2 * Copyright (c) 1993, David Greenman
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * $FreeBSD: src/sys/kern/kern_exec.c,v 1.107.2.15 2002/07/30 15:40:46 nectar Exp $
27 * $DragonFly: src/sys/kern/kern_exec.c,v 1.3 2003/06/23 17:55:41 dillon Exp $
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/sysproto.h>
33 #include <sys/kernel.h>
34 #include <sys/mount.h>
35 #include <sys/filedesc.h>
36 #include <sys/fcntl.h>
39 #include <sys/imgact.h>
40 #include <sys/imgact_elf.h>
42 #include <sys/malloc.h>
44 #include <sys/signalvar.h>
45 #include <sys/pioctl.h>
46 #include <sys/namei.h>
47 #include <sys/sysent.h>
49 #include <sys/sysctl.h>
50 #include <sys/vnode.h>
54 #include <vm/vm_param.h>
57 #include <vm/vm_page.h>
58 #include <vm/vm_map.h>
59 #include <vm/vm_kern.h>
60 #include <vm/vm_extern.h>
61 #include <vm/vm_object.h>
62 #include <vm/vm_pager.h>
65 #include <machine/reg.h>
67 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
69 static register_t *exec_copyout_strings __P((struct image_params *));
71 /* XXX This should be vm_size_t. */
72 static u_long ps_strings = PS_STRINGS;
73 SYSCTL_ULONG(_kern, KERN_PS_STRINGS, ps_strings, CTLFLAG_RD, &ps_strings, 0, "");
75 /* XXX This should be vm_size_t. */
76 static u_long usrstack = USRSTACK;
77 SYSCTL_ULONG(_kern, KERN_USRSTACK, usrstack, CTLFLAG_RD, &usrstack, 0, "");
79 u_long ps_arg_cache_limit = PAGE_SIZE / 16;
80 SYSCTL_LONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
81 &ps_arg_cache_limit, 0, "");
84 SYSCTL_INT(_kern, OID_AUTO, ps_argsopen, CTLFLAG_RW, &ps_argsopen, 0, "");
87 * Each of the items is a pointer to a `const struct execsw', hence the
88 * double pointer here.
90 static const struct execsw **execsw;
92 #ifndef _SYS_SYSPROTO_H_
101 * execve() system call.
104 execve(struct execve_args *uap)
106 struct proc *p = curproc;
107 struct nameidata nd, *ndp;
108 register_t *stack_base;
110 struct image_params image_params, *imgp;
112 int (*img_first) __P((struct image_params *));
114 imgp = &image_params;
117 * Lock the process and set the P_INEXEC flag to indicate that
118 * it should be left alone until we're done here. This is
119 * necessary to avoid race conditions - e.g. in ptrace() -
120 * that might allow a local user to illicitly obtain elevated
123 p->p_flag |= P_INEXEC;
126 * Initialize part of the common data
131 imgp->argc = imgp->envc = 0;
133 imgp->entry_addr = 0;
134 imgp->vmspace_destroyed = 0;
135 imgp->interpreted = 0;
136 imgp->interpreter_name[0] = '\0';
137 imgp->auxargs = NULL;
139 imgp->firstpage = NULL;
140 imgp->ps_strings = 0;
143 * Allocate temporary demand zeroed space for argument and
144 * environment strings
146 imgp->stringbase = (char *)kmem_alloc_wait(exec_map, ARG_MAX + PAGE_SIZE);
147 if (imgp->stringbase == NULL) {
151 imgp->stringp = imgp->stringbase;
152 imgp->stringspace = ARG_MAX;
153 imgp->image_header = imgp->stringbase + ARG_MAX;
156 * Translate the file name. namei() returns a vnode pointer
157 * in ni_vp amoung other things.
