exec_script.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $NetBSD: exec_script.c,v 1.38.10.7 2005/09/08 21:06:30 tron Exp $       */
    2 
    3 /*
    4  * Copyright (c) 1993, 1994, 1996 Christopher G. Demetriou
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  * 3. All advertising materials mentioning features or use of this software
   16  *    must display the following acknowledgement:
   17  *      This product includes software developed by Christopher G. Demetriou.
   18  * 4. The name of the author may not be used to endorse or promote products
   19  *    derived from this software without specific prior written permission
   20  *
   21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __KERNEL_RCSID(0, "$NetBSD: exec_script.c,v 1.38.10.7 2005/09/08 21:06:30 tron Exp $");
   35 
   36 #if defined(SETUIDSCRIPTS) && !defined(FDSCRIPTS)
   37 #define FDSCRIPTS               /* Need this for safe set-id scripts. */
   38 #endif
   39 
   40 #include "opt_verified_exec.h"
   41 
   42 #include <sys/param.h>
   43 #include <sys/systm.h>
   44 #include <sys/proc.h>
   45 #include <sys/malloc.h>
   46 #include <sys/vnode.h>
   47 #include <sys/namei.h>
   48 #include <sys/file.h>
   49 #ifdef SETUIDSCRIPTS
   50 #include <sys/stat.h>
   51 #endif
   52 #include <sys/filedesc.h>
   53 #include <sys/exec.h>
   54 #include <sys/resourcevar.h>
   55 
   56 #include <sys/exec_script.h>
   57 #include <sys/exec_elf.h>
   58 
   59 #include <sys/verified_exec.h>
   60 
   61 /*
   62  * exec_script_makecmds(): Check if it's an executable shell script.
   63  *
   64  * Given a proc pointer and an exec package pointer, see if the referent
   65  * of the epp is in shell script.  If it is, then set thing up so that
   66  * the script can be run.  This involves preparing the address space
   67  * and arguments for the shell which will run the script.
   68  *
   69  * This function is ultimately responsible for creating a set of vmcmds
   70  * which can be used to build the process's vm space and inserting them
   71  * into the exec package.
   72  */
   73 int
   74 exec_script_makecmds(struct proc *p, struct exec_package *epp)
   75 {
   76         int error, hdrlinelen, shellnamelen, shellarglen;
   77         char *hdrstr = epp->ep_hdr;
   78         char *cp, *shellname, *shellarg, *oldpnbuf;
   79         char **shellargp, **tmpsap;
   80         struct vnode *scriptvp;
   81 #ifdef SETUIDSCRIPTS
   82         /* Gcc needs those initialized for spurious uninitialized warning */
   83         uid_t script_uid = (uid_t) -1;
   84         gid_t script_gid = NOGROUP;
   85         u_short script_sbits;
   86 #endif
   87 
   88         /*
   89          * if the magic isn't that of a shell script, or we've already
   90          * done shell script processing for this exec, punt on it.
   91          */
   92         if ((epp->ep_flags & EXEC_INDIR) != 0 ||
   93             epp->ep_hdrvalid < EXEC_SCRIPT_MAGICLEN ||
   94             strncmp(hdrstr, EXEC_SCRIPT_MAGIC, EXEC_SCRIPT_MAGICLEN))
   95                 return ENOEXEC;
   96 
   97         /*
   98          * check that the shell spec is terminated by a newline,
   99          * and that it isn't too large.  Don't modify the
  100          * buffer unless we're ready to commit to handling it.
  101          * (The latter requirement means that we have to check
  102          * for both spaces and tabs later on.)
  103          */
  104         hdrlinelen = min(epp->ep_hdrvalid, SCRIPT_HDR_SIZE);
  105         for (cp = hdrstr + EXEC_SCRIPT_MAGICLEN; cp < hdrstr + hdrlinelen;
  106             cp++) {
  107                 if (*cp == '\n') {
  108                         *cp = '\0';
  109                         break;
  110                 }
  111         }
  112         if (cp >= hdrstr + hdrlinelen)
  113                 return ENOEXEC;
  114 
  115         /*
  116          * If the script has an ELF header, don't exec it.
