kern_sharedpage.c revision 31891
1/* 2 * Copyright (c) 1993, David Greenman 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $Id: kern_exec.c,v 1.70 1997/12/16 15:40:29 davidg Exp $ 27 */ 28 29#include <sys/param.h> 30#include <sys/systm.h> 31#include <sys/sysproto.h> 32#include <sys/signalvar.h> 33#include <sys/kernel.h> 34#include <sys/mount.h> 35#include <sys/filedesc.h> 36#include <sys/fcntl.h> 37#include <sys/acct.h> 38#include <sys/exec.h> 39#include <sys/imgact.h> 40#include <sys/imgact_elf.h> 41#include <sys/wait.h> 42#include <sys/proc.h> 43#include <sys/pioctl.h> 44#include <sys/malloc.h> 45#include <sys/namei.h> 46#include <sys/sysent.h> 47#include <sys/shm.h> 48#include <sys/sysctl.h> 49#include <sys/vnode.h> 50#include <sys/buf.h> 51 52#include <vm/vm.h> 53#include <vm/vm_param.h> 54#include <vm/vm_prot.h> 55#include <sys/lock.h> 56#include <vm/pmap.h> 57#include <vm/vm_map.h> 58#include <vm/vm_kern.h> 59#include <vm/vm_extern.h> 60#include <vm/vm_object.h> 61 62#include <machine/reg.h> 63 64static int *exec_copyout_strings __P((struct image_params *)); 65 66static int exec_check_permissions(struct image_params *); 67 68/* 69 * XXX trouble here if sizeof(caddr_t) != sizeof(int), other parts 70 * of the sysctl code also assumes this, and sizeof(int) == sizeof(long). 71 */ 72static struct ps_strings *ps_strings = PS_STRINGS; 73SYSCTL_INT(_kern, KERN_PS_STRINGS, ps_strings, 0, &ps_strings, 0, ""); 74 75static caddr_t usrstack = (caddr_t)USRSTACK; 76SYSCTL_INT(_kern, KERN_USRSTACK, usrstack, 0, &usrstack, 0, ""); 77 78/* 79 * execsw_set is constructed for us by the linker. Each of the items 80 * is a pointer to a `const struct execsw', hence the double pointer here. 81 */ 82static const struct execsw **execsw = 83 (const struct execsw **)&execsw_set.ls_items[0]; 84 85#ifndef _SYS_SYSPROTO_H_ 86struct execve_args { 87 char *fname; 88 char **argv; 89 char **envv; 90}; 91#endif 92 93/* 94 * execve() system call. 95 */ 96int 97execve(p, uap) 98 struct proc *p; 99 register struct execve_args *uap; 100{ 101 struct nameidata nd, *ndp; 102 int *stack_base; 103 int error, len, i; 104 struct image_params image_params, *imgp; 105 struct vattr attr; 106 struct buf *bp = NULL; 107 108 imgp = &image_params; 109 110 /* 111 * Initialize part of the common data 112 */ 113 imgp->proc = p; 114 imgp->uap = uap; 115 imgp->attr = &attr; 116 imgp->image_header = NULL; 117 imgp->argc = imgp->envc = 0; 118 imgp->argv0 = NULL; 119 imgp->entry_addr = 0; 120 imgp->vmspace_destroyed = 0; 121 imgp->interpreted = 0; 122 imgp->interpreter_name[0] = '\0'; 123 imgp->auxargs = NULL; 124 125 /* 126 * Allocate temporary demand zeroed space for argument and 127 * environment strings 128 */ 129 imgp->stringbase = (char *)kmem_alloc_wait(exec_map, ARG_MAX); 130 if (imgp->stringbase == NULL) { 131 error = ENOMEM; 132 goto exec_fail; 133 } 134 imgp->stringp = imgp->stringbase; 135 imgp->stringspace = ARG_MAX; 136 137 /* 138 * Translate the file name. namei() returns a vnode pointer 139 * in ni_vp amoung other things. 140 */ 141 ndp = &nd; 142 NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME, 143 UIO_USERSPACE, uap->fname, p); 144 145interpret: 146 147 error = namei(ndp); 148 if (error) { 149 kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX); 150 goto exec_fail; 151 } 152 153 imgp->vp = ndp->ni_vp; 154 155 /* 156 * Check file permissions (also 'opens' file) 157 */ 158 error = exec_check_permissions(imgp); 159 if (error) { 160 VOP_UNLOCK(imgp->vp, 0, p); 161 goto exec_fail_dealloc; 162 } 163 164 /* 165 * Get the image header, which we define here as meaning the first 166 * page of the executable. 