160 NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
161 UIO_USERSPACE, uap->fname, p);
167 kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase,
168 ARG_MAX + PAGE_SIZE);
172 imgp->vp = ndp->ni_vp;
173 imgp->fname = uap->fname;
176 * Check file permissions (also 'opens' file)
178 error = exec_check_permissions(imgp);
180 VOP_UNLOCK(imgp->vp, 0, p);
181 goto exec_fail_dealloc;
184 error = exec_map_first_page(imgp);
185 VOP_UNLOCK(imgp->vp, 0, p);
187 goto exec_fail_dealloc;
190 * If the current process has a special image activator it
191 * wants to try first, call it. For example, emulating shell
192 * scripts differently.
195 if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
196 error = img_first(imgp);
199 * Loop through the list of image activators, calling each one.
200 * An activator returns -1 if there is no match, 0 on success,
201 * and an error otherwise.
203 for (i = 0; error == -1 && execsw[i]; ++i) {
204 if (execsw[i]->ex_imgact == NULL ||
205 execsw[i]->ex_imgact == img_first) {
208 error = (*execsw[i]->ex_imgact)(imgp);
214 goto exec_fail_dealloc;
218 * Special interpreter operation, cleanup and loop up to try to
219 * activate the interpreter.
221 if (imgp->interpreted) {
222 exec_unmap_first_page(imgp);
223 /* free name buffer and old vnode */
224 NDFREE(ndp, NDF_ONLY_PNBUF);
226 /* set new name to that of the interpreter */
227 NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME,
228 UIO_SYSSPACE, imgp->interpreter_name, p);
233 * Copy out strings (args and env) and initialize stack base
235 stack_base = exec_copyout_strings(imgp);
236 p->p_vmspace->vm_minsaddr = (char *)stack_base;
239 * If custom stack fixup routine present for this process
240 * let it do the stack setup.
241 * Else stuff argument count as first item on stack
243 if (p->p_sysent->sv_fixup)
244 (*p->p_sysent->sv_fixup)(&stack_base, imgp);
246 suword(--stack_base, imgp->argc);
249 * For security and other reasons, the file descriptor table cannot
250 * be shared after an exec.
252 if (p->p_fd->fd_refcnt > 1) {
253 struct filedesc *tmp;
261 * For security and other reasons, signal handlers cannot
262 * be shared after an exec. The new proces gets a copy of the old
263 * handlers. In execsigs(), the new process will have its signals
266 if (p->p_procsig->ps_refcnt > 1) {
267 struct procsig *newprocsig;
269 MALLOC(newprocsig, struct procsig *, sizeof(struct procsig),
270 M_SUBPROC, M_WAITOK);
271 bcopy(p->p_procsig, newprocsig, sizeof(*newprocsig));
272 p->p_procsig->ps_refcnt--;
273 p->p_procsig = newprocsig;
274 p->p_procsig->ps_refcnt = 1;
275 if (p->p_sigacts == &p->p_addr->u_sigacts)
276 panic("shared procsig but private sigacts?");
278 p->p_addr->u_sigacts = *p->p_sigacts;
279 p->p_sigacts = &p->p_addr->u_sigacts;
285 /* close files on exec */
288 /* reset caught signals */
291 /* name this process - nameiexec(p, ndp) */
292 len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN);
293 bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len);
297 * mark as execed, wakeup the process that vforked (if any) and tell
298 * it that it now has its own resources back
301 if (p->p_pptr && (p->p_flag & P_PPWAIT)) {
302 p->p_flag &= ~P_PPWAIT;
303 wakeup((caddr_t)p->p_pptr);
307 * Implement image setuid/setgid.
309 * Don't honor setuid/setgid if the filesystem prohibits it or if
310 * the process is being traced.
312 if ((((attr.va_mode & VSUID) && p->p_ucred->cr_uid != attr.va_uid) ||
313 ((attr.va_mode & VSGID) && p->p_ucred->cr_gid != attr.va_gid)) &&
314 (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
315 (p->p_flag & P_TRACED) == 0) {
317 * Turn off syscall tracing for set-id programs, except for
318 * root. Record any set-id flags first to make sure that
319 * we do not regain any tracing during a possible block.
