1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2012 Milan Jurik. All rights reserved. 25 */ 26 27 /* Copyright (c) 1988 AT&T */ 28 /* All Rights Reserved */ 29 30 31 /* from S5R4 1.6 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/sysmacros.h> 36 #include <sys/signal.h> 37 #include <sys/cred.h> 38 #include <sys/user.h> 39 #include <sys/errno.h> 40 #include <sys/vnode.h> 41 #include <sys/proc.h> 42 #include <sys/cmn_err.h> 43 #include <sys/debug.h> 44 #include <sys/pathname.h> 45 #include <sys/disp.h> 46 #include <sys/exec.h> 47 #include <sys/kmem.h> 48 #include <sys/note.h> 49 #include <sys/sdt.h> 50 51 /* 52 * This is the loadable module wrapper. 53 */ 54 #include <sys/modctl.h> 55 56 extern int intpexec(struct vnode *, struct execa *, struct uarg *, 57 struct intpdata *, int, long *, int, caddr_t, struct cred *, int); 58 59 static struct execsw esw = { 60 intpmagicstr, 61 0, 62 2, 63 intpexec, 64 NULL 65 }; 66 67 /* 68 * Module linkage information for the kernel. 69 */ 70 extern struct mod_ops mod_execops; 71 72 static struct modlexec modlexec = { 73 &mod_execops, "exec mod for interp", &esw 74 }; 75 76 static struct modlinkage modlinkage = { 77 MODREV_1, (void *)&modlexec, NULL 78 }; 79 80 int 81 _init() 82 { 83 return (mod_install(&modlinkage)); 84 } 85 86 int 87 _fini() 88 { 89 return (mod_remove(&modlinkage)); 90 } 91 92 int 93 _info(struct modinfo *modinfop) 94 { 95 return (mod_info(&modlinkage, modinfop)); 96 } 97 98 99 /* 100 * Crack open a '#!' line. 101 */ 102 static int 103 getintphead(struct vnode *vp, struct intpdata *idatap) 104 { 105 int error; 106 char *cp, *linep = idatap->intp; 107 ssize_t resid; 108 109 /* 110 * Read the entire line and confirm that it starts with '#!'. 111 */ 112 if (error = vn_rdwr(UIO_READ, vp, linep, INTPSZ, (offset_t)0, 113 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) 114 return (error); 115 if (resid > INTPSZ-2 || linep[0] != '#' || linep[1] != '!') 116 return (ENOEXEC); 117 /* 118 * Blank all white space and find the newline. 119 */ 120 for (cp = &linep[2]; cp < &linep[INTPSZ] && *cp != '\n'; cp++) 121 if (*cp == '\t') 122 *cp = ' '; 123 if (cp >= &linep[INTPSZ]) 124 return (ENOEXEC); 125 ASSERT(*cp == '\n'); 126 *cp = '\0'; 127 128 /* 129 * Locate the beginning and end of the interpreter name. 130 * In addition to the name, one additional argument may 131 * optionally be included here, to be prepended to the 132 * arguments provided on the command line. Thus, for 133 * example, you can say 134 * 135 * #! /usr/bin/awk -f 136 */ 137 for (cp = &linep[2]; *cp == ' '; cp++) 138 ; 139 if (*cp == '\0') 140 return (ENOEXEC); 141 idatap->intp_name[0] = cp; 142 while (*cp && *cp != ' ') 143 cp++; 144 if (*cp == '\0') { 145 idatap->intp_arg[0] = NULL; 146 } else { 147 *cp++ = '\0'; 148 while (*cp == ' ') 149 cp++; 150 if (*cp == '\0') 151 idatap->intp_arg[0] = NULL; 152 else { 153 idatap->intp_arg[0] = cp; 154 while (*cp && *cp != ' ') 155 cp++; 156 *cp = '\0'; 157 } 158 } 159 return (0); 160 } 161 162 /* 163 * We support nested interpreters up to a depth of INTP_MAXDEPTH (this value 164 * matches the depth on Linux). When a nested interpreter is in use, the 165 * previous name and argument must be passed along. We use the intpdata_t 166 * name and argument arrays for this. In the normal, non-nested case, only the 167 * first element in those arrays will be populated. 