1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* Copyright (c) 1988 AT&T */ 29 /* All Rights Reserved */ 30 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/sysmacros.h> 35 #include <sys/systm.h> 36 #include <sys/signal.h> 37 #include <sys/cred_impl.h> 38 #include <sys/policy.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/file.h> 42 #include <sys/vfs.h> 43 #include <sys/vnode.h> 44 #include <sys/mman.h> 45 #include <sys/acct.h> 46 #include <sys/cpuvar.h> 47 #include <sys/proc.h> 48 #include <sys/cmn_err.h> 49 #include <sys/debug.h> 50 #include <sys/pathname.h> 51 #include <sys/vm.h> 52 #include <sys/vtrace.h> 53 #include <sys/exec.h> 54 #include <sys/exechdr.h> 55 #include <sys/kmem.h> 56 #include <sys/prsystm.h> 57 #include <sys/modctl.h> 58 #include <sys/vmparam.h> 59 #include <sys/schedctl.h> 60 #include <sys/utrap.h> 61 #include <sys/systeminfo.h> 62 #include <sys/stack.h> 63 #include <sys/rctl.h> 64 #include <sys/dtrace.h> 65 #include <sys/lwpchan_impl.h> 66 #include <sys/pool.h> 67 #include <sys/sdt.h> 68 69 #include <c2/audit.h> 70 71 #include <vm/hat.h> 72 #include <vm/anon.h> 73 #include <vm/as.h> 74 #include <vm/seg.h> 75 #include <vm/seg_vn.h> 76 77 #define PRIV_RESET 0x01 /* needs to reset privs */ 78 #define PRIV_SETID 0x02 /* needs to change uids */ 79 #define PRIV_SETUGID 0x04 /* is setuid/setgid/forced privs */ 80 #define PRIV_INCREASE 0x08 /* child runs with more privs */ 81 82 static int execsetid(struct vnode *, struct vattr *, uid_t *, uid_t *); 83 static int hold_execsw(struct execsw *); 84 85 uint_t auxv_hwcap = 0; /* auxv AT_SUN_HWCAP value; determined on the fly */ 86 #if defined(_SYSCALL32_IMPL) 87 uint_t auxv_hwcap32 = 0; /* 32-bit version of auxv_hwcap */ 88 #endif 89 90 int exec_lpg_disable = 0; 91 92 #define PSUIDFLAGS (SNOCD|SUGID) 93 94 /* 95 * exec() - wrapper around exece providing NULL environment pointer 96 */ 97 int 98 exec(const char *fname, const char **argp) 99 { 100 return (exece(fname, argp, NULL)); 101 } 102 103 /* 104 * exece() - system call wrapper around exec_common() 105 */ 106 int 107 exece(const char *fname, const char **argp, const char **envp) 108 { 109 int error; 110 111 error = exec_common(fname, argp, envp); 112 return (error ? (set_errno(error)) : 0); 113 } 114 115 int 116 exec_common(const char *fname, const char **argp, const char **envp) 117 { 118 vnode_t *vp = NULL, *dir = NULL, *tmpvp = NULL; 119 proc_t *p = ttoproc(curthread); 120 klwp_t *lwp = ttolwp(curthread); 121 struct user *up = PTOU(p); 122 long execsz; /* temporary count of exec size */ 123 int i; 124 int error; 125 char exec_file[MAXCOMLEN+1]; 126 struct pathname pn; 127 struct pathname resolvepn; 128 struct uarg args; 129 struct execa ua; 130 k_sigset_t savedmask; 131 lwpdir_t *lwpdir = NULL; 132 lwpdir_t **tidhash; 133 lwpdir_t *old_lwpdir = NULL; 134 uint_t old_lwpdir_sz; 135 lwpdir_t **old_tidhash; 136 uint_t old_tidhash_sz; 137 lwpent_t *lep; 138 139 /* 140 * exec() is not supported for the /proc agent lwp. 141 */ 142 if (curthread == p->p_agenttp) 143 return (ENOTSUP); 144 145 if ((error = secpolicy_basic_exec(CRED())) != 0) 146 return (error); 147 148 /* 149 * Inform /proc that an exec() has started. 150 * Hold signals that are ignored by default so that we will 151 * not be interrupted by a signal that will be ignored after 152 * successful completion of gexec(). 153 */ 154 mutex_enter(&p->p_lock); 155 prexecstart(); 156 schedctl_finish_sigblock(curthread); 157 savedmask = curthread->t_hold; 158 sigorset(&curthread->t_hold, &ignoredefault); 159 mutex_exit(&p->p_lock); 160 161 /* 162 * Look up path name and remember last component for later. 163 * To help coreadm expand its %d token, we attempt to save 164 * the directory containing the executable in p_execdir. The 165 * first call to lookuppn() may fail and return EINVAL because 166 * dirvpp is non-NULL. In that case, we make a second call to 167 * lookuppn() with dirvpp set to NULL; p_execdir will be NULL, 168 * but coreadm is allowed to expand %d to the empty string and 169 * there are other cases in which that failure may occur. 170 */ 171 if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0) 172 goto out; 173 pn_alloc(&resolvepn); 174 if ((error = lookuppn(&pn, &resolvepn, FOLLOW, &dir, &vp)) != 0) { 175 pn_free(&resolvepn); 176 pn_free(&pn); 177 if (error != EINVAL) 178 goto out; 179 180 dir = NULL; 181 if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0) 182 goto out; 183 pn_alloc(&resolvepn); 184 if ((error = lookuppn(&pn, &resolvepn, FOLLOW, NULLVPP, 185 &vp)) != 0) { 186 pn_free(&resolvepn); 187 pn_free(&pn); 188 goto out; 189 } 190 } 191 if (vp == NULL) { 192 if (dir != NULL) 193 VN_RELE(dir); 194 error = ENOENT; 195 pn_free(&resolvepn); 196 pn_free(&pn); 197 goto out; 198 } 199 200 /* 201 * We do not allow executing files in attribute directories. 202 * We test this by determining whether the resolved path 203 * contains a "/" when we're in an attribute directory; 204 * only if the pathname does not contain a "/" the resolved path 205 * points to a file in the current working (attribute) directory. 206 */ 207 if ((p->p_user.u_cdir->v_flag & V_XATTRDIR) != 0 && 208 strchr(resolvepn.pn_path, '/') == NULL) { 209 if (dir != NULL) 210 VN_RELE(dir); 211 error = EACCES; 212 pn_free(&resolvepn); 213 pn_free(&pn); 214 VN_RELE(vp); 215 goto out; 216 } 217 218 bzero(exec_file, MAXCOMLEN+1); 219 (void) strncpy(exec_file, pn.pn_path, MAXCOMLEN); 220 bzero(&args, sizeof (args)); 221 args.pathname = resolvepn.pn_path; 222 /* don't free resolvepn until we are done with args */ 223 pn_free(&pn); 224 225 /* 226 * Specific exec handlers, or policies determined via 227 * /etc/system may override the historical default. 