167 */ 168 if (imgp->vp->v_object && imgp->vp->v_mount && 169 imgp->vp->v_mount->mnt_stat.f_iosize >= PAGE_SIZE && 170 imgp->vp->v_object->un_pager.vnp.vnp_size >= 171 imgp->vp->v_mount->mnt_stat.f_iosize) { 172 /* 173 * Get a buffer with (at least) the first page. 174 */ 175 error = bread(imgp->vp, 0, imgp->vp->v_mount->mnt_stat.f_iosize, 176 p->p_ucred, &bp); 177 imgp->image_header = bp->b_data; 178 } else { 179 int resid; 180 181 /* 182 * The filesystem block size is too small, so do this the hard 183 * way. Malloc some space and read PAGE_SIZE worth of the image 184 * header into it. 185 */ 186 imgp->image_header = malloc(PAGE_SIZE, M_TEMP, M_WAITOK); 187 error = vn_rdwr(UIO_READ, imgp->vp, (void *)imgp->image_header, PAGE_SIZE, 0, 188 UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid, p); 189 /* 190 * Clear out any remaining junk. 191 */ 192 if (!error && resid) 193 bzero((char *)imgp->image_header + PAGE_SIZE - resid, resid); 194 } 195 VOP_UNLOCK(imgp->vp, 0, p); 196 if (error) 197 goto exec_fail_dealloc; 198 199 /* 200 * Loop through list of image activators, calling each one. 201 * If there is no match, the activator returns -1. If there 202 * is a match, but there was an error during the activation, 203 * the error is returned. Otherwise 0 means success. If the 204 * image is interpreted, loop back up and try activating 205 * the interpreter. 206 */ 207 for (i = 0; execsw[i]; ++i) { 208 if (execsw[i]->ex_imgact) 209 error = (*execsw[i]->ex_imgact)(imgp); 210 else 211 continue; 212 if (error == -1) 213 continue; 214 if (error) 215 goto exec_fail_dealloc; 216 if (imgp->interpreted) { 217 /* free old bp/image_header */ 218 if (bp != NULL) { 219 brelse(bp); 220 bp = NULL; 221 } else 222 free((void *)imgp->image_header, M_TEMP); 223 imgp->image_header = NULL; 224 /* free old vnode and name buffer */ 225 vrele(ndp->ni_vp); 226 zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 227 /* set new name to that of the interpreter */ 228 NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME, 229 UIO_SYSSPACE, imgp->interpreter_name, p); 230 goto interpret; 231 } 232 break; 233 } 234 /* If we made it through all the activators and none matched, exit. */ 235 if (error == -1) { 236 error = ENOEXEC; 237 goto exec_fail_dealloc; 238 } 239 240 /* 241 * Copy out strings (args and env) and initialize stack base 242 */ 243 stack_base = exec_copyout_strings(imgp); 244 p->p_vmspace->vm_minsaddr = (char *)stack_base; 245 246 /* 247 * If custom stack fixup routine present for this process 248 * let it do the stack setup. 249 * Else stuff argument count as first item on stack 250 */ 251 if (p->p_sysent->sv_fixup) 252 (*p->p_sysent->sv_fixup)(&stack_base, imgp); 253 else 254 suword(--stack_base, imgp->argc); 255 256 /* 257 * For security and other reasons, the file descriptor table cannot 258 * be shared after an exec. 259 */ 260 if (p->p_fd->fd_refcnt > 1) { 261 struct filedesc *tmp; 262 263 tmp = fdcopy(p); 264 fdfree(p); 265 p->p_fd = tmp; 266 } 267 268 /* close files on exec */ 269 fdcloseexec(p); 270 271 /* reset