168 * 169 * For setid scripts the "script hole" is a security race condition between 170 * when we exec the interpreter and when the interpreter reads the script. We 171 * handle this below for the initial script, but we don't allow setid scripts 172 * when using nested interpreters. Because gexec only modifies the credentials 173 * for a setid script at level 0, then if we come back through for a nested 174 * interpreter we know that args->fname will be set (the first script is setid) 175 * and we can return an error. If an intermediate nested interpreter is setid 176 * then it will not be run with different credentials because of the gexec 177 * handling, so it is effectively no longer setid and we don't have to worry 178 * about the "script hole". 179 */ 180 int 181 intpexec( 182 struct vnode *vp, 183 struct execa *uap, 184 struct uarg *args, 185 struct intpdata *idatap, 186 int level, 187 long *execsz, 188 int setid, 189 caddr_t exec_file, 190 struct cred *cred, 191 int brand_action) 192 { 193 _NOTE(ARGUNUSED(brand_action)) 194 vnode_t *nvp; 195 int error = 0; 196 struct intpdata idata; 197 struct pathname intppn; 198 struct pathname resolvepn; 199 char *opath; 200 char devfd[19]; /* 32-bit int fits in 10 digits + 8 for "/dev/fd/" */ 201 int fd = -1; 202 203 if (level >= INTP_MAXDEPTH) { /* Can't recurse past maxdepth */ 204 error = ELOOP; 205 goto bad; 206 } 207 208 if (level == 0) 209 ASSERT(idatap == (struct intpdata *)NULL); 210 211 bzero(&idata, sizeof (intpdata_t)); 212 213 /* 214 * Allocate a buffer to read in the interpreter pathname. 215 */ 216 idata.intp = kmem_alloc(INTPSZ, KM_SLEEP); 217 if (error = getintphead(vp, &idata)) 218 goto fail; 219 220 /* 221 * Look the new vnode up. 222 */ 223 if (error = pn_get(idata.intp_name[0], UIO_SYSSPACE, &intppn)) 224 goto fail; 225 pn_alloc(&resolvepn); 226 if (error = lookuppn(&intppn, &resolvepn, FOLLOW, NULLVPP, &nvp)) { 227 pn_free(&resolvepn); 228 pn_free(&intppn); 229 goto fail; 230 } 231 232 if (level > 0) { 233 /* 234 * We have a nested interpreter. The previous name(s) and 235 * argument(s) need to be passed along. We also keep track 236 * of how often this zone uses nested interpreters. 237 */ 238 int i; 239 240 atomic_inc_32(&curproc->p_zone->zone_nested_intp); 241 242 ASSERT(idatap != NULL); 243 /* since we're shifting up, loop stops one short */ 244 for (i = 0; i < (INTP_MAXDEPTH - 1); i++) { 245 idata.intp_name[i + 1] = idatap->intp_name[i]; 246 idata.intp_arg[i + 1] = idatap->intp_arg[i]; 247 } 248 249 DTRACE_PROBE3(nested__intp, int, level, void *, &idata, 250 void *, nvp); 251 } 252 253 opath = args->pathname; 254 args->pathname = resolvepn.pn_path; 255 /* don't free resolvepn until we are done with args */ 256 pn_free(&intppn); 257 258 /* 259 * Disallow setuid or additional privilege execution for nested 260 * interpreters. 261 */ 262 if (level > 0 && args->fname != NULL) { 263 error = ENOEXEC; 264 goto done; 265 } 266 267 /* 268 * When we're executing a set-uid script resulting in uids 269 * mismatching or when we execute with additional privileges, 270 * we close the "replace script between exec and open by shell" 271 * hole by passing the script as /dev/fd parameter. 272 */ 273 if ((setid & EXECSETID_PRIVS) != 0 || 274 (setid & (EXECSETID_UGIDS|EXECSETID_SETID)) == 275 (EXECSETID_UGIDS|EXECSETID_SETID)) { 276 (void) strcpy(devfd, "/dev/fd/"); 277 if (error = execopen(&vp, &fd)) 278 goto done; 279 numtos(fd, &devfd[8]); 280 args->fname = devfd; 281 } 282 283 error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred, 284 EBA_NONE); 285 286 if (!error) { 287 /* 288 * Close this executable as the interpreter 289 * will open and close it later on. 290 */ 291 (void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL); 292 } 293 done: 294 VN_RELE(nvp); 295 args->pathname = opath; 296 pn_free(&resolvepn); 297 fail: 298 kmem_free(idata.intp, INTPSZ); 299 if (error && fd != -1) 300 (void) execclose(fd); 301 bad: 302 return (error); 303 } 304