228 */ 229 args.stk_prot = PROT_ZFOD; 230 args.dat_prot = PROT_ZFOD; 231 232 CPU_STATS_ADD_K(sys, sysexec, 1); 233 DTRACE_PROC1(exec, char *, args.pathname); 234 235 ua.fname = fname; 236 ua.argp = argp; 237 ua.envp = envp; 238 239 if ((error = gexec(&vp, &ua, &args, NULL, 0, &execsz, 240 exec_file, p->p_cred)) != 0) { 241 VN_RELE(vp); 242 if (dir != NULL) 243 VN_RELE(dir); 244 pn_free(&resolvepn); 245 goto fail; 246 } 247 248 /* 249 * Free floating point registers (sun4u only) 250 */ 251 ASSERT(lwp != NULL); 252 lwp_freeregs(lwp, 1); 253 254 /* 255 * Free thread and process context ops. 256 */ 257 if (curthread->t_ctx) 258 freectx(curthread, 1); 259 if (p->p_pctx) 260 freepctx(p, 1); 261 262 /* 263 * Remember file name for accounting; clear any cached DTrace predicate. 264 */ 265 up->u_acflag &= ~AFORK; 266 bcopy(exec_file, up->u_comm, MAXCOMLEN+1); 267 curthread->t_predcache = NULL; 268 269 /* 270 * Clear contract template state 271 */ 272 lwp_ctmpl_clear(lwp); 273 274 /* 275 * Save the directory in which we found the executable for expanding 276 * the %d token used in core file patterns. 277 */ 278 mutex_enter(&p->p_lock); 279 tmpvp = p->p_execdir; 280 p->p_execdir = dir; 281 if (p->p_execdir != NULL) 282 VN_HOLD(p->p_execdir); 283 mutex_exit(&p->p_lock); 284 285 if (tmpvp != NULL) 286 VN_RELE(tmpvp); 287 288 /* 289 * Reset stack state to the user stack, clear set of signals 290 * caught on the signal stack, and reset list of signals that 291 * restart system calls; the new program's environment should 292 * not be affected by detritus from the old program. Any 293 * pending held signals remain held, so don't clear t_hold. 294 */ 295 mutex_enter(&p->p_lock); 296 lwp->lwp_oldcontext = 0; 297 lwp->lwp_ustack = 0; 298 lwp->lwp_old_stk_ctl = 0; 299 sigemptyset(&up->u_signodefer); 300 sigemptyset(&up->u_sigonstack); 301 sigemptyset(&up->u_sigresethand); 302 lwp->lwp_sigaltstack.ss_sp = 0; 303 lwp->lwp_sigaltstack.ss_size = 0; 304 lwp->lwp_sigaltstack.ss_flags = SS_DISABLE; 305 306 /* 307 * Make saved resource limit == current resource limit. 308 */ 309 for (i = 0; i < RLIM_NLIMITS; i++) { 310 /*CONSTCOND*/ 311 if (RLIM_SAVED(i)) { 312 (void) rctl_rlimit_get(rctlproc_legacy[i], p, 313 &up->u_saved_rlimit[i]); 314 } 315 } 316 317 /* 318 * If the action was to catch the signal, then the action 319 * must be reset to SIG_DFL. 320 */ 321 sigdefault(p); 322 p->p_flag &= ~(SNOWAIT|SJCTL); 323 p->p_flag |= (SEXECED|SMSACCT|SMSFORK); 324 up->u_signal[SIGCLD - 1] = SIG_DFL; 325 326 /* 327 * Delete the dot4 sigqueues/signotifies. 328 */ 329 sigqfree(p); 330 331 mutex_exit(&p->p_lock); 332 333 mutex_enter(&p->p_pflock); 334 p->p_prof.pr_base = NULL; 335 p->p_prof.pr_size = 0; 336 p->p_prof.pr_off = 0; 337 p->p_prof.pr_scale = 0; 338 p->p_prof.pr_samples = 0; 339 mutex_exit(&p->p_pflock); 340 341 ASSERT(curthread->t_schedctl == NULL); 342 343 #if defined(__sparc) 344 if (p->p_utraps != NULL) 345 utrap_free(p); 346 #endif /* __sparc */ 347 348 /* 349 * Close all close-on-exec files. 350 */ 351 close_exec(P_FINFO(p)); 352 TRACE_2(TR_FAC_PROC, TR_PROC_EXEC, "proc_exec:p %p up %p", p, up); 353 setregs(&args); 354 355 /* Mark this as an executable vnode */ 356 mutex_enter(&vp->v_lock); 357 vp->v_flag |= VVMEXEC; 358 mutex_exit(&vp->v_lock); 359 360 VN_RELE(vp); 361 if (dir != NULL) 362 VN_RELE(dir); 363 pn_free(&resolvepn); 364 365 /* 366 * Allocate a new lwp directory and lwpid hash table if necessary. 367 */ 368 if (curthread->t_tid != 1 || p->p_lwpdir_sz != 2) { 369 lwpdir = kmem_zalloc(2 * sizeof (lwpdir_t), KM_SLEEP); 370 lwpdir->ld_next = lwpdir + 1; 371 tidhash = kmem_zalloc(2 * sizeof (lwpdir_t *), KM_SLEEP); 372 if (p->p_lwpdir != NULL) 373 lep = p->p_lwpdir[curthread->t_dslot].ld_entry; 374 else 375 lep = kmem_zalloc(sizeof (*lep), KM_SLEEP); 376 } 377 378 mutex_enter(&p->p_lock); 379 prbarrier(p); 380 381 /* 382 * Reset lwp id to the default value of 1. 383 * This is a single-threaded process now 384 * and lwp #1 is lwp_wait()able by default. 385 * The t_unpark flag should not be inherited. 386 */ 387 ASSERT(p->p_lwpcnt == 1 && p->p_zombcnt == 0); 388 curthread->t_tid = 1; 389 curthread->t_unpark = 0; 390 curthread->t_proc_flag |= TP_TWAIT; 391 curthread->t_proc_flag &= ~TP_DAEMON; /* daemons shouldn't exec */ 392 p->p_lwpdaemon = 0; /* but oh well ... */ 393 p->p_lwpid = 1; 394 395 /* 396 * Install the newly-allocated lwp directory and lwpid hash table 397 * and insert the current thread into the new hash table. 398 */ 399 if (lwpdir != NULL) { 400 old_lwpdir = p->p_lwpdir; 401 old_lwpdir_sz = p->p_lwpdir_sz; 402 old_tidhash = p->p_tidhash; 403 old_tidhash_sz = p->p_tidhash_sz; 404 p->p_lwpdir = p->p_lwpfree = lwpdir; 405 p->p_lwpdir_sz = 2; 406 p->p_tidhash = tidhash; 407 p->p_tidhash_sz = 2; 408 lep->le_thread = curthread; 409 lep->le_lwpid = curthread->t_tid; 410 lep->le_start = curthread->t_start; 411 lwp_hash_in(p, lep); 412 } 413 /* 414 * Restore the saved signal mask and 415 * inform /proc that the exec() has finished. 416 */ 417 curthread->t_hold = savedmask; 418 prexecend(); 419 mutex_exit(&p->p_lock); 420 if (old_lwpdir) { 421 kmem_free(old_lwpdir, old_lwpdir_sz * sizeof (lwpdir_t)); 422 kmem_free(old_tidhash, old_tidhash_sz * sizeof (lwpdir_t *)); 423 } 424 ASSERT(error == 0); 425 DTRACE_PROC(exec__success); 426 return (0); 427 428 fail: 429 DTRACE_PROC1(exec__failure, int, error); 430 out: /* error return */ 431 mutex_enter(&p->p_lock); 432 curthread->t_hold = savedmask; 433 prexecend(); 434 mutex_exit(&p->p_lock); 435 ASSERT(error != 0); 436 return (error); 437 } 438 439 440 /* 441 * Perform generic exec duties and switchout to object-file specific 442 * handler. 