imgact_shell.c revision 219352
1139804Simp/*- 2885Swollman * Copyright (c) 1993, David Greenman 3885Swollman * All rights reserved. 4885Swollman * 5885Swollman * Redistribution and use in source and binary forms, with or without 6885Swollman * modification, are permitted provided that the following conditions 7885Swollman * are met: 8885Swollman * 1. Redistributions of source code must retain the above copyright 9885Swollman * notice, this list of conditions and the following disclaimer. 10885Swollman * 2. Redistributions in binary form must reproduce the above copyright 11885Swollman * notice, this list of conditions and the following disclaimer in the 12885Swollman * documentation and/or other materials provided with the distribution. 13885Swollman * 14885Swollman * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15885Swollman * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16885Swollman * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1710625Sdg * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18885Swollman * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19885Swollman * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20885Swollman * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21885Swollman * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22885Swollman * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23885Swollman * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24885Swollman * SUCH DAMAGE. 25885Swollman */ 26885Swollman 27116182Sobrien#include <sys/cdefs.h> 28116182Sobrien__FBSDID("$FreeBSD: head/sys/kern/imgact_shell.c 219352 2011-03-06 22:59:30Z kib $"); 29116182Sobrien 302056Swollman#include <sys/param.h> 31142448Ssobomax#include <sys/vnode.h> 32142448Ssobomax#include <sys/proc.h> 33182191Skib#include <sys/sbuf.h> 3440435Speter#include <sys/systm.h> 3511332Sswallace#include <sys/sysproto.h> 361549Srgrimes#include <sys/exec.h> 372056Swollman#include <sys/imgact.h> 382056Swollman#include <sys/kernel.h> 39885Swollman 40886Swollman#if BYTE_ORDER == LITTLE_ENDIAN 41885Swollman#define SHELLMAGIC 0x2123 /* #! */ 42886Swollman#else 43886Swollman#define SHELLMAGIC 0x2321 44886Swollman#endif 45886Swollman 46885Swollman/* 47146731Sgad * At the time of this writing, MAXSHELLCMDLEN == PAGE_SIZE. This is 48146731Sgad * significant because the caller has only mapped in one page of the 49212965Salc * file we're reading. 50885Swollman */ 51146731Sgad#if MAXSHELLCMDLEN > PAGE_SIZE 52146731Sgad#error "MAXSHELLCMDLEN is larger than a single page!" 53146731Sgad#endif 54146731Sgad 55212965Salc/* 56212965Salc * MAXSHELLCMDLEN must be at least MAXINTERP plus the size of the `#!' 57212965Salc * prefix and terminating newline. 58212965Salc */ 59212965SalcCTASSERT(MAXSHELLCMDLEN >= MAXINTERP + 3); 60212965Salc 61146731Sgad/** 62146731Sgad * Shell interpreter image activator. An interpreter name beginning at 63146731Sgad * imgp->args->begin_argv is the minimal successful exit requirement. 64146731Sgad * 65146731Sgad * If the given file is a shell-script, then the first line will start 66146731Sgad * with the two characters `#!' (aka SHELLMAGIC), followed by the name 67146731Sgad * of the shell-interpreter to run, followed by zero or more tokens. 68146731Sgad * 69146731Sgad * The interpreter is then started up such that it will see: 70146731Sgad * arg[0] -> The name of interpreter as specified after `#!' in the 71146731Sgad * first line of the script. The interpreter name must 72146731Sgad * not be longer than MAXSHELLCMDLEN bytes. 73146731Sgad * arg[1] -> *If* there are any additional tokens on the first line, 74146731Sgad * then we add a new arg[1], which is a copy of the rest of 75146731Sgad * that line. The copy starts at the first token after the 76146731Sgad * interpreter name. We leave it to the interpreter to 77146731Sgad * parse the tokens in that value. 