322 if (p->p_tracep && suser()) {
325 if ((vtmp = p->p_tracep) != NULL) {
331 /* Close any file descriptors 0..2 that reference procfs */
333 /* Make sure file descriptors 0..2 are in use. */
334 error = fdcheckstd(p);
336 goto exec_fail_dealloc;
338 * Set the new credentials.
340 p->p_ucred = crcopy(p->p_ucred);
341 if (attr.va_mode & VSUID)
342 change_euid(attr.va_uid);
343 if (attr.va_mode & VSGID)
344 p->p_ucred->cr_gid = attr.va_gid;
346 if (p->p_ucred->cr_uid == p->p_ucred->cr_ruid &&
347 p->p_ucred->cr_gid == p->p_ucred->cr_rgid)
348 p->p_flag &= ~P_SUGID;
352 * Implement correct POSIX saved-id behavior.
354 p->p_ucred->cr_svuid = p->p_ucred->cr_uid;
355 p->p_ucred->cr_svgid = p->p_ucred->cr_gid;
358 * Store the vp for use in procfs
360 if (p->p_textvp) /* release old reference */
363 p->p_textvp = ndp->ni_vp;
366 * Notify others that we exec'd, and clear the P_INEXEC flag
367 * as we're now a bona fide freshly-execed process.
369 KNOTE(&p->p_klist, NOTE_EXEC);
370 p->p_flag &= ~P_INEXEC;
373 * If tracing the process, trap to debugger so breakpoints
374 * can be set before the program executes.
376 STOPEVENT(p, S_EXEC, 0);
378 if (p->p_flag & P_TRACED)
381 /* clear "fork but no exec" flag, as we _are_ execing */
382 p->p_acflag &= ~AFORK;
384 /* Set values passed into the program in registers. */
385 setregs(p, imgp->entry_addr, (u_long)(uintptr_t)stack_base,
388 /* Free any previous argument cache */
389 if (p->p_args && --p->p_args->ar_ref == 0)
390 FREE(p->p_args, M_PARGS);
393 /* Cache arguments if they fit inside our allowance */
394 i = imgp->endargs - imgp->stringbase;
395 if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
396 MALLOC(p->p_args, struct pargs *, sizeof(struct pargs) + i,
398 p->p_args->ar_ref = 1;
399 p->p_args->ar_length = i;
400 bcopy(imgp->stringbase, p->p_args->ar_args, i);
406 * free various allocated resources
409 exec_unmap_first_page(imgp);
411 if (imgp->stringbase != NULL)
412 kmem_free_wakeup(exec_map, (vm_offset_t)imgp->stringbase,
413 ARG_MAX + PAGE_SIZE);
416 NDFREE(ndp, NDF_ONLY_PNBUF);
424 /* we're done here, clear P_INEXEC */
425 p->p_flag &= ~P_INEXEC;
426 if (imgp->vmspace_destroyed) {
427 /* sorry, no more process anymore. exit gracefully */
428 exit1(W_EXITCODE(0, SIGABRT));
437 exec_map_first_page(struct image_params *imgp)
441 vm_page_t ma[VM_INITIAL_PAGEIN];
445 if (imgp->firstpage) {
446 exec_unmap_first_page(imgp);
449 VOP_GETVOBJECT(imgp->vp, &object);
452 ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL | VM_ALLOC_RETRY);
454 if ((ma[0]->valid & VM_PAGE_BITS_ALL) != VM_PAGE_BITS_ALL) {
455 initial_pagein = VM_INITIAL_PAGEIN;
456 if (initial_pagein > object->size)
457 initial_pagein = object->size;
458 for (i = 1; i < initial_pagein; i++) {
459 if ((ma[i] = vm_page_lookup(object, i)) != NULL) {
460 if ((ma[i]->flags & PG_BUSY) || ma[i]->busy)
466 ma[i] = vm_page_alloc(object, i, VM_ALLOC_NORMAL);
473 rv = vm_pager_get_pages(object, ma, initial_pagein, 0);
474 ma[0] = vm_page_lookup(object, 0);
476 if ((rv != VM_PAGER_OK) || (ma[0] == NULL) || (ma[0]->valid == 0)) {
478 vm_page_protect(ma[0], VM_PROT_NONE);
487 vm_page_wakeup(ma[0]);
490 pmap_kenter((vm_offset_t) imgp->image_header, VM_PAGE_TO_PHYS(ma[0]));
491 imgp->firstpage = ma[0];
497 exec_unmap_first_page(imgp)
498 struct image_params *imgp;
500 if (imgp->firstpage) {
501 pmap_kremove((vm_offset_t) imgp->image_header);
502 vm_page_unwire(imgp->firstpage, 1);
503 imgp->firstpage = NULL;
508 * Destroy old address space, and allocate a new stack
509 * The new stack is only SGROWSIZ large because it is grown
510 * automatically in trap.c.