443 */ 444 int 445 gexec( 446 struct vnode **vpp, 447 struct execa *uap, 448 struct uarg *args, 449 struct intpdata *idatap, 450 int level, 451 long *execsz, 452 caddr_t exec_file, 453 struct cred *cred) 454 { 455 struct vnode *vp; 456 proc_t *pp = ttoproc(curthread); 457 struct execsw *eswp; 458 int error = 0; 459 int suidflags = 0; 460 ssize_t resid; 461 uid_t uid, gid; 462 struct vattr vattr; 463 char magbuf[MAGIC_BYTES]; 464 int setid; 465 cred_t *oldcred, *newcred = NULL; 466 int privflags = 0; 467 468 /* 469 * If the SNOCD or SUGID flag is set, turn it off and remember the 470 * previous setting so we can restore it if we encounter an error. 471 */ 472 if (level == 0 && (pp->p_flag & PSUIDFLAGS)) { 473 mutex_enter(&pp->p_lock); 474 suidflags = pp->p_flag & PSUIDFLAGS; 475 pp->p_flag &= ~PSUIDFLAGS; 476 mutex_exit(&pp->p_lock); 477 } 478 479 if ((error = execpermissions(*vpp, &vattr, args)) != 0) 480 goto bad; 481 482 /* need to open vnode for stateful file systems like rfs */ 483 if ((error = VOP_OPEN(vpp, FREAD, CRED())) != 0) 484 goto bad; 485 vp = *vpp; 486 487 /* 488 * Note: to support binary compatibility with SunOS a.out 489 * executables, we read in the first four bytes, as the 490 * magic number is in bytes 2-3. 491 */ 492 if (error = vn_rdwr(UIO_READ, vp, magbuf, sizeof (magbuf), 493 (offset_t)0, UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) 494 goto bad; 495 if (resid != 0) 496 goto bad; 497 498 if ((eswp = findexec_by_hdr(magbuf)) == NULL) 499 goto bad; 500 501 if (level == 0 && 502 (privflags = execsetid(vp, &vattr, &uid, &gid)) != 0) { 503 504 newcred = cred = crdup(cred); 505 506 /* If we can, drop the PA bit */ 507 if ((privflags & PRIV_RESET) != 0) 508 priv_adjust_PA(cred); 509 510 if (privflags & PRIV_SETID) { 511 cred->cr_uid = uid; 512 cred->cr_gid = gid; 513 cred->cr_suid = uid; 514 cred->cr_sgid = gid; 515 } 516 517 /* 518 * Implement the privilege updates: 519 * 520 * Restrict with L: 521 * 522 * I' = I & L 523 * 524 * E' = P' = (I' + F) & A 525 * 526 * But if running under ptrace, we cap I with P. 527 */ 528 if ((privflags & PRIV_RESET) != 0) { 529 if ((privflags & PRIV_INCREASE) != 0 && 530 (pp->p_proc_flag & P_PR_PTRACE) != 0) 531 priv_intersect(&CR_OPPRIV(cred), 532 &CR_IPRIV(cred)); 533 priv_intersect(&CR_LPRIV(cred), &CR_IPRIV(cred)); 534 CR_EPRIV(cred) = CR_PPRIV(cred) = CR_IPRIV(cred); 535 priv_adjust_PA(cred); 536 } 537 } 538 539 /* SunOS 4.x buy-back */ 540 if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) && 541 (vattr.va_mode & (VSUID|VSGID))) { 542 cmn_err(CE_NOTE, 543 "!%s, uid %d: setuid execution not allowed, dev=%lx", 544 exec_file, cred->cr_uid, vp->v_vfsp->vfs_dev); 545 } 546 547 /* 548 * execsetid() told us whether or not we had to change the 549 * credentials of the process. In privflags, it told us 550 * whether we gained any privileges or executed a set-uid executable. 551 */ 552 setid = (privflags & (PRIV_SETUGID|PRIV_INCREASE)); 553 554 /* 555 * Use /etc/system variable to determine if the stack 556 * should be marked as executable by default. 557 */ 558 if (noexec_user_stack) 559 args->stk_prot &= ~PROT_EXEC; 560 561 args->execswp = eswp; /* Save execsw pointer in uarg for exec_func */ 562 563 /* 564 * Traditionally, the setid flags told the sub processes whether 565 * the file just executed was set-uid or set-gid; this caused 566 * some confusion as the 'setid' flag did not match the SUGID 567 * process flag which is only set when the uids/gids do not match. 568 * A script set-gid/set-uid to the real uid/gid would start with 569 * /dev/fd/X but an executable would happily trust LD_LIBRARY_PATH. 570 * Now we flag those cases where the calling process cannot 571 * be trusted to influence the newly exec'ed process, either 572 * because it runs with more privileges or when the uids/gids 573 * do in fact not match. 574 * This also makes the runtime linker agree with the on exec 575 * values of SNOCD and SUGID. 576 */ 577 error = (*eswp->exec_func)(vp, uap, args, idatap, level, execsz, 578 (setid & PRIV_INCREASE) != 0 || 579 cred->cr_uid != cred->cr_ruid || 580 (cred->cr_rgid != cred->cr_gid && 581 !supgroupmember(cred->cr_gid, cred)), exec_file, cred); 582 rw_exit(eswp->exec_lock); 583 if (error != 0) { 584 if (newcred != NULL) 585 crfree(newcred); 586 goto bad; 587 } 588 589 if (level == 0) { 590 mutex_enter(&pp->p_crlock); 591 if (newcred != NULL) { 592 /* 593 * Free the old credentials, and set the new ones. 594 * Do this for both the process and the (single) thread. 595 */ 596 crfree(pp->p_cred); 597 pp->p_cred = cred; /* cred already held for proc */ 598 crhold(cred); /* hold new cred for thread */ 599 /* 600 * DTrace accesses t_cred in probe context. t_cred 601 * must always be either NULL, or point to a valid, 602 * allocated cred structure. 603 */ 604 oldcred = curthread->t_cred; 605 curthread->t_cred = cred; 606 crfree(oldcred); 607 } 608 /* 609 * On emerging from a successful exec(), the saved 610 * uid and gid equal the effective uid and gid. 611 */ 612 cred->cr_suid = cred->cr_uid; 613 cred->cr_sgid = cred->cr_gid; 614 615 /* 616 * If the real and effective ids do not match, this 617 * is a setuid process that should not dump core. 618 * The group comparison is tricky; we prevent the code 619 * from flagging SNOCD when executing with an effective gid 620 * which is a supplementary group. 621 */ 622 if (cred->cr_ruid != cred->cr_uid || 623 (cred->cr_rgid != cred->cr_gid && 624 !supgroupmember(cred->cr_gid, cred)) || 625 (privflags & PRIV_INCREASE) != 0) 626 suidflags = PSUIDFLAGS; 627 else 628 suidflags = 0; 629 630 mutex_exit(&pp->p_crlock); 631 if (suidflags) { 632 mutex_enter(&pp->p_lock); 633 pp->p_flag |= suidflags; 634 mutex_exit(&pp->p_lock); 635 } 636 if (setid && (pp->p_proc_flag & P_PR_PTRACE) == 0) { 637 /* 638 * If process is traced via /proc, arrange to 639 * invalidate the associated /proc vnode. 