FreeBSD/Linux Kernel Cross Reference
sys/kern/kern_exec.c
1 /*-
2 * Copyright (c) 1993, David Greenman
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD: src/sys/kern/kern_exec.c,v 1.321 2008/08/12 21:27:48 csjp Exp $");
29
30 #include "opt_hwpmc_hooks.h"
31 #include "opt_kdtrace.h"
32 #include "opt_ktrace.h"
33 #include "opt_mac.h"
34 #include "opt_vm.h"
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/eventhandler.h>
39 #include <sys/lock.h>
40 #include <sys/mutex.h>
41 #include <sys/sysproto.h>
42 #include <sys/signalvar.h>
43 #include <sys/kernel.h>
44 #include <sys/mount.h>
45 #include <sys/filedesc.h>
46 #include <sys/fcntl.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/imgact.h>
50 #include <sys/imgact_elf.h>
51 #include <sys/wait.h>
52 #include <sys/malloc.h>
53 #include <sys/priv.h>
54 #include <sys/proc.h>
55 #include <sys/pioctl.h>
56 #include <sys/namei.h>
57 #include <sys/resourcevar.h>
58 #include <sys/sdt.h>
59 #include <sys/sf_buf.h>
60 #include <sys/syscallsubr.h>
61 #include <sys/sysent.h>
62 #include <sys/shm.h>
63 #include <sys/sysctl.h>
64 #include <sys/vnode.h>
65 #ifdef KTRACE
66 #include <sys/ktrace.h>
67 #endif
68
69 #include <vm/vm.h>
70 #include <vm/vm_param.h>
71 #include <vm/pmap.h>
72 #include <vm/vm_page.h>
73 #include <vm/vm_map.h>
74 #include <vm/vm_kern.h>
75 #include <vm/vm_extern.h>
76 #include <vm/vm_object.h>
77 #include <vm/vm_pager.h>
78
79 #ifdef HWPMC_HOOKS
80 #include <sys/pmckern.h>
81 #endif
82
83 #include <machine/reg.h>
84
85 #include <security/audit/audit.h>
86 #include <security/mac/mac_framework.h>
87
88 #ifdef KDTRACE_HOOKS
89 #include <sys/dtrace_bsd.h>
90 dtrace_execexit_func_t dtrace_fasttrap_exec;
91 #endif
92
93 SDT_PROVIDER_DECLARE(proc);
94 SDT_PROBE_DEFINE(proc, kernel, , exec);
95 SDT_PROBE_ARGTYPE(proc, kernel, , exec, 0, "char *");
96 SDT_PROBE_DEFINE(proc, kernel, , exec_failure);
97 SDT_PROBE_ARGTYPE(proc, kernel, , exec_failure, 0, "int");
98 SDT_PROBE_DEFINE(proc, kernel, , exec_success);
99 SDT_PROBE_ARGTYPE(proc, kernel, , exec_success, 0, "char *");
100
101 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
102
103 static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS);
104 static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS);
105 static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS);
106 static int do_execve(struct thread *td, struct image_args *args,
107 struct mac *mac_p);
108 static void exec_free_args(struct image_args *);
109
110 /* XXX This should be vm_size_t. */
111 SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD,
112 NULL, 0, sysctl_kern_ps_strings, "LU", "");
113
114 /* XXX This should be vm_size_t. */
115 SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD,
116 NULL, 0, sysctl_kern_usrstack, "LU", "");
117
118 SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD,
119 NULL, 0, sysctl_kern_stackprot, "I", "");
120
121 u_long ps_arg_cache_limit = PAGE_SIZE / 16;
122 SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
123 &ps_arg_cache_limit, 0, "");
124
125 static int
126 sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
127 {
128 struct proc *p;
129 int error;
130
131 p = curproc;
132 #ifdef SCTL_MASK32
133 if (req->flags & SCTL_MASK32) {
134 unsigned int val;
135 val = (unsigned int)p->p_sysent->sv_psstrings;
136 error = SYSCTL_OUT(req, &val, sizeof(val));
137 } else
138 #endif
139 error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings,
140 sizeof(p->p_sysent->sv_psstrings));
141 return error;
142 }
143
144 static int
145 sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS)
146 {
147 struct proc *p;
148 int error;
149
150 p = curproc;
151 #ifdef SCTL_MASK32
152 if (req->flags & SCTL_MASK32) {
153 unsigned int val;
154 val = (unsigned int)p->p_sysent->sv_usrstack;
155 error = SYSCTL_OUT(req, &val, sizeof(val));
156 } else
157 #endif
158 error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack,
159 sizeof(p->p_sysent->sv_usrstack));
160 return error;
161 }
162
163 static int
164 sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS)
165 {
166 struct proc *p;
167
168 p = curproc;
169 return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot,
170 sizeof(p->p_sysent->sv_stackprot)));
171 }
172
173 /*
174 * Each of the items is a pointer to a `const struct execsw', hence the
175 * double pointer here.
