1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2012 Milan Jurik. All rights reserved. 25 */ 26 27 /* Copyright (c) 1988 AT&T */ 28 /* All Rights Reserved */ 29 30 31 /* from S5R4 1.6 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/sysmacros.h> 36 #include <sys/signal.h> 37 #include <sys/cred.h> 38 #include <sys/user.h> 39 #include <sys/errno.h> 40 #include <sys/vnode.h> 41 #include <sys/proc.h> 42 #include <sys/cmn_err.h> 43 #include <sys/debug.h> 44 #include <sys/pathname.h> 45 #include <sys/disp.h> 46 #include <sys/exec.h> 47 #include <sys/kmem.h> 48 #include <sys/note.h> 49 50 /* 51 * This is the loadable module wrapper. 52 */ 53 #include <sys/modctl.h> 54 55 extern int intpexec(struct vnode *, struct execa *, struct uarg *, 56 struct intpdata *, int, long *, int, caddr_t, struct cred *, int); 57 58 static struct execsw esw = { 59 intpmagicstr, 60 0, 61 2, 62 intpexec, 63 NULL 64 }; 65 66 /* 67 * Module linkage information for the kernel. 68 */ 69 extern struct mod_ops mod_execops; 70 71 static struct modlexec modlexec = { 72 &mod_execops, "exec mod for interp", &esw 73 }; 74 75 static struct modlinkage modlinkage = { 76 MODREV_1, (void *)&modlexec, NULL 77 }; 78 79 int 80 _init() 81 { 82 return (mod_install(&modlinkage)); 83 } 84 85 int 86 _fini() 87 { 88 return (mod_remove(&modlinkage)); 89 } 90 91 int 92 _info(struct modinfo *modinfop) 93 { 94 return (mod_info(&modlinkage, modinfop)); 95 } 96 97 98 /* 99 * Crack open a '#!' line. 100 */ 101 static int 102 getintphead(struct vnode *vp, struct intpdata *idatap) 103 { 104 int error; 105 char *cp, *linep = idatap->intp; 106 ssize_t resid; 107 108 /* 109 * Read the entire line and confirm that it starts with '#!'. 110 */ 111 if (error = vn_rdwr(UIO_READ, vp, linep, INTPSZ, (offset_t)0, 112 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) 113 return (error); 114 if (resid > INTPSZ-2 || linep[0] != '#' || linep[1] != '!') 115 return (ENOEXEC); 116 /* 117 * Blank all white space and find the newline. 118 */ 119 for (cp = &linep[2]; cp < &linep[INTPSZ] && *cp != '\n'; cp++) 120 if (*cp == '\t') 121 *cp = ' '; 122 if (cp >= &linep[INTPSZ]) 123 return (ENOEXEC); 124 ASSERT(*cp == '\n'); 125 *cp = '\0'; 126 127 /* 128 * Locate the beginning and end of the interpreter name. 129 * In addition to the name, one additional argument may 130 * optionally be included here, to be prepended to the 131 * arguments provided on the command line. Thus, for 132 * example, you can say 133 * 134 * #! /usr/bin/awk -f 135 */ 136 for (cp = &linep[2]; *cp == ' '; cp++) 137 ; 138 if (*cp == '\0') 139 return (ENOEXEC); 140 idatap->intp_name = cp; 141 while (*cp && *cp != ' ') 142 cp++; 143 if (*cp == '\0') 144 idatap->intp_arg = NULL; 145 else { 146 *cp++ = '\0'; 147 while (*cp == ' ') 148 cp++; 149 if (*cp == '\0') 150 idatap->intp_arg = NULL; 151 else { 152 idatap->intp_arg = cp; 153 while (*cp && *cp != ' ') 154 cp++; 155 *cp = '\0'; 156 } 157 } 158 return (0); 159 } 160 161 int 162 intpexec( 163 struct vnode *vp, 164 struct execa *uap, 165 struct uarg *args, 166 struct intpdata *idatap, 167 int level, 168 long *execsz, 169 int setid, 170 caddr_t exec_file, 171 struct cred *cred, 172 int brand_action) 173 { 174 _NOTE(ARGUNUSED(brand_action)) 175 vnode_t *nvp; 176 int error = 0; 177 struct intpdata idata; 178 struct pathname intppn; 179 struct pathname resolvepn; 180 char *opath; 181 char devfd[19]; /* 32-bit int fits in 10 digits + 8 for "/dev/fd/" */ 182 int fd = -1; 183 184 if (level) { /* Can't recurse */ 185 error = ENOEXEC; 186 goto bad; 187 } 188 189 ASSERT(idatap == (struct intpdata *)NULL); 190 191 /* 192 * Allocate a buffer to read in the interpreter pathname. 193 */ 194 idata.intp = kmem_alloc(INTPSZ, KM_SLEEP); 195 if (error = getintphead(vp, &idata)) 196 goto fail; 197 198 /* 199 * Look the new vnode up. 200 */ 201 if (error = pn_get(idata.intp_name, UIO_SYSSPACE, &intppn)) 202 goto fail; 203 pn_alloc(&resolvepn); 204 if (error = lookuppn(&intppn, &resolvepn, FOLLOW, NULLVPP, &nvp)) { 205 pn_free(&resolvepn); 206 pn_free(&intppn); 207 goto fail; 208 } 209 opath = args->pathname; 210 args->pathname = resolvepn.pn_path; 211 /* don't free resolvepn until we are done with args */ 212 pn_free(&intppn); 213 214 /* 215 * When we're executing a set-uid script resulting in uids 216 * mismatching or when we execute with additional privileges, 217 * we close the "replace script between exec and open by shell" 218 * hole by passing the script as /dev/fd parameter. 219 */ 220 if ((setid & EXECSETID_PRIVS) != 0 || 221 (setid & (EXECSETID_UGIDS|EXECSETID_SETID)) == 222 (EXECSETID_UGIDS|EXECSETID_SETID)) { 223 (void) strcpy(devfd, "/dev/fd/"); 224 if (error = execopen(&vp, &fd)) 225 goto done; 226 numtos(fd, &devfd[8]); 227 args->fname = devfd; 228 } 229 230 error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred, 231 EBA_NONE); 232 233 if (!error) { 234 /* 235 * Close this executable as the interpreter 236 * will open and close it later on. 237 */ 238 (void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL); 239 } 240 done: 241 VN_RELE(nvp); 242 args->pathname = opath; 243 pn_free(&resolvepn); 244 fail: 245 kmem_free(idata.intp, INTPSZ); 246 if (error && fd != -1) 247 (void) execclose(fd); 248 bad: 249 return (error); 250 } 251