp->v_mount->mnt_flag & MNT_NOSUID) || (p->p_flag & P_TRACED))
623 		attr->va_mode &= ~(VSUID | VSGID);
624 
625 	return (0);
626 }
627