176 */
177 static const struct execsw **execsw;
178
179 #ifndef _SYS_SYSPROTO_H_
180 struct execve_args {
181 char *fname;
182 char **argv;
183 char **envv;
184 };
185 #endif
186
187 int
188 execve(td, uap)
189 struct thread *td;
190 struct execve_args /* {
191 char *fname;
192 char **argv;
193 char **envv;
194 } */ *uap;
195 {
196 int error;
197 struct image_args args;
198
199 error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
200 uap->argv, uap->envv);
201 if (error == 0)
202 error = kern_execve(td, &args, NULL);
203 return (error);
204 }
205
206 #ifndef _SYS_SYSPROTO_H_
207 struct fexecve_args {
208 int fd;
209 char **argv;
210 char **envv;
211 }
212 #endif
213 int
214 fexecve(struct thread *td, struct fexecve_args *uap)
215 {
216 int error;
217 struct image_args args;
218
219 error = exec_copyin_args(&args, NULL, UIO_SYSSPACE,
220 uap->argv, uap->envv);
221 if (error == 0) {
222 args.fd = uap->fd;
223 error = kern_execve(td, &args, NULL);
224 }
225 return (error);
226 }
227
228 #ifndef _SYS_SYSPROTO_H_
229 struct __mac_execve_args {
230 char *fname;
231 char **argv;
232 char **envv;
233 struct mac *mac_p;
234 };
235 #endif
236
237 int
238 __mac_execve(td, uap)
239 struct thread *td;
240 struct __mac_execve_args /* {
241 char *fname;
242 char **argv;
243 char **envv;
244 struct mac *mac_p;
245 } */ *uap;
246 {
247 #ifdef MAC
248 int error;
249 struct image_args args;
250
251 error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
252 uap->argv, uap->envv);
253 if (error == 0)
254 error = kern_execve(td, &args, uap->mac_p);
255 return (error);
256 #else
257 return (ENOSYS);
258 #endif
259 }
260
261 /*
262 * XXX: kern_execve has the astonishing property of not always returning to
263 * the caller. If sufficiently bad things happen during the call to
264 * do_execve(), it can end up calling exit1(); as a result, callers must
265 * avoid doing anything which they might need to undo (e.g., allocating
266 * memory).
267 */
268 int
269 kern_execve(td, args, mac_p)
270 struct thread *td;
271 struct image_args *args;
272 struct mac *mac_p;
273 {
274 struct proc *p = td->td_proc;
275 int error;
276
277 AUDIT_ARG(argv, args->begin_argv, args->argc,
278 args->begin_envv - args->begin_argv);
279 AUDIT_ARG(envv, args->begin_envv, args->envc,
280 args->endp - args->begin_envv);
281 if (p->p_flag & P_HADTHREADS) {
282 PROC_LOCK(p);
283 if (thread_single(SINGLE_BOUNDARY)) {
284 PROC_UNLOCK(p);
285 exec_free_args(args);
286 return (ERESTART); /* Try again later. */
287 }
288 PROC_UNLOCK(p);
289 }
290
291 error = do_execve(td, args, mac_p);
292
293 if (p->p_flag & P_HADTHREADS) {
294 PROC_LOCK(p);
295 /*
296 * If success, we upgrade to SINGLE_EXIT state to
297 * force other threads to suicide.
298 */
299 if (error == 0)
300 thread_single(SINGLE_EXIT);
301 else
302 thread_single_end();
303 PROC_UNLOCK(p);
304 }
305
306 return (error);
307 }
308
309 /*
310 * In-kernel implementation of execve(). All arguments are assumed to be
311 * userspace pointers from the passed thread.