78146731Sgad * arg[x] -> the full pathname of the script. This will either be 79146731Sgad * arg[2] or arg[1], depending on whether or not tokens 80146731Sgad * were found after the interpreter name. 81146731Sgad * arg[x+1] -> all the arguments that were specified on the original 82146731Sgad * command line. 83146731Sgad * 84146731Sgad * This processing is described in the execve(2) man page. 85146731Sgad */ 86146731Sgad 87146731Sgad/* 88146731Sgad * HISTORICAL NOTE: From 1993 to mid-2005, FreeBSD parsed out the tokens as 89146731Sgad * found on the first line of the script, and setup each token as a separate 90146731Sgad * value in arg[]. This extra processing did not match the behavior of other 91146731Sgad * OS's, and caused a few subtle problems. For one, it meant the kernel was 92146731Sgad * deciding how those values should be parsed (wrt characters for quoting or 93146731Sgad * comments, etc), while the interpreter might have other rules for parsing. 94146731Sgad * It also meant the interpreter had no way of knowing which arguments came 95146731Sgad * from the first line of the shell script, and which arguments were specified 96147151Sgad * by the user on the command line. That extra processing was dropped in the 97147151Sgad * 6.x branch on May 28, 2005 (matching __FreeBSD_version 600029). 98146731Sgad */ 9959663Sdillonint 10012130Sdgexec_shell_imgact(imgp) 10112130Sdg struct image_params *imgp; 102885Swollman{ 10312130Sdg const char *image_header = imgp->image_header; 104182191Skib const char *ihp, *interpb, *interpe, *maxp, *optb, *opte, *fname; 105141028Ssobomax int error, offset; 106212965Salc size_t length; 107142448Ssobomax struct vattr vattr; 108182191Skib struct sbuf *sname; 109885Swollman 110885Swollman /* a shell script? */ 111212965Salc if (((const short *)image_header)[0] != SHELLMAGIC) 112212965Salc return (-1); 113885Swollman 114885Swollman /* 115885Swollman * Don't allow a shell script to be the shell for a shell 116885Swollman * script. :-) 117885Swollman */ 11812130Sdg if (imgp->interpreted) 119212965Salc return (ENOEXEC); 120885Swollman 12112130Sdg imgp->interpreted = 1; 122885Swollman 123885Swollman /* 124142448Ssobomax * At this point we have the first page of the file mapped. 125142448Ssobomax * However, we don't know how far into the page the contents are 126142448Ssobomax * valid -- the actual file might be much shorter than the page. 127142448Ssobomax * So find out the file size. 128142448Ssobomax */ 129182371Sattilio error = VOP_GETATTR(imgp->vp, &vattr, imgp->proc->p_ucred); 130142448Ssobomax if (error) 131142448Ssobomax return (error); 132142448Ssobomax 133142448Ssobomax /* 134146731Sgad * Copy shell name and arguments from image_header into a string 135212965Salc * buffer. 136146731Sgad */ 137212965Salc maxp = &image_header[MIN(vattr.va_size, MAXSHELLCMDLEN)]; 138146731Sgad ihp = &image_header[2]; 139146731Sgad 140146731Sgad /* 141146731Sgad * Find the beginning and end of the interpreter_name. If the 142146731Sgad * line does not include any interpreter, or if the name which 143146731Sgad * was found is too long, we bail out. 144146731Sgad */ 145146731Sgad while (ihp < maxp && ((*ihp == ' ') || (*ihp == '\t'))) 146146731Sgad ihp++; 147146731Sgad interpb = ihp; 148146731Sgad while (ihp < maxp && ((*ihp != ' ') && (*ihp != '\t') && (*ihp != '\n') 149146731Sgad && (*ihp != '\0'))) 150146731Sgad ihp++; 151146731Sgad interpe = ihp; 152146731Sgad if (interpb == interpe) 153146731Sgad return (ENOEXEC); 154212965Salc if (interpe - interpb >= MAXINTERP) 155146731Sgad return (ENAMETOOLONG); 156885Swollman 157140992Ssobomax /* 158146731Sgad * Find the beginning of the options (if any), and the end-of-line. 159146731Sgad * Then trim the trailing blanks off the value. Note that some 160146731Sgad * other operating systems do *not* trim the trailing whitespace... 