caught signals */ 272 execsigs(p); 273 274 /* name this process - nameiexec(p, ndp) */ 275 len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN); 276 bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len); 277 p->p_comm[len] = 0; 278 279 /* 280 * mark as execed, wakeup the process that vforked (if any) and tell 281 * it that it now has it's own resources back 282 */ 283 p->p_flag |= P_EXEC; 284 if (p->p_pptr && (p->p_flag & P_PPWAIT)) { 285 p->p_flag &= ~P_PPWAIT; 286 wakeup((caddr_t)p->p_pptr); 287 } 288 289 /* 290 * Implement image setuid/setgid. 291 * 292 * Don't honor setuid/setgid if the filesystem prohibits it or if 293 * the process is being traced. 294 */ 295 if ((attr.va_mode & VSUID && p->p_ucred->cr_uid != attr.va_uid || 296 attr.va_mode & VSGID && p->p_ucred->cr_gid != attr.va_gid) && 297 (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 && 298 (p->p_flag & P_TRACED) == 0) { 299 /* 300 * Turn off syscall tracing for set-id programs, except for 301 * root. 302 */ 303 if (p->p_tracep && suser(p->p_ucred, &p->p_acflag)) { 304 p->p_traceflag = 0; 305 vrele(p->p_tracep); 306 p->p_tracep = NULL; 307 } 308 /* 309 * Set the new credentials. 310 */ 311 p->p_ucred = crcopy(p->p_ucred); 312 if (attr.va_mode & VSUID) 313 p->p_ucred->cr_uid = attr.va_uid; 314 if (attr.va_mode & VSGID) 315 p->p_ucred->cr_gid = attr.va_gid; 316 setsugid(p); 317 } else { 318 if (p->p_ucred->cr_uid == p->p_cred->p_ruid && 319 p->p_ucred->cr_gid == p->p_cred->p_rgid) 320 p->p_flag &= ~P_SUGID; 321 } 322 323 /* 324 * Implement correct POSIX saved-id behavior. 325 */ 326 p->p_cred->p_svuid = p->p_ucred->cr_uid; 327 p->p_cred->p_svgid = p->p_ucred->cr_gid; 328 329 /* 330 * Store the vp for use in procfs 331 */ 332 if (p->p_textvp) /* release old reference */ 333 vrele(p->p_textvp); 334 VREF(ndp->ni_vp); 335 p->p_textvp = ndp->ni_vp; 336 337 /* 338 * If tracing the process, trap to debugger so breakpoints 339 * can be set before the program executes. 340 */ 341 STOPEVENT(p, S_EXEC, 0); 342 343 if (p->p_flag & P_TRACED) 344 psignal(p, SIGTRAP); 345 346 /* clear "fork but no exec" flag, as we _are_ execing */ 347 p->p_acflag &= ~AFORK; 348 349 /* Set entry address */ 350 setregs(p, imgp->entry_addr, (u_long)stack_base); 351 352 /* 353 * free various allocated resources 354 */ 355 kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX); 356 if (bp != NULL) 357 brelse(bp); 358 else if (imgp->image_header != NULL) 359 free((void *)imgp->image_header, M_TEMP); 360 vrele(ndp->ni_vp); 361 zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 362 363 return (0); 364 365exec_fail_dealloc: 366 if (imgp->stringbase != NULL) 367 kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase, ARG_MAX); 368 if (bp != NULL) 369 brelse(bp); 370 else if (imgp->image_header != NULL) 371 free((void *)imgp->image_header, M_TEMP); 372 if (ndp->ni_vp) { 373 vrele(ndp->ni_vp); 374 zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 375 } 376 377exec_fail: 378 if (imgp->vmspace_destroyed) { 379 /* sorry, no more process anymore. exit gracefully */ 380 exit1(p, W_EXITCODE(0, SIGABRT)); 381 /* NOT REACHED */ 382 return(0); 383 } else { 384 return(error); 385 } 386} 387 388/* 389 * Destroy old address space, and allocate a new stack 390 * The new stack is only SGROWSIZ large because it is grown 391 * automatically in trap.c. 392 */ 393int 