312 */
313 static int
314 do_execve(td, args, mac_p)
315 struct thread *td;
316 struct image_args *args;
317 struct mac *mac_p;
318 {
319 struct proc *p = td->td_proc;
320 struct nameidata nd, *ndp;
321 struct ucred *newcred = NULL, *oldcred;
322 struct uidinfo *euip;
323 register_t *stack_base;
324 int error, len = 0, i;
325 struct image_params image_params, *imgp;
326 struct vattr attr;
327 int (*img_first)(struct image_params *);
328 struct pargs *oldargs = NULL, *newargs = NULL;
329 struct sigacts *oldsigacts, *newsigacts;
330 #ifdef KTRACE
331 struct vnode *tracevp = NULL;
332 struct ucred *tracecred = NULL;
333 #endif
334 struct vnode *textvp = NULL, *binvp = NULL;
335 int credential_changing;
336 int vfslocked;
337 int textset;
338 #ifdef MAC
339 struct label *interplabel = NULL;
340 int will_transition;
341 #endif
342 #ifdef HWPMC_HOOKS
343 struct pmckern_procexec pe;
344 #endif
345 static const char fexecv_proc_title[] = "(fexecv)";
346
347 vfslocked = 0;
348 imgp = &image_params;
349
350 /*
351 * Lock the process and set the P_INEXEC flag to indicate that
352 * it should be left alone until we're done here. This is
353 * necessary to avoid race conditions - e.g. in ptrace() -
354 * that might allow a local user to illicitly obtain elevated
355 * privileges.
356 */
357 PROC_LOCK(p);
358 KASSERT((p->p_flag & P_INEXEC) == 0,
359 ("%s(): process already has P_INEXEC flag", __func__));
360 p->p_flag |= P_INEXEC;
361 PROC_UNLOCK(p);
362
363 /*
364 * Initialize part of the common data
365 */
366 imgp->proc = p;
367 imgp->execlabel = NULL;
368 imgp->attr = &attr;
369 imgp->entry_addr = 0;
370 imgp->vmspace_destroyed = 0;
371 imgp->interpreted = 0;
372 imgp->opened = 0;
373 imgp->interpreter_name = args->buf + PATH_MAX + ARG_MAX;
374 imgp->auxargs = NULL;
375 imgp->vp = NULL;
376 imgp->object = NULL;
377 imgp->firstpage = NULL;
378 imgp->ps_strings = 0;
379 imgp->auxarg_size = 0;
380 imgp->args = args;
381
382 #ifdef MAC
383 error = mac_execve_enter(imgp, mac_p);
384 if (error)
385 goto exec_fail;
386 #endif
387
388 imgp->image_header = NULL;
389
390 SDT_PROBE(proc, kernel, , exec, args->fname, 0, 0, 0, 0 );
391
392 /*
393 * Translate the file name. namei() returns a vnode pointer
394 * in ni_vp amoung other things.
395 *
396 * XXXAUDIT: It would be desirable to also audit the name of the
397 * interpreter if this is an interpreted binary.
398 */
399 if (args->fname != NULL) {
400 ndp = &nd;
401 NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME
402 | MPSAFE | AUDITVNODE1, UIO_SYSSPACE, args->fname, td);
403 }
404
405 interpret:
406 if (args->fname != NULL) {
407 error = namei(ndp);
408 if (error)
409 goto exec_fail;
410
411 vfslocked = NDHASGIANT(ndp);
412 binvp = ndp->ni_vp;
413 imgp->vp = binvp;
414 } else {
415 error = fgetvp(td, args->fd, &binvp);
416 if (error)
417 goto exec_fail;
418 vfslocked = VFS_LOCK_GIANT(binvp->v_mount);
419 vn_lock(binvp, LK_EXCLUSIVE | LK_RETRY);
420 imgp->vp = binvp;
421 }
422
423 /*
424 * Check file permissions (also 'opens' file)
425 */
426 error = exec_check_permissions(imgp);
427 if (error)
428 goto exec_fail_dealloc;
429
430 imgp->object = imgp->vp->v_object;
431 if (imgp->object != NULL)
432 vm_object_reference(imgp->object);
433
434 /*
435 * Set VV_TEXT now so no one can write to the executable while we're
436 * activating it.