640 */ 641 if (pp->p_plist || (pp->p_proc_flag & P_PR_TRACE)) 642 args->traceinval = 1; 643 } 644 if (pp->p_proc_flag & P_PR_PTRACE) 645 psignal(pp, SIGTRAP); 646 if (args->traceinval) 647 prinvalidate(&pp->p_user); 648 } 649 650 return (0); 651 bad: 652 if (error == 0) 653 error = ENOEXEC; 654 655 if (suidflags) { 656 mutex_enter(&pp->p_lock); 657 pp->p_flag |= suidflags; 658 mutex_exit(&pp->p_lock); 659 } 660 return (error); 661 } 662 663 extern char *execswnames[]; 664 665 struct execsw * 666 allocate_execsw(char *name, char *magic, size_t magic_size) 667 { 668 int i, j; 669 char *ename; 670 char *magicp; 671 672 mutex_enter(&execsw_lock); 673 for (i = 0; i < nexectype; i++) { 674 if (execswnames[i] == NULL) { 675 ename = kmem_alloc(strlen(name) + 1, KM_SLEEP); 676 (void) strcpy(ename, name); 677 execswnames[i] = ename; 678 /* 679 * Set the magic number last so that we 680 * don't need to hold the execsw_lock in 681 * findexectype(). 682 */ 683 magicp = kmem_alloc(magic_size, KM_SLEEP); 684 for (j = 0; j < magic_size; j++) 685 magicp[j] = magic[j]; 686 execsw[i].exec_magic = magicp; 687 mutex_exit(&execsw_lock); 688 return (&execsw[i]); 689 } 690 } 691 mutex_exit(&execsw_lock); 692 return (NULL); 693 } 694 695 /* 696 * Find the exec switch table entry with the corresponding magic string. 697 */ 698 struct execsw * 699 findexecsw(char *magic) 700 { 701 struct execsw *eswp; 702 703 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) { 704 ASSERT(eswp->exec_maglen <= MAGIC_BYTES); 705 if (magic && eswp->exec_maglen != 0 && 706 bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0) 707 return (eswp); 708 } 709 return (NULL); 710 } 711 712 /* 713 * Find the execsw[] index for the given exec header string by looking for the 714 * magic string at a specified offset and length for each kind of executable 715 * file format until one matches. If no execsw[] entry is found, try to 716 * autoload a module for this magic string. 717 */ 718 struct execsw * 719 findexec_by_hdr(char *header) 720 { 721 struct execsw *eswp; 722 723 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) { 724 ASSERT(eswp->exec_maglen <= MAGIC_BYTES); 725 if (header && eswp->exec_maglen != 0 && 726 bcmp(&header[eswp->exec_magoff], eswp->exec_magic, 727 eswp->exec_maglen) == 0) { 728 if (hold_execsw(eswp) != 0) 729 return (NULL); 730 return (eswp); 731 } 732 } 733 return (NULL); /* couldn't find the type */ 734 } 735 736 /* 737 * Find the execsw[] index for the given magic string. If no execsw[] entry 738 * is found, try to autoload a module for this magic string. 739 */ 740 struct execsw * 741 findexec_by_magic(char *magic) 742 { 743 struct execsw *eswp; 744 745 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) { 746 ASSERT(eswp->exec_maglen <= MAGIC_BYTES); 747 if (magic && eswp->exec_maglen != 0 && 748 bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0) { 749 if (hold_execsw(eswp) != 0) 750 return (NULL); 751 return (eswp); 752 } 753 } 754 return (NULL); /* couldn't find the type */ 755 } 756 757 static int 758 hold_execsw(struct execsw *eswp) 759 { 760 char *name; 761 762 rw_enter(eswp->exec_lock, RW_READER); 763 while (!LOADED_EXEC(eswp)) { 764 rw_exit(eswp->exec_lock); 765 name = execswnames[eswp-execsw]; 766 ASSERT(name); 767 if (modload("exec", name) == -1) 768 return (-1); 769 rw_enter(eswp->exec_lock, RW_READER); 770 } 771 return (0); 772 } 773 774 static int 775 execsetid(struct vnode *vp, struct vattr *vattrp, uid_t *uidp, uid_t *gidp) 776 { 777 proc_t *pp = ttoproc(curthread); 778 uid_t uid, gid; 779 cred_t *cr = pp->p_cred; 780 int privflags = 0; 781 782 /* 783 * Remember credentials. 784 */ 785 uid = cr->cr_uid; 786 gid = cr->cr_gid; 787 788 /* Will try to reset the PRIV_AWARE bit later. */ 789 if ((CR_FLAGS(cr) & (PRIV_AWARE|PRIV_AWARE_INHERIT)) == PRIV_AWARE) 790 privflags |= PRIV_RESET; 791 792 if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) == 0) { 793 /* 794 * Set-uid root execution only allowed if the limit set 795 * holds all unsafe privileges. 796 */ 797 if ((vattrp->va_mode & VSUID) && (vattrp->va_uid != 0 || 798 priv_issubset(&priv_unsafe, &CR_LPRIV(cr)))) { 799 uid = vattrp->va_uid; 800 privflags |= PRIV_SETUGID; 801 } 802 if (vattrp->va_mode & VSGID) { 803 gid = vattrp->va_gid; 804 privflags |= PRIV_SETUGID; 805 } 806 } 807 808 /* 809 * Do we need to change our credential anyway? 810 * This is the case when E != I or P != I, as 811 * we need to do the assignments (with F empty and A full) 812 * Or when I is not a subset of L; in that case we need to 813 * enforce L. 814 * 815 * I' = L & I 816 * 817 * E' = P' = (I' + F) & A 818 * or 819 * E' = P' = I' 820 */ 821 if (!priv_isequalset(&CR_EPRIV(cr), &CR_IPRIV(cr)) || 822 !priv_issubset(&CR_IPRIV(cr), &CR_LPRIV(cr)) || 823 !priv_isequalset(&CR_PPRIV(cr), &CR_IPRIV(cr))) 824 privflags |= PRIV_RESET; 825 826 /* 827 * When we introduce the "forced" set then we will need 828 * to set PRIV_INCREASE here if I not a subset of P. 829 * If the "allowed" set is introduced we will need to do 830 * a similar thing; however, it seems more reasonable to 831 * have the allowed set reduce "L": script language interpreters 832 * would typically have an allowed set of "all". 833 */ 834 835 /* 836 * Set setuid/setgid protections if no ptrace() compatibility. 837 * For privileged processes, honor setuid/setgid even in 838 * the presence of ptrace() compatibility. 