513 exec_new_vmspace(imgp)
514 struct image_params *imgp;
517 struct vmspace *vmspace = imgp->proc->p_vmspace;
518 vm_offset_t stack_addr = USRSTACK - maxssiz;
519 vm_map_t map = &vmspace->vm_map;
521 imgp->vmspace_destroyed = 1;
524 * Prevent a pending AIO from modifying the new address space.
526 aio_proc_rundown(imgp->proc);
529 * Blow away entire process VM, if address space not shared,
530 * otherwise, create a new VM space so that other threads are
533 if (vmspace->vm_refcnt == 1) {
536 pmap_remove_pages(vmspace_pmap(vmspace), 0, VM_MAXUSER_ADDRESS);
537 vm_map_remove(map, 0, VM_MAXUSER_ADDRESS);
539 vmspace_exec(imgp->proc);
540 vmspace = imgp->proc->p_vmspace;
541 map = &vmspace->vm_map;
544 /* Allocate a new stack */
545 error = vm_map_stack(&vmspace->vm_map, stack_addr, (vm_size_t)maxssiz,
546 VM_PROT_ALL, VM_PROT_ALL, 0);
550 /* vm_ssize and vm_maxsaddr are somewhat antiquated concepts in the
551 * VM_STACK case, but they are still used to monitor the size of the
552 * process stack so we can check the stack rlimit.
554 vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT;
555 vmspace->vm_maxsaddr = (char *)USRSTACK - maxssiz;
561 * Copy out argument and environment strings from the old process
562 * address space into the temporary string buffer.
565 exec_extract_strings(imgp)
566 struct image_params *imgp;
574 * extract arguments first
577 argv = imgp->uap->argv;
580 argp = (caddr_t) (intptr_t) fuword(argv);
581 if (argp == (caddr_t) -1)
589 if (argp == (caddr_t) -1)
591 if ((error = copyinstr(argp, imgp->stringp,
592 imgp->stringspace, &length))) {
593 if (error == ENAMETOOLONG)
597 imgp->stringspace -= length;
598 imgp->stringp += length;
600 } while ((argp = (caddr_t) (intptr_t) fuword(argv++)));
604 imgp->endargs = imgp->stringp;
607 * extract environment strings
610 envv = imgp->uap->envv;
613 while ((envp = (caddr_t) (intptr_t) fuword(envv++))) {
614 if (envp == (caddr_t) -1)
616 if ((error = copyinstr(envp, imgp->stringp,
617 imgp->stringspace, &length))) {
618 if (error == ENAMETOOLONG)
622 imgp->stringspace -= length;
623 imgp->stringp += length;
632 * Copy strings out to the new process address space, constructing
633 * new arg and env vector tables. Return a pointer to the base
634 * so that it can be used as the initial stack pointer.
637 exec_copyout_strings(imgp)
638 struct image_params *imgp;
642 char *stringp, *destp;
643 register_t *stack_base;
644 struct ps_strings *arginfo;
648 * Calculate string base and vector table pointers.
649 * Also deal with signal trampoline code for this exec type.