437 *
438 * Remember if this was set before and unset it in case this is not
439 * actually an executable image.
440 */
441 textset = imgp->vp->v_vflag & VV_TEXT;
442 imgp->vp->v_vflag |= VV_TEXT;
443
444 error = exec_map_first_page(imgp);
445 if (error)
446 goto exec_fail_dealloc;
447
448 imgp->proc->p_osrel = 0;
449 /*
450 * If the current process has a special image activator it
451 * wants to try first, call it. For example, emulating shell
452 * scripts differently.
453 */
454 error = -1;
455 if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
456 error = img_first(imgp);
457
458 /*
459 * Loop through the list of image activators, calling each one.
460 * An activator returns -1 if there is no match, 0 on success,
461 * and an error otherwise.
462 */
463 for (i = 0; error == -1 && execsw[i]; ++i) {
464 if (execsw[i]->ex_imgact == NULL ||
465 execsw[i]->ex_imgact == img_first) {
466 continue;
467 }
468 error = (*execsw[i]->ex_imgact)(imgp);
469 }
470
471 if (error) {
472 if (error == -1) {
473 if (textset == 0)
474 imgp->vp->v_vflag &= ~VV_TEXT;
475 error = ENOEXEC;
476 }
477 goto exec_fail_dealloc;
478 }
479
480 /*
481 * Special interpreter operation, cleanup and loop up to try to
482 * activate the interpreter.
483 */
484 if (imgp->interpreted) {
485 exec_unmap_first_page(imgp);
486 /*
487 * VV_TEXT needs to be unset for scripts. There is a short
488 * period before we determine that something is a script where
489 * VV_TEXT will be set. The vnode lock is held over this
490 * entire period so nothing should illegitimately be blocked.
491 */
492 imgp->vp->v_vflag &= ~VV_TEXT;
493 /* free name buffer and old vnode */
494 if (args->fname != NULL)
495 NDFREE(ndp, NDF_ONLY_PNBUF);
496 #ifdef MAC
497 interplabel = mac_vnode_label_alloc();
498 mac_vnode_copy_label(binvp->v_label, interplabel);
499 #endif
500 if (imgp->opened) {
501 VOP_CLOSE(binvp, FREAD, td->td_ucred, td);
502 imgp->opened = 0;
503 }
504 vput(binvp);
505 vm_object_deallocate(imgp->object);
506 imgp->object = NULL;
507 VFS_UNLOCK_GIANT(vfslocked);
508 vfslocked = 0;
509 /* set new name to that of the interpreter */
510 NDINIT(ndp, LOOKUP, LOCKLEAF | FOLLOW | SAVENAME | MPSAFE,
511 UIO_SYSSPACE, imgp->interpreter_name, td);
512 args->fname = imgp->interpreter_name;
513 goto interpret;
514 }
515
516 /*
517 * NB: We unlock the vnode here because it is believed that none
518 * of the sv_copyout_strings/sv_fixup operations require the vnode.
519 */
520 VOP_UNLOCK(imgp->vp, 0);
521 /*
522 * Copy out strings (args and env) and initialize stack base
523 */
524 if (p->p_sysent->sv_copyout_strings)
525 stack_base = (*p->p_sysent->sv_copyout_strings)(imgp);
526 else
527 stack_base = exec_copyout_strings(imgp);
528
529 /*
530 * If custom stack fixup routine present for this process
531 * let it do the stack setup.
532 * Else stuff argument count as first item on stack
533 */
534 if (p->p_sysent->sv_fixup != NULL)
535 (*p->p_sysent->sv_fixup)(&stack_base, imgp);
536 else
537 suword(--stack_base, imgp->args->argc);
538
539 /*
540 * For security and other reasons, the file descriptor table cannot
541 * be shared after an exec.
542 */
543 fdunshare(p, td);
544
545 /*
546 * Malloc things before we need locks.
547 */
548 newcred = crget();
549 euip = uifind(attr.va_uid);
550 i = imgp->args->begin_envv - imgp->args->begin_argv;
551 /* Cache arguments if they fit inside our allowance */
552 if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
553 newargs = pargs_alloc(i);
554 bcopy(imgp->args->begin_argv, newargs->ar_args, i);
555 }
556
557 /* close files on exec */
558 fdcloseexec(td);
559 vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
560
561 /* Get a reference to the vnode prior to locking the proc */
562 VREF(binvp);
563
564 /*
565 * For security and other reasons, signal handlers cannot
566 * be shared after an exec. The new process gets a copy of the old
567 * handlers. In execsigs(), the new process will have its signals
568 * reset.