839 */ 840 if (((pp->p_proc_flag & P_PR_PTRACE) == 0 || 841 PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, (uid == 0))) && 842 (cr->cr_uid != uid || 843 cr->cr_gid != gid || 844 cr->cr_suid != uid || 845 cr->cr_sgid != gid)) { 846 *uidp = uid; 847 *gidp = gid; 848 privflags |= PRIV_SETID; 849 } 850 return (privflags); 851 } 852 853 int 854 execpermissions(struct vnode *vp, struct vattr *vattrp, struct uarg *args) 855 { 856 int error; 857 proc_t *p = ttoproc(curthread); 858 859 vattrp->va_mask = AT_MODE | AT_UID | AT_GID | AT_SIZE; 860 if (error = VOP_GETATTR(vp, vattrp, ATTR_EXEC, p->p_cred)) 861 return (error); 862 /* 863 * Check the access mode. 864 * If VPROC, ask /proc if the file is an object file. 865 */ 866 if ((error = VOP_ACCESS(vp, VEXEC, 0, p->p_cred)) != 0 || 867 !(vp->v_type == VREG || (vp->v_type == VPROC && pr_isobject(vp))) || 868 (vp->v_vfsp->vfs_flag & VFS_NOEXEC) != 0 || 869 (vattrp->va_mode & (VEXEC|(VEXEC>>3)|(VEXEC>>6))) == 0) { 870 if (error == 0) 871 error = EACCES; 872 return (error); 873 } 874 875 if ((p->p_plist || (p->p_proc_flag & (P_PR_PTRACE|P_PR_TRACE))) && 876 (error = VOP_ACCESS(vp, VREAD, 0, p->p_cred))) { 877 /* 878 * If process is under ptrace(2) compatibility, 879 * fail the exec(2). 880 */ 881 if (p->p_proc_flag & P_PR_PTRACE) 882 goto bad; 883 /* 884 * Process is traced via /proc. 885 * Arrange to invalidate the /proc vnode. 886 */ 887 args->traceinval = 1; 888 } 889 return (0); 890 bad: 891 if (error == 0) 892 error = ENOEXEC; 893 return (error); 894 } 895 896 /* 897 * Map a section of an executable file into the user's 898 * address space. 899 */ 900 int 901 execmap(struct vnode *vp, caddr_t addr, size_t len, size_t zfodlen, 902 off_t offset, int prot, int page, uint_t szc) 903 { 904 int error = 0; 905 off_t oldoffset; 906 caddr_t zfodbase, oldaddr; 907 size_t end, oldlen; 908 size_t zfoddiff; 909 label_t ljb; 910 proc_t *p = ttoproc(curthread); 911 912 oldaddr = addr; 913 addr = (caddr_t)((uintptr_t)addr & (uintptr_t)PAGEMASK); 914 if (len) { 915 oldlen = len; 916 len += ((size_t)oldaddr - (size_t)addr); 917 oldoffset = offset; 918 offset = (off_t)((uintptr_t)offset & PAGEMASK); 919 if (page) { 920 spgcnt_t prefltmem, availm, npages; 921 int preread; 922 uint_t mflag = MAP_PRIVATE | MAP_FIXED; 923 924 if ((prot & (PROT_WRITE | PROT_EXEC)) == PROT_EXEC) { 925 mflag |= MAP_TEXT; 926 } else { 927 mflag |= MAP_INITDATA; 928 } 929 930 if (valid_usr_range(addr, len, prot, p->p_as, 931 p->p_as->a_userlimit) != RANGE_OKAY) { 932 error = ENOMEM; 933 goto bad; 934 } 935 if (error = VOP_MAP(vp, (offset_t)offset, 936 p->p_as, &addr, len, prot, PROT_ALL, 937 mflag, CRED())) 938 goto bad; 939 940 /* 941 * If the segment can fit, then we prefault 942 * the entire segment in. This is based on the 943 * model that says the best working set of a 944 * small program is all of its pages. 945 */ 946 npages = (spgcnt_t)btopr(len); 947 prefltmem = freemem - desfree; 948 preread = 949 (npages < prefltmem && len < PGTHRESH) ? 1 : 0; 950 951 /* 952 * If we aren't prefaulting the segment, 953 * increment "deficit", if necessary to ensure 954 * that pages will become available when this 955 * process starts executing. 956 */ 957 availm = freemem - lotsfree; 958 if (preread == 0 && npages > availm && 959 deficit < lotsfree) { 960 deficit += MIN((pgcnt_t)(npages - availm), 961 lotsfree - deficit); 962 } 963 964 if (preread) { 965 TRACE_2(TR_FAC_PROC, TR_EXECMAP_PREREAD, 966 "execmap preread:freemem %d size %lu", 967 freemem, len); 968 (void) as_fault(p->p_as->a_hat, p->p_as, 969 (caddr_t)addr, len, F_INVAL, S_READ); 970 } 971 } else { 972 if (valid_usr_range(addr, len, prot, p->p_as, 973 p->p_as->a_userlimit) != RANGE_OKAY) { 974 error = ENOMEM; 975 goto bad; 976 } 977 978 if (error = as_map(p->p_as, addr, len, 979 segvn_create, zfod_argsp)) 980 goto bad; 981 /* 982 * Read in the segment in one big chunk. 983 */ 984 if (error = vn_rdwr(UIO_READ, vp, (caddr_t)oldaddr, 985 oldlen, (offset_t)oldoffset, UIO_USERSPACE, 0, 986 (rlim64_t)0, CRED(), (ssize_t *)0)) 987 goto bad; 988 /* 989 * Now set protections. 990 */ 991 if (prot != PROT_ZFOD) { 992 (void) as_setprot(p->p_as, (caddr_t)addr, 993 len, prot); 994 } 995 } 996 } 997 998 if (zfodlen) { 999 end = (size_t)addr + len; 1000 zfodbase = (caddr_t)roundup(end, PAGESIZE); 1001 zfoddiff = (uintptr_t)zfodbase - end; 1002 if (zfoddiff) { 1003 if (on_fault(&ljb)) { 1004 no_fault(); 1005 error = EFAULT; 1006 goto bad; 1007 } 1008 uzero((void *)end, zfoddiff); 1009 no_fault(); 1010 } 1011 if (zfodlen > zfoddiff) { 1012 struct segvn_crargs crargs = 1013 SEGVN_ZFOD_ARGS(PROT_ZFOD, PROT_ALL); 1014 1015 zfodlen -= zfoddiff; 1016 if (valid_usr_range(zfodbase, zfodlen, prot, p->p_as, 1017 p->p_as->a_userlimit) != RANGE_OKAY) { 1018 error = ENOMEM; 1019 goto bad; 1020 } 1021 crargs.szc = szc; 1022 if (error = as_map(p->p_as, (caddr_t)zfodbase, 1023 zfodlen, segvn_create, &crargs)) 1024 goto bad; 1025 if (prot != PROT_ZFOD) { 1026 (void) as_setprot(p->p_as, (caddr_t)zfodbase, 1027 zfodlen, prot); 1028 } 1029 } 1030 } 1031 return (0); 1032 bad: 1033 return (error); 1034 } 1035 1036 void 1037 setexecenv(struct execenv *ep) 1038 { 1039 proc_t *p = ttoproc(curthread); 1040 klwp_t *lwp = ttolwp(curthread); 1041 struct vnode *vp; 1042 1043 p->p_bssbase = ep->ex_bssbase; 1044 p->p_brkbase = ep->ex_brkbase; 1045 p->p_brksize = ep->ex_brksize; 1046 if (p->p_exec) 1047 VN_RELE(p->p_exec); /* out with the old */ 1048 vp = p->p_exec = ep->ex_vp; 1049 if (vp != NULL) 1050 VN_HOLD(vp); /* in with the new */ 1051 1052 lwp->lwp_sigaltstack.ss_sp = 0; 1053 lwp->lwp_sigaltstack.ss_size = 0; 1054 lwp->lwp_sigaltstack.ss_flags = SS_DISABLE; 1055 } 1056 1057 int 1058 execopen(struct vnode **vpp, int *fdp) 1059 { 1060 struct vnode *vp = *vpp; 1061 file_t *fp; 1062 int error = 0; 1063 int filemode = FREAD; 1064 1065 VN_HOLD(vp); /* open reference */ 1066 if (error = falloc(NULL, filemode, &fp, fdp)) { 1067 VN_RELE(vp); 1068 *fdp = -1; /* just in case falloc changed value */ 1069 return (error); 1070 } 1071 if (error = VOP_OPEN(&vp, filemode, CRED())) { 1072 VN_RELE(vp); 1073 setf(*fdp, NULL); 1074 unfalloc(fp); 1075 *fdp = -1; 1076 return (error); 1077 } 1078 *vpp = vp; /* vnode should not have changed */ 1079 fp->f_vnode = vp; 1080 mutex_exit(&fp->f_tlock); 1081 setf(*fdp, fp); 1082 return (0); 1083 } 1084 1085 int 1086 execclose(int fd) 1087 { 1088 return (closeandsetf(fd, NULL)); 1089 } 1090 1091 1092 /* 1093 * noexec stub function. 