  117          */
  118         if (epp->ep_hdrvalid >= sizeof(ELFMAG)-1 &&
  119             memcmp(hdrstr, ELFMAG, sizeof(ELFMAG)-1) == 0)
  120                 return ENOEXEC;
  121 
  122         shellname = NULL;
  123         shellarg = NULL;
  124         shellarglen = 0;
  125 
  126         /* strip spaces before the shell name */
  127         for (cp = hdrstr + EXEC_SCRIPT_MAGICLEN; *cp == ' ' || *cp == '\t';
  128             cp++)
  129                 ;
  130 
  131         /* collect the shell name; remember it's length for later */
  132         shellname = cp;
  133         shellnamelen = 0;
  134         if (*cp == '\0')
  135                 goto check_shell;
  136         for ( /* cp = cp */ ; *cp != '\0' && *cp != ' ' && *cp != '\t'; cp++)
  137                 shellnamelen++;
  138         if (*cp == '\0')
  139                 goto check_shell;
  140         *cp++ = '\0';
  141 
  142         /* skip spaces before any argument */
  143         for ( /* cp = cp */ ; *cp == ' ' || *cp == '\t'; cp++)
  144                 ;
  145         if (*cp == '\0')
  146                 goto check_shell;
  147 
  148         /*
  149          * collect the shell argument.  everything after the shell name
  150          * is passed as ONE argument; that's the correct (historical)
  151          * behaviour.
  152          */
  153         shellarg = cp;
  154         for ( /* cp = cp */ ; *cp != '\0'; cp++)
  155                 shellarglen++;
  156         *cp++ = '\0';
  157 
  158 check_shell:
  159 #ifdef SETUIDSCRIPTS
  160         /*
  161          * MNT_NOSUID has already taken care of by check_exec,
  162          * so we don't need to worry about it now or later.  We
  163          * will need to check P_TRACED later, however.
  164          */
  165         script_sbits = epp->ep_vap->va_mode & (S_ISUID | S_ISGID);
  166         if (script_sbits != 0) {
  167                 script_uid = epp->ep_vap->va_uid;
  168                 script_gid = epp->ep_vap->va_gid;
  169         }
  170 #endif
  171 #ifdef FDSCRIPTS
  172         /*
  173          * if the script isn't readable, or it's set-id, then we've
  174          * gotta supply a "/dev/fd/..." for the shell to read.
  175          * Note that stupid shells (csh) do the wrong thing, and
  176          * close all open fd's when the start.  That kills this
  177          * method of implementing "safe" set-id and x-only scripts.
  178          */
  179         vn_lock(epp->ep_vp, LK_EXCLUSIVE | LK_RETRY);
  180         error = VOP_ACCESS(epp->ep_vp, VREAD, p->p_ucred, p);
  181         VOP_UNLOCK(epp->ep_vp, 0);
  182         if (error == EACCES
  183 #ifdef SETUIDSCRIPTS
  184             || script_sbits
  185 #endif
  186             ) {
  187                 struct file *fp;
  188 
  189 #if defined(DIAGNOSTIC) && defined(FDSCRIPTS)
  190                 if (epp->ep_flags & EXEC_HASFD)
  191                         panic("exec_script_makecmds: epp already has a fd");
  192 #endif
  193 
  194                 /* falloc() will use the descriptor for us */
  195                 if ((error = falloc(p, &fp, &epp->ep_fd)) != 0) {
  196                         scriptvp = NULL;
  197                         shellargp = NULL;
  198                         goto fail;
  199                 }
  200 
  201                 epp->ep_flags |= EXEC_HASFD;
  202                 fp->f_type = DTYPE_VNODE;
  203                 fp->f_ops = &vnops;
  204                 fp->f_data = (caddr_t) epp->ep_vp;
  205                 fp->f_flag = FREAD;
  206                 FILE_SET_MATURE(fp);
  207                 FILE_UNUSE(fp, p);
  208         }
  209 #endif
  210 
  211         /* set up the parameters for the recursive check_exec() call */
  212         epp->ep_ndp->ni_dirp = shellname;
  213         epp->ep_ndp->ni_segflg = UIO_SYSSPACE;
  214         epp->ep_flags |= EXEC_INDIR;
  215 
  216         /* and set up the fake args list, for later */
  217         MALLOC(shellargp, char **, 4 * sizeof(char *), M_EXEC, M_WAITOK);
  218         tmpsap = shellargp;
  219         MALLOC(*tmpsap, char *, shellnamelen + 1, M_EXEC, M_WAITOK);
  220         strlcpy(*tmpsap++, shellname, shellnamelen + 1);
  221         if (shellarg != NULL) {
  222                 MALLOC(*tmpsap, char *, shellarglen + 1, M_EXEC, M_WAITOK);
  223                 strlcpy(*tmpsap++, shellarg, shellarglen + 1);
  224         }
  225         MALLOC(*tmpsap, char *, MAXPATHLEN, M_EXEC, M_WAITOK);
  226 #ifdef FDSCRIPTS
  227         if ((epp->ep_flags & EXEC_HASFD) == 0) {
  228 #endif
  229                 /* normally can't fail, but check for it if diagnostic */
  230                 error = copyinstr(epp->ep_name, *tmpsap++, MAXPATHLEN,
  231                     (size_t *)0);
  232 #ifdef DIAGNOSTIC
  233                 if (error != 0)
  234                         panic("exec_script: copyinstr couldn't fail");
  235 #endif
  236 #ifdef FDSCRIPTS
  237         } else
  238                 snprintf(*tmpsap++, MAXPATHLEN, "/dev/fd/%d", epp->ep_fd);
  239 #endif
  240         *tmpsap = NULL;
  241 
  242         /*
  243          * mark the header we have as invalid; check_exec will read
  244          * the header from the new executable
  245          */
  246         epp->ep_hdrvalid = 0;
  247 
  248         /*
  249          * remember the old vp and pnbuf for later, so we can restore
  250          * them if check_exec() fails.