394exec_new_vmspace(imgp) 395 struct image_params *imgp; 396{ 397 int error; 398 struct vmspace *vmspace = imgp->proc->p_vmspace; 399 caddr_t stack_addr = (caddr_t) (USRSTACK - SGROWSIZ); 400 vm_map_t map = &vmspace->vm_map; 401 402 imgp->vmspace_destroyed = 1; 403 404 /* 405 * Blow away entire process VM, if address space not shared, 406 * otherwise, create a new VM space so that other threads are 407 * not disrupted 408 */ 409 if (vmspace->vm_refcnt == 1) { 410 if (vmspace->vm_shm) 411 shmexit(imgp->proc); 412 pmap_remove_pages(&vmspace->vm_pmap, 0, USRSTACK); 413 vm_map_remove(map, 0, USRSTACK); 414 } else { 415 vmspace_exec(imgp->proc); 416 vmspace = imgp->proc->p_vmspace; 417 map = &vmspace->vm_map; 418 } 419 420 /* Allocate a new stack */ 421 error = vm_map_find(map, NULL, 0, (vm_offset_t *)&stack_addr, 422 SGROWSIZ, FALSE, VM_PROT_ALL, VM_PROT_ALL, 0); 423 if (error) 424 return(error); 425 426 vmspace->vm_ssize = SGROWSIZ >> PAGE_SHIFT; 427 428 /* Initialize maximum stack address */ 429 vmspace->vm_maxsaddr = (char *)USRSTACK - MAXSSIZ; 430 431 return(0); 432} 433 434/* 435 * Copy out argument and environment strings from the old process 436 * address space into the temporary string buffer. 437 */ 438int 439exec_extract_strings(imgp) 440 struct image_params *imgp; 441{ 442 char **argv, **envv; 443 char *argp, *envp; 444 int error, length; 445 446 /* 447 * extract arguments first 448 */ 449 450 argv = imgp->uap->argv; 451 452 if (argv) { 453 argp = (caddr_t) fuword(argv); 454 if (argp == (caddr_t) -1) 455 return (EFAULT); 456 if (argp) 457 argv++; 458 if (imgp->argv0) 459 argp = imgp->argv0; 460 if (argp) { 461 do { 462 if (argp == (caddr_t) -1) 463 return (EFAULT); 464 if ((error = copyinstr(argp, imgp->stringp, 465 imgp->stringspace, &length))) { 466 if (error == ENAMETOOLONG) 467 return(E2BIG); 468 return (error); 469 } 470 imgp->stringspace -= length; 471 imgp->stringp += length; 472 imgp->argc++; 473 } while ((argp = (caddr_t) fuword(argv++))); 474 } 475 } 476 477 /* 478 * extract environment strings 479 */ 480 481 envv = imgp->uap->envv; 482 483 if (envv) { 484 while ((envp = (caddr_t) fuword(envv++))) { 485 if (envp == (caddr_t) -1) 486 return (EFAULT); 487 if ((error = copyinstr(envp, imgp->stringp, 488 imgp->stringspace, &length))) { 489 if (error == ENAMETOOLONG) 490 return(E2BIG); 491 return (error); 492 } 493 imgp->stringspace -= length; 494 imgp->stringp += length; 495 imgp->envc++; 496 } 497 } 498 499 return (0); 500} 501 502/* 503 * Copy strings out to the new process address space, constructing 504 * new arg and env vector tables. Return a pointer to the base 505 * so that it can be used as the initial stack pointer. 506 */ 507int * 508exec_copyout_strings(imgp) 509 struct image_params *imgp; 510{ 511 int argc, envc; 512 char **vectp; 513 char *stringp, *destp; 514 int *stack_base; 515 struct ps_strings *arginfo; 516 int szsigcode; 517 518 /* 519 * Calculate string base and vector table pointers. 520 * Also deal with signal trampoline code for this exec type. 521 */ 522 arginfo = PS_STRINGS; 523 szsigcode = *(imgp->proc->p_sysent->sv_szsigcode); 524 destp = (caddr_t)arginfo - szsigcode - SPARE_USRSPACE - 525 roundup((ARG_MAX - imgp->stringspace), sizeof(char *)); 526 527 /* 528 * install sigcode 529 */ 530 if (szsigcode) 531 copyout(imgp->proc->p_sysent->sv_sigcode, 532 ((caddr_t)arginfo - szsigcode), szsigcode); 533 534 /* 535 * If we have a valid auxargs ptr, prepare some room 536 * on the stack. 