1094 */ 1095 /*ARGSUSED*/ 1096 int 1097 noexec( 1098 struct vnode *vp, 1099 struct execa *uap, 1100 struct uarg *args, 1101 struct intpdata *idatap, 1102 int level, 1103 long *execsz, 1104 int setid, 1105 caddr_t exec_file, 1106 struct cred *cred) 1107 { 1108 cmn_err(CE_WARN, "missing exec capability for %s", uap->fname); 1109 return (ENOEXEC); 1110 } 1111 1112 /* 1113 * Support routines for building a user stack. 1114 * 1115 * execve(path, argv, envp) must construct a new stack with the specified 1116 * arguments and environment variables (see exec_args() for a description 1117 * of the user stack layout). To do this, we copy the arguments and 1118 * environment variables from the old user address space into the kernel, 1119 * free the old as, create the new as, and copy our buffered information 1120 * to the new stack. Our kernel buffer has the following structure: 1121 * 1122 * +-----------------------+ <--- stk_base + stk_size 1123 * | string offsets | 1124 * +-----------------------+ <--- stk_offp 1125 * | | 1126 * | STK_AVAIL() space | 1127 * | | 1128 * +-----------------------+ <--- stk_strp 1129 * | strings | 1130 * +-----------------------+ <--- stk_base 1131 * 1132 * When we add a string, we store the string's contents (including the null 1133 * terminator) at stk_strp, and we store the offset of the string relative to 1134 * stk_base at --stk_offp. At strings are added, stk_strp increases and 1135 * stk_offp decreases. The amount of space remaining, STK_AVAIL(), is just 1136 * the difference between these pointers. If we run out of space, we return 1137 * an error and exec_args() starts all over again with a buffer twice as large. 1138 * When we're all done, the kernel buffer looks like this: 1139 * 1140 * +-----------------------+ <--- stk_base + stk_size 1141 * | argv[0] offset | 1142 * +-----------------------+ 1143 * | ... | 1144 * +-----------------------+ 1145 * | argv[argc-1] offset | 1146 * +-----------------------+ 1147 * | envp[0] offset | 1148 * +-----------------------+ 1149 * | ... | 1150 * +-----------------------+ 1151 * | envp[envc-1] offset | 1152 * +-----------------------+ 1153 * | AT_SUN_PLATFORM offset| 1154 * +-----------------------+ 1155 * | AT_SUN_EXECNAME offset| 1156 * +-----------------------+ <--- stk_offp 1157 * | | 1158 * | STK_AVAIL() space | 1159 * | | 1160 * +-----------------------+ <--- stk_strp 1161 * | AT_SUN_EXECNAME offset| 1162 * +-----------------------+ 1163 * | AT_SUN_PLATFORM offset| 1164 * +-----------------------+ 1165 * | envp[envc-1] string | 1166 * +-----------------------+ 1167 * | ... | 1168 * +-----------------------+ 1169 * | envp[0] string | 1170 * +-----------------------+ 1171 * | argv[argc-1] string | 1172 * +-----------------------+ 1173 * | ... | 1174 * +-----------------------+ 1175 * | argv[0] string | 1176 * +-----------------------+ <--- stk_base 1177 */ 1178 1179 #define STK_AVAIL(args) ((char *)(args)->stk_offp - (args)->stk_strp) 1180 1181 /* 1182 * Add a string to the stack. 1183 */ 1184 static int 1185 stk_add(uarg_t *args, const char *sp, enum uio_seg segflg) 1186 { 1187 int error; 1188 size_t len; 1189 1190 if (STK_AVAIL(args) < sizeof (int)) 1191 return (E2BIG); 1192 *--args->stk_offp = args->stk_strp - args->stk_base; 1193 1194 if (segflg == UIO_USERSPACE) { 1195 error = copyinstr(sp, args->stk_strp, STK_AVAIL(args), &len); 1196 if (error != 0) 1197 return (error); 1198 } else { 1199 len = strlen(sp) + 1; 1200 if (len > STK_AVAIL(args)) 1201 return (E2BIG); 1202 bcopy(sp, args->stk_strp, len); 1203 } 1204 1205 args->stk_strp += len; 1206 1207 return (0); 1208 } 1209 1210 static int 1211 stk_getptr(uarg_t *args, char *src, char **dst) 1212 { 1213 int error; 1214 1215 if (args->from_model == DATAMODEL_NATIVE) { 1216 ulong_t ptr; 1217 error = fulword(src, &ptr); 1218 *dst = (caddr_t)ptr; 1219 } else { 1220 uint32_t ptr; 1221 error = fuword32(src, &ptr); 1222 *dst = (caddr_t)(uintptr_t)ptr; 1223 } 1224 return (error); 1225 } 1226 1227 static int 1228 stk_putptr(uarg_t *args, char *addr, char *value) 1229 { 1230 if (args->to_model == DATAMODEL_NATIVE) 1231 return (sulword(addr, (ulong_t)value)); 1232 else 1233 return (suword32(addr, (uint32_t)(uintptr_t)value)); 1234 } 1235 1236 static int 1237 stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp) 1238 { 1239 char *sp; 1240 int argc, error; 1241 int argv_empty = 0; 1242 size_t ptrsize = args->from_ptrsize; 1243 size_t size, pad; 1244 char *argv = (char *)uap->argp; 1245 char *envp = (char *)uap->envp; 1246 1247 /* 1248 * Copy interpreter's name and argument to argv[0] and argv[1]. 1249 */ 1250 if (intp != NULL && intp->intp_name != NULL) { 1251 if ((error = stk_add(args, intp->intp_name, UIO_SYSSPACE)) != 0) 1252 return (error); 1253 if (intp->intp_arg != NULL && 1254 (error = stk_add(args, intp->intp_arg, UIO_SYSSPACE)) != 0) 1255 return (error); 1256 if (args->fname != NULL) 1257 error = stk_add(args, args->fname, UIO_SYSSPACE); 1258 else 1259 error = stk_add(args, uap->fname, UIO_USERSPACE); 1260 if (error) 1261 return (error); 1262 1263 /* 1264 * Check for an empty argv[]. 1265 */ 1266 if (stk_getptr(args, argv, &sp)) 1267 return (EFAULT); 1268 if (sp == NULL) 1269 argv_empty = 1; 1270 1271 argv += ptrsize; /* ignore original argv[0] */ 1272 } 1273 1274 if (argv_empty == 0) { 1275 /* 1276 * Add argv[] strings to the stack. 