  251          */
  252         scriptvp = epp->ep_vp;
  253         oldpnbuf = epp->ep_ndp->ni_cnd.cn_pnbuf;
  254 
  255 #ifdef VERIFIED_EXEC
  256         if ((error = check_exec(p, epp, VERIEXEC_INDIRECT)) == 0) {
  257 #else
  258         if ((error = check_exec(p, epp, 0)) == 0) {
  259 #endif
  260                 /* note that we've clobbered the header */
  261                 epp->ep_flags |= EXEC_DESTR|EXEC_HASES;
  262 
  263                 /*
  264                  * It succeeded.  Unlock the script and
  265                  * close it if we aren't using it any more.
  266                  * Also, set things up so that the fake args
  267                  * list will be used.
  268                  */
  269                 if ((epp->ep_flags & EXEC_HASFD) == 0) {
  270                         vn_lock(scriptvp, LK_EXCLUSIVE | LK_RETRY);
  271                         VOP_CLOSE(scriptvp, FREAD, p->p_ucred, p);
  272                         vput(scriptvp);
  273                 }
  274 
  275                 /* free the old pathname buffer */
  276                 PNBUF_PUT(oldpnbuf);
  277 
  278                 epp->ep_flags |= (EXEC_HASARGL | EXEC_SKIPARG);
  279                 epp->ep_fa = shellargp;
  280 #ifdef SETUIDSCRIPTS
  281                 /*
  282                  * set thing up so that set-id scripts will be
  283                  * handled appropriately.  P_TRACED will be
  284                  * checked later when the shell is actually
  285                  * exec'd.
  286                  */
  287                 epp->ep_vap->va_mode |= script_sbits;
  288                 if (script_sbits & S_ISUID)
  289                         epp->ep_vap->va_uid = script_uid;
  290                 if (script_sbits & S_ISGID)
  291                         epp->ep_vap->va_gid = script_gid;
  292 #endif
  293                 return (0);
  294         }
  295 
  296         /* XXX oldpnbuf not set for "goto fail" path */
  297         epp->ep_ndp->ni_cnd.cn_pnbuf = oldpnbuf;
  298 #ifdef FDSCRIPTS
  299 fail:
  300 #endif
  301         /* note that we've clobbered the header */
  302         epp->ep_flags |= EXEC_DESTR;
  303 
  304         /* kill the opened file descriptor, else close the file */
  305         if (epp->ep_flags & EXEC_HASFD) {
  306                 epp->ep_flags &= ~EXEC_HASFD;
  307                 (void) fdrelease(p, epp->ep_fd);
  308         } else if (scriptvp) {
  309                 vn_lock(scriptvp, LK_EXCLUSIVE | LK_RETRY);
  310                 VOP_CLOSE(scriptvp, FREAD, p->p_ucred, p);
  311                 vput(scriptvp);
  312         }
  313 
  314         PNBUF_PUT(epp->ep_ndp->ni_cnd.cn_pnbuf);
  315 
  316         /* free the fake arg list, because we're not returning it */
  317         if ((tmpsap = shellargp) != NULL) {
  318                 while (*tmpsap != NULL) {
  319                         FREE(*tmpsap, M_EXEC);
  320                         tmpsap++;
  321                 }
  322                 FREE(shellargp, M_EXEC);
  323         }
  324 
  325         /*
  326          * free any vmspace-creation commands,
  327          * and release their references
  328          */
  329         kill_vmcmds(&epp->ep_vmcmds);
  330 
  331         return error;
  332 }
Cache object: 8046ac34e41b7e965981982d8cd3b200
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/kern/exec_script.c

FreeBSD/Linux Kernel Cross Reference
sys/kern/exec_script.c