651 arginfo = (struct ps_strings *)PS_STRINGS;
652 szsigcode = *(imgp->proc->p_sysent->sv_szsigcode);
653 destp = (caddr_t)arginfo - szsigcode - SPARE_USRSPACE -
654 roundup((ARG_MAX - imgp->stringspace), sizeof(char *));
660 copyout(imgp->proc->p_sysent->sv_sigcode,
661 ((caddr_t)arginfo - szsigcode), szsigcode);
664 * If we have a valid auxargs ptr, prepare some room
669 * The '+ 2' is for the null pointers at the end of each of the
670 * arg and env vector sets, and 'AT_COUNT*2' is room for the
673 vectp = (char **)(destp - (imgp->argc + imgp->envc + 2 +
674 AT_COUNT*2) * sizeof(char*));
677 * The '+ 2' is for the null pointers at the end of each of the
678 * arg and env vector sets
681 (destp - (imgp->argc + imgp->envc + 2) * sizeof(char*));
684 * vectp also becomes our initial stack base
686 stack_base = (register_t *)vectp;
688 stringp = imgp->stringbase;
693 * Copy out strings - arguments and environment.
695 copyout(stringp, destp, ARG_MAX - imgp->stringspace);
698 * Fill in "ps_strings" struct for ps, w, etc.
700 suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp);
701 suword(&arginfo->ps_nargvstr, argc);
704 * Fill in argument portion of vector table.
706 for (; argc > 0; --argc) {
707 suword(vectp++, (long)(intptr_t)destp);
708 while (*stringp++ != 0)
713 /* a null vector table pointer seperates the argp's from the envp's */
716 suword(&arginfo->ps_envstr, (long)(intptr_t)vectp);
717 suword(&arginfo->ps_nenvstr, envc);
720 * Fill in environment portion of vector table.
722 for (; envc > 0; --envc) {
723 suword(vectp++, (long)(intptr_t)destp);
724 while (*stringp++ != 0)
729 /* end of vector table is a null pointer */
736 * Check permissions of file to execute.
737 * Return 0 for success or error code on failure.
740 exec_check_permissions(imgp)
741 struct image_params *imgp;
743 struct proc *p = imgp->proc;
744 struct vnode *vp = imgp->vp;
745 struct vattr *attr = imgp->attr;
748 /* Get file attributes */
749 error = VOP_GETATTR(vp, attr, p->p_ucred, p);
754 * 1) Check if file execution is disabled for the filesystem that this
756 * 2) Insure that at least one execute bit is on - otherwise root
757 * will always succeed, and we don't want to happen unless the
758 * file really is executable.
759 * 3) Insure that the file is a regular file.
761 if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
762 ((attr->va_mode & 0111) == 0) ||
763 (attr->va_type != VREG)) {
768 * Zero length files can't be exec'd
770 if (attr->va_size == 0)
774 * Check for execute permission to file based on current credentials.
776 error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p);
781 * Check number of open-for-writes on the file and deny execution
784 if (vp->v_writecount)
788 * Call filesystem specific open routine (which does nothing in the
791 error = VOP_OPEN(vp, FREAD, p->p_ucred, p);
799 * Exec handler registration
802 exec_register(execsw_arg)
803 const struct execsw *execsw_arg;
805 const struct execsw **es, **xs, **newexecsw;
806 int count = 2; /* New slot and trailing NULL */
809 for (es = execsw; *es; es++)
811 newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
812 if (newexecsw == NULL)
816 for (es = execsw; *es; es++)
821 free(execsw, M_TEMP);
827 exec_unregister(execsw_arg)
828 const struct execsw *execsw_arg;
830 const struct execsw **es, **xs, **newexecsw;
834 panic("unregister with no handlers left?\n");
836 for (es = execsw; *es; es++) {
837 if (*es == execsw_arg)
842 for (es = execsw; *es; es++)
843 if (*es != execsw_arg)
845 newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
846 if (newexecsw == NULL)
849 for (es = execsw; *es; es++)
850 if (*es != execsw_arg)
854 free(execsw, M_TEMP);