1277 */ 1278 for (;;) { 1279 if (stk_getptr(args, argv, &sp)) 1280 return (EFAULT); 1281 if (sp == NULL) 1282 break; 1283 if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0) 1284 return (error); 1285 argv += ptrsize; 1286 } 1287 } 1288 argc = (int *)(args->stk_base + args->stk_size) - args->stk_offp; 1289 args->arglen = args->stk_strp - args->stk_base; 1290 1291 /* 1292 * Add environ[] strings to the stack. 1293 */ 1294 if (envp != NULL) { 1295 for (;;) { 1296 if (stk_getptr(args, envp, &sp)) 1297 return (EFAULT); 1298 if (sp == NULL) 1299 break; 1300 if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0) 1301 return (error); 1302 envp += ptrsize; 1303 } 1304 } 1305 args->na = (int *)(args->stk_base + args->stk_size) - args->stk_offp; 1306 args->ne = args->na - argc; 1307 1308 /* 1309 * Add AT_SUN_PLATFORM and AT_SUN_EXECNAME strings to the stack. 1310 */ 1311 if (auxvpp != NULL && *auxvpp != NULL) { 1312 if ((error = stk_add(args, platform, UIO_SYSSPACE)) != 0) 1313 return (error); 1314 if ((error = stk_add(args, args->pathname, UIO_SYSSPACE)) != 0) 1315 return (error); 1316 } 1317 1318 /* 1319 * Compute the size of the stack. This includes all the pointers, 1320 * the space reserved for the aux vector, and all the strings. 1321 * The total number of pointers is args->na (which is argc + envc) 1322 * plus 4 more: (1) a pointer's worth of space for argc; (2) the NULL 1323 * after the last argument (i.e. argv[argc]); (3) the NULL after the 1324 * last environment variable (i.e. envp[envc]); and (4) the NULL after 1325 * all the strings, at the very top of the stack. 1326 */ 1327 size = (args->na + 4) * args->to_ptrsize + args->auxsize + 1328 (args->stk_strp - args->stk_base); 1329 1330 /* 1331 * Pad the string section with zeroes to align the stack size. 1332 */ 1333 pad = P2NPHASE(size, args->stk_align); 1334 1335 if (STK_AVAIL(args) < pad) 1336 return (E2BIG); 1337 1338 args->usrstack_size = size + pad; 1339 1340 while (pad-- != 0) 1341 *args->stk_strp++ = 0; 1342 1343 args->nc = args->stk_strp - args->stk_base; 1344 1345 return (0); 1346 } 1347 1348 static int 1349 stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up) 1350 { 1351 size_t ptrsize = args->to_ptrsize; 1352 ssize_t pslen; 1353 char *kstrp = args->stk_base; 1354 char *ustrp = usrstack - args->nc - ptrsize; 1355 char *usp = usrstack - args->usrstack_size; 1356 int *offp = (int *)(args->stk_base + args->stk_size); 1357 int envc = args->ne; 1358 int argc = args->na - envc; 1359 int i; 1360 1361 /* 1362 * Record argc for /proc. 1363 */ 1364 up->u_argc = argc; 1365 1366 /* 1367 * Put argc on the stack. Note that even though it's an int, 1368 * it always consumes ptrsize bytes (for alignment). 1369 */ 1370 if (stk_putptr(args, usp, (char *)(uintptr_t)argc)) 1371 return (-1); 1372 1373 /* 1374 * Add argc space (ptrsize) to usp and record argv for /proc. 1375 */ 1376 up->u_argv = (uintptr_t)(usp += ptrsize); 1377 1378 /* 1379 * Put the argv[] pointers on the stack. 1380 */ 1381 for (i = 0; i < argc; i++, usp += ptrsize) 1382 if (stk_putptr(args, usp, &ustrp[*--offp])) 1383 return (-1); 1384 1385 /* 1386 * Copy arguments to u_psargs. 1387 */ 1388 pslen = MIN(args->arglen, PSARGSZ) - 1; 1389 for (i = 0; i < pslen; i++) 1390 up->u_psargs[i] = (kstrp[i] == '\0' ? ' ' : kstrp[i]); 1391 while (i < PSARGSZ) 1392 up->u_psargs[i++] = '\0'; 1393 1394 /* 1395 * Add space for argv[]'s NULL terminator (ptrsize) to usp and 1396 * record envp for /proc. 1397 */ 1398 up->u_envp = (uintptr_t)(usp += ptrsize); 1399 1400 /* 1401 * Put the envp[] pointers on the stack. 1402 */ 1403 for (i = 0; i < envc; i++, usp += ptrsize) 1404 if (stk_putptr(args, usp, &ustrp[*--offp])) 1405 return (-1); 1406 1407 /* 1408 * Add space for envp[]'s NULL terminator (ptrsize) to usp and 1409 * remember where the stack ends, which is also where auxv begins. 1410 */ 1411 args->stackend = usp += ptrsize; 1412 1413 /* 1414 * Put all the argv[], envp[], and auxv strings on the stack. 1415 */ 1416 if (copyout(args->stk_base, ustrp, args->nc)) 1417 return (-1); 1418 1419 /* 1420 * Fill in the aux vector now that we know the user stack addresses 1421 * for the AT_SUN_PLATFORM and AT_SUN_EXECNAME strings. 1422 */ 1423 if (auxvpp != NULL && *auxvpp != NULL) { 1424 if (args->to_model == DATAMODEL_NATIVE) { 1425 auxv_t **a = (auxv_t **)auxvpp; 1426 ADDAUX(*a, AT_SUN_PLATFORM, (long)&ustrp[*--offp]) 1427 ADDAUX(*a, AT_SUN_EXECNAME, (long)&ustrp[*--offp]) 1428 } else { 1429 auxv32_t **a = (auxv32_t **)auxvpp; 1430 ADDAUX(*a, 1431 AT_SUN_PLATFORM, (int)(uintptr_t)&ustrp[*--offp]) 1432 ADDAUX(*a, 1433 AT_SUN_EXECNAME, (int)(uintptr_t)&ustrp[*--offp]); 1434 } 1435 } 1436 1437 return (0); 1438 } 1439 1440 #ifdef DEBUG 1441 int mpss_brkpgszsel = 0; 1442 int mpss_stkpgszsel = 0; 1443 #endif 1444 1445 /* 1446 * Initialize a new user stack with the specified arguments and environment. 1447 * The initial user stack layout is as follows: 1448 * 1449 * User Stack 1450 * +---------------+ <--- curproc->p_usrstack 1451 * | NULL | 1452 * +---------------+ 1453 * | | 1454 * | auxv strings | 1455 * | | 1456 * +---------------+ 1457 * | | 1458 * | envp strings | 1459 * | | 1460 * +---------------+ 1461 * | | 1462 * | argv strings | 1463 * | | 1464 * +---------------+ <--- ustrp 1465 * | | 1466 * | aux vector | 1467 * | | 1468 * +---------------+ <--- auxv 1469 * | NULL | 1470 * +---------------+ 1471 * | envp[envc-1] | 1472 * +---------------+ 1473 * | ... | 1474 * +---------------+ 1475 * | envp[0] | 1476 * +---------------+ <--- envp[] 1477 * | NULL | 1478 * +---------------+ 1479 * | argv[argc-1] | 1480 * +---------------+ 1481 * | ... | 1482 * +---------------+ 1483 * | argv[0] | 1484 * +---------------+ <--- argv[] 1485 * | argc | 1486 * +---------------+ <--- stack base 1487 */ 1488 int 1489 exec_args(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp) 1490 { 1491 size_t size; 1492 int error; 1493 proc_t *p = ttoproc(curthread); 1494 user_t *up = PTOU(p); 1495 char *usrstack; 1496 rctl_entity_p_t e; 1497 1498 struct as *as; 1499 1500 args->from_model = p->p_model; 1501 if (p->p_model == DATAMODEL_NATIVE) { 1502 args->from_ptrsize = sizeof (long); 1503 } else { 1504 args->from_ptrsize = sizeof (int32_t); 1505 } 1506 1507 if (args->to_model == DATAMODEL_NATIVE) { 1508 args->to_ptrsize = sizeof (long); 1509 args->ncargs = NCARGS; 1510 args->stk_align = STACK_ALIGN; 1511 usrstack = (char *)USRSTACK; 1512 } else { 1513 args->to_ptrsize = sizeof (int32_t); 1514 args->ncargs = NCARGS32; 1515 args->stk_align = STACK_ALIGN32; 1516 usrstack = (char *)USRSTACK32; 1517 } 1518 1519 ASSERT(P2PHASE((uintptr_t)usrstack, args->stk_align) == 0); 1520 1521 #if defined(__sparc) 1522 /* 1523 * Make sure user register windows are empty before 1524 * attempting to make a new stack. 1525 */ 1526 (void) flush_user_windows_to_stack(NULL); 1527 #endif 1528 1529 for (size = PAGESIZE; ; size *= 2) { 1530 args->stk_size = size; 1531 args->stk_base = kmem_alloc(size, KM_SLEEP); 1532 args->stk_strp = args->stk_base; 1533 args->stk_offp = (int *)(args->stk_base + size); 1534 error = stk_copyin(uap, args, intp, auxvpp); 1535 if (error == 0) 1536 break; 1537 kmem_free(args->stk_base, size); 1538 if (error != E2BIG && error != ENAMETOOLONG) 1539 return (error); 1540 if (size >= args->ncargs) 1541 return (E2BIG); 1542 } 1543 1544 size = args->usrstack_size; 1545 1546 ASSERT(error == 0); 1547 ASSERT(P2PHASE(size, args->stk_align) == 0); 1548 ASSERT((ssize_t)STK_AVAIL(args) >= 0); 1549 1550 if (size > args->ncargs) { 1551 kmem_free(args->stk_base, args->stk_size); 1552 return (E2BIG); 1553 } 1554 1555 /* 1556 * Leave only the current lwp and force the other lwps to exit. 1557 * If another lwp beat us to the punch by calling exit(), bail out. 1558 */ 1559 if ((error = exitlwps(0)) != 0) { 1560 kmem_free(args->stk_base, args->stk_size); 1561 return (error); 1562 } 1563 1564 /* 1565 * Revoke any doors created by the process. 1566 */ 1567 if (p->p_door_list) 1568 door_exit(); 1569 1570 /* 1571 * Release schedctl data structures. 1572 */ 1573 if (p->p_pagep) 1574 schedctl_proc_cleanup(); 1575 1576 /* 1577 * Clean up any DTrace helpers for the process. 1578 */ 1579 if (p->p_dtrace_helpers != NULL) { 1580 ASSERT(dtrace_helpers_cleanup != NULL); 1581 (*dtrace_helpers_cleanup)(); 1582 } 1583 1584 mutex_enter(&p->p_lock); 1585 /* 1586 * Cleanup the DTrace provider associated with this process. 1587 */ 1588 if (p->p_dtrace_probes) { 1589 ASSERT(dtrace_fasttrap_exec_ptr != NULL); 1590 dtrace_fasttrap_exec_ptr(p); 1591 } 1592 mutex_exit(&p->p_lock); 1593 1594 /* 1595 * discard the lwpchan cache. 1596 */ 1597 if (p->p_lcp != NULL) 1598 lwpchan_destroy_cache(1); 1599 1600 /* 1601 * Delete the POSIX timers. 1602 */ 1603 if (p->p_itimer != NULL) 1604 timer_exit(); 1605 1606 #ifdef C2_AUDIT 1607 if (audit_active) 1608 audit_exec(args->stk_base, args->stk_base + args->arglen, 1609 args->na - args->ne, args->ne); 1610 #endif 1611 1612 /* 1613 * Ensure that we don't change resource associations while we 1614 * change address spaces. 1615 */ 1616 mutex_enter(&p->p_lock); 1617 pool_barrier_enter(); 1618 mutex_exit(&p->p_lock); 1619 1620 /* 1621 * Destroy the old address space and create a new one. 1622 * From here on, any errors are fatal to the exec()ing process. 1623 * On error we return -1, which means the caller must SIGKILL 1624 * the process. 1625 */ 1626 relvm(); 1627 1628 mutex_enter(&p->p_lock); 1629 pool_barrier_exit(); 1630 mutex_exit(&p->p_lock); 1631 1632 up->u_execsw = args->execswp; 1633 1634 p->p_brkbase = NULL; 1635 p->p_brksize = 0; 1636 p->p_stksize = 0; 1637 p->p_model = args->to_model; 1638 p->p_usrstack = usrstack; 1639 p->p_stkprot = args->stk_prot; 1640 p->p_datprot = args->dat_prot; 1641 1642 /* 1643 * Reset resource controls such that all controls are again active as 1644 * well as appropriate to the potentially new address model for the 1645 * process. 1646 */ 1647 e.rcep_p.proc = p; 1648 e.rcep_t = RCENTITY_PROCESS; 1649 rctl_set_reset(p->p_rctls, p, &e); 1650 1651 if (exec_lpg_disable == 0) { 1652 #ifdef DEBUG 1653 uint_t pgsizes = page_num_pagesizes(); 1654 uint_t szc; 1655 #endif 1656 p->p_brkpageszc = args->brkpageszc; 1657 p->p_stkpageszc = args->stkpageszc; 1658 1659 if (p->p_brkpageszc == 0) { 1660 p->p_brkpageszc = page_szc(map_pgsz(MAPPGSZ_HEAP, 1661 p, 0, 0, NULL)); 1662 } 1663 if (p->p_stkpageszc == 0) { 1664 p->p_stkpageszc = page_szc(map_pgsz(MAPPGSZ_STK, 1665 p, 0, 0, NULL)); 1666 } 1667 1668 #ifdef DEBUG 1669 if (mpss_brkpgszsel != 0) { 1670 if (mpss_brkpgszsel == -1) { 1671 szc = ((uint_t)gethrtime() >> 8) % pgsizes; 1672 } else { 1673 szc = mpss_brkpgszsel % pgsizes; 1674 } 1675 p->p_brkpageszc = szc; 1676 } 1677 1678 if (mpss_stkpgszsel != 0) { 1679 if (mpss_stkpgszsel == -1) { 1680 szc = ((uint_t)gethrtime() >> 7) % pgsizes; 1681 } else { 1682 szc = mpss_stkpgszsel % pgsizes; 1683 } 1684 p->p_stkpageszc = szc; 1685 } 1686 1687 #endif 1688 mutex_enter(&p->p_lock); 1689 p->p_flag |= SAUTOLPG; /* kernel controls page sizes */ 1690 mutex_exit(&p->p_lock); 1691 1692 } else { 1693 p->p_brkpageszc = 0; 1694 p->p_stkpageszc = 0; 1695 } 1696 1697 exec_set_sp(size); 1698 1699 as = as_alloc(); 1700 p->p_as = as; 1701 if (p->p_model == DATAMODEL_ILP32) 1702 as->a_userlimit = (caddr_t)USERLIMIT32; 1703 (void) hat_setup(as->a_hat, HAT_ALLOC); 1704 1705 /* 1706 * Finally, write out the contents of the new stack. 1707 */ 1708 error = stk_copyout(args, usrstack, auxvpp, up); 1709 kmem_free(args->stk_base, args->stk_size); 1710 return (error); 1711 } 1712