161146731Sgad */ 162146731Sgad while (ihp < maxp && ((*ihp == ' ') || (*ihp == '\t'))) 163146731Sgad ihp++; 164146731Sgad optb = ihp; 165146731Sgad while (ihp < maxp && ((*ihp != '\n') && (*ihp != '\0'))) 166146731Sgad ihp++; 167146731Sgad opte = ihp; 168212965Salc if (opte == maxp) 169212965Salc return (ENOEXEC); 170147479Sgad while (--ihp > optb && ((*ihp == ' ') || (*ihp == '\t'))) 171146731Sgad opte = ihp; 172146731Sgad 173182191Skib if (imgp->args->fname != NULL) { 174182191Skib fname = imgp->args->fname; 175182191Skib sname = NULL; 176182191Skib } else { 177182191Skib sname = sbuf_new_auto(); 178182191Skib sbuf_printf(sname, "/dev/fd/%d", imgp->args->fd); 179182191Skib sbuf_finish(sname); 180182191Skib fname = sbuf_data(sname); 181182191Skib } 182182191Skib 183146731Sgad /* 184146731Sgad * We need to "pop" (remove) the present value of arg[0], and "push" 185146731Sgad * either two or three new values in the arg[] list. To do this, 186146731Sgad * we first shift all the other values in the `begin_argv' area to 187146731Sgad * provide the exact amount of room for the values added. Set up 188146731Sgad * `offset' as the number of bytes to be added to the `begin_argv' 189146731Sgad * area, and 'length' as the number of bytes being removed. 190146731Sgad */ 191146731Sgad offset = interpe - interpb + 1; /* interpreter */ 192147479Sgad if (opte > optb) /* options (if any) */ 193146731Sgad offset += opte - optb + 1; 194182191Skib offset += strlen(fname) + 1; /* fname of script */ 195146731Sgad length = (imgp->args->argc == 0) ? 0 : 196146731Sgad strlen(imgp->args->begin_argv) + 1; /* bytes to delete */ 197146731Sgad 198219352Skib if (offset > imgp->args->stringspace + length) { 199182191Skib if (sname != NULL) 200182191Skib sbuf_delete(sname); 201146731Sgad return (E2BIG); 202182191Skib } 203146731Sgad 204146731Sgad bcopy(imgp->args->begin_argv + length, imgp->args->begin_argv + offset, 205146731Sgad imgp->args->endp - (imgp->args->begin_argv + length)); 206146731Sgad 207146731Sgad offset -= length; /* calculate actual adjustment */ 208146731Sgad imgp->args->begin_envv += offset; 209146731Sgad imgp->args->endp += offset; 210146731Sgad imgp->args->stringspace -= offset; 211146731Sgad 212146731Sgad /* 213146731Sgad * If there was no arg[0] when we started, then the interpreter_name 214146731Sgad * is adding an argument (instead of replacing the arg[0] we started 215146731Sgad * with). And we're always adding an argument when we include the 216146731Sgad * full pathname of the original script. 217146731Sgad */ 218146731Sgad if (imgp->args->argc == 0) 219146731Sgad imgp->args->argc = 1; 220146731Sgad imgp->args->argc++; 221146731Sgad 222146731Sgad /* 223146731Sgad * The original arg[] list has been shifted appropriately. Copy in 224146731Sgad * the interpreter name and options-string. 225146731Sgad */ 226146731Sgad length = interpe - interpb; 227210475Salc bcopy(interpb, imgp->args->begin_argv, length); 228210475Salc *(imgp->args->begin_argv + length) = '\0'; 229146731Sgad offset = length + 1; 230147479Sgad if (opte > optb) { 231146731Sgad length = opte - optb; 232210475Salc bcopy(optb, imgp->args->begin_argv + offset, length); 233210475Salc *(imgp->args->begin_argv + offset + length) = '\0'; 234146731Sgad offset += length + 1; 235146731Sgad imgp->args->argc++; 236146731Sgad } 237146731Sgad 238146731Sgad /* 239140992Ssobomax * Finally, add the filename onto the end for the interpreter to 240140992Ssobomax * use and copy the interpreter's name to imgp->interpreter_name 241140992Ssobomax * for exec to use. 242140992Ssobomax */ 243210475Salc error = copystr(fname, imgp->args->begin_argv + offset, 244210475Salc imgp->args->stringspace, NULL); 245885Swollman 246140992Ssobomax if (error == 0) 247210545Salc imgp->interpreter_name = imgp->args->begin_argv; 248140992Ssobomax 249182191Skib if (sname != NULL) 250182191Skib sbuf_delete(sname); 251140992Ssobomax return (error); 252885Swollman} 253886Swollman 254886Swollman/* 255886Swollman * Tell kern_execve.c about it, with a little help from the linker. 256886Swollman */ 25743402Sdillonstatic struct execsw shell_execsw = { exec_shell_imgact, "#!" }; 25840435SpeterEXEC_SET(shell, shell_execsw); 259