537 */ 538 if (imgp->auxargs) 539 /* 540 * The '+ 2' is for the null pointers at the end of each of the 541 * arg and env vector sets, and 'AT_COUNT*2' is room for the 542 * ELF Auxargs data. 543 */ 544 vectp = (char **)(destp - (imgp->argc + imgp->envc + 2 + 545 AT_COUNT*2) * sizeof(char*)); 546 else 547 /* 548 * The '+ 2' is for the null pointers at the end of each of the 549 * arg and env vector sets 550 */ 551 vectp = (char **) 552 (destp - (imgp->argc + imgp->envc + 2) * sizeof(char*)); 553 554 /* 555 * vectp also becomes our initial stack base 556 */ 557 stack_base = (int *)vectp; 558 559 stringp = imgp->stringbase; 560 argc = imgp->argc; 561 envc = imgp->envc; 562 563 /* 564 * Copy out strings - arguments and environment. 565 */ 566 copyout(stringp, destp, ARG_MAX - imgp->stringspace); 567 568 /* 569 * Fill in "ps_strings" struct for ps, w, etc. 570 */ 571 suword(&arginfo->ps_argvstr, (int)vectp); 572 suword(&arginfo->ps_nargvstr, argc); 573 574 /* 575 * Fill in argument portion of vector table. 576 */ 577 for (; argc > 0; --argc) { 578 suword(vectp++, (int)destp); 579 while (*stringp++ != 0) 580 destp++; 581 destp++; 582 } 583 584 /* a null vector table pointer seperates the argp's from the envp's */ 585 suword(vectp++, 0); 586 587 suword(&arginfo->ps_envstr, (int)vectp); 588 suword(&arginfo->ps_nenvstr, envc); 589 590 /* 591 * Fill in environment portion of vector table. 592 */ 593 for (; envc > 0; --envc) { 594 suword(vectp++, (int)destp); 595 while (*stringp++ != 0) 596 destp++; 597 destp++; 598 } 599 600 /* end of vector table is a null pointer */ 601 suword(vectp, 0); 602 603 return (stack_base); 604} 605 606/* 607 * Check permissions of file to execute. 608 * Return 0 for success or error code on failure. 609 */ 610static int 611exec_check_permissions(imgp) 612 struct image_params *imgp; 613{ 614 struct proc *p = imgp->proc; 615 struct vnode *vp = imgp->vp; 616 struct vattr *attr = imgp->attr; 617 int error; 618 619 /* Get file attributes */ 620 error = VOP_GETATTR(vp, attr, p->p_ucred, p); 621 if (error) 622 return (error); 623 624 /* 625 * 1) Check if file execution is disabled for the filesystem that this 626 * file resides on. 627 * 2) Insure that at least one execute bit is on - otherwise root 628 * will always succeed, and we don't want to happen unless the 629 * file really is executable. 630 * 3) Insure that the file is a regular file. 631 */ 632 if ((vp->v_mount->mnt_flag & MNT_NOEXEC) || 633 ((attr->va_mode & 0111) == 0) || 634 (attr->va_type != VREG)) { 635 return (EACCES); 636 } 637 638 /* 639 * Zero length files can't be exec'd 640 */ 641 if (attr->va_size == 0) 642 return (ENOEXEC); 643 644 /* 645 * Check for execute permission to file based on current credentials. 646 */ 647 error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p); 648 if (error) 649 return (error); 650 651 /* 652 * Check number of open-for-writes on the file and deny execution 653 * if there are any. 654 */ 655 if (vp->v_writecount) 656 return (ETXTBSY); 657 658 /* 659 * Call filesystem specific open routine (which does nothing in the 660 * general case). 661 */ 662 error = VOP_OPEN(vp, FREAD, p->p_ucred, p); 663 if (error) 664 return (error); 665 666 return (0); 667} 668