569 */
570 PROC_LOCK(p);
571 if (sigacts_shared(p->p_sigacts)) {
572 oldsigacts = p->p_sigacts;
573 PROC_UNLOCK(p);
574 newsigacts = sigacts_alloc();
575 sigacts_copy(newsigacts, oldsigacts);
576 PROC_LOCK(p);
577 p->p_sigacts = newsigacts;
578 } else
579 oldsigacts = NULL;
580
581 /* Stop profiling */
582 stopprofclock(p);
583
584 /* reset caught signals */
585 execsigs(p);
586
587 /* name this process - nameiexec(p, ndp) */
588 if (args->fname) {
589 len = min(ndp->ni_cnd.cn_namelen,MAXCOMLEN);
590 bcopy(ndp->ni_cnd.cn_nameptr, p->p_comm, len);
591 } else {
592 len = MAXCOMLEN;
593 if (vn_commname(binvp, p->p_comm, MAXCOMLEN + 1) == 0)
594 len = MAXCOMLEN;
595 else {
596 len = sizeof(fexecv_proc_title);
597 bcopy(fexecv_proc_title, p->p_comm, len);
598 }
599 }
600 p->p_comm[len] = 0;
601 bcopy(p->p_comm, td->td_name, sizeof(td->td_name));
602
603 /*
604 * mark as execed, wakeup the process that vforked (if any) and tell
605 * it that it now has its own resources back
606 */
607 p->p_flag |= P_EXEC;
608 if (p->p_pptr && (p->p_flag & P_PPWAIT)) {
609 p->p_flag &= ~P_PPWAIT;
610 wakeup(p->p_pptr);
611 }
612
613 /*
614 * Implement image setuid/setgid.
615 *
616 * Don't honor setuid/setgid if the filesystem prohibits it or if
617 * the process is being traced.
618 *
619 * XXXMAC: For the time being, use NOSUID to also prohibit
620 * transitions on the file system.
621 */
622 oldcred = p->p_ucred;
623 credential_changing = 0;
624 credential_changing |= (attr.va_mode & VSUID) && oldcred->cr_uid !=
625 attr.va_uid;
626 credential_changing |= (attr.va_mode & VSGID) && oldcred->cr_gid !=
627 attr.va_gid;
628 #ifdef MAC
629 will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp,
630 interplabel, imgp);
631 credential_changing |= will_transition;
632 #endif
633
634 if (credential_changing &&
635 (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
636 (p->p_flag & P_TRACED) == 0) {
637 /*
638 * Turn off syscall tracing for set-id programs, except for
639 * root. Record any set-id flags first to make sure that
640 * we do not regain any tracing during a possible block.
641 */
642 setsugid(p);
643
644 #ifdef KTRACE
645 if (p->p_tracevp != NULL &&
646 priv_check_cred(oldcred, PRIV_DEBUG_DIFFCRED, 0)) {
647 mtx_lock(&ktrace_mtx);
648 p->p_traceflag = 0;
649 tracevp = p->p_tracevp;
650 p->p_tracevp = NULL;
651 tracecred = p->p_tracecred;
652 p->p_tracecred = NULL;
653 mtx_unlock(&ktrace_mtx);
654 }
655 #endif
656 /*
657 * Close any file descriptors 0..2 that reference procfs,
658 * then make sure file descriptors 0..2 are in use.
659 *
660 * setugidsafety() may call closef() and then pfind()
661 * which may grab the process lock.
662 * fdcheckstd() may call falloc() which may block to
663 * allocate memory, so temporarily drop the process lock.
664 */
665 PROC_UNLOCK(p);
666 setugidsafety(td);
667 VOP_UNLOCK(imgp->vp, 0);
668 error = fdcheckstd(td);
669 vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
670 if (error != 0)
671 goto done1;
672 PROC_LOCK(p);
673 /*
674 * Set the new credentials.
675 */
676 crcopy(newcred, oldcred);
677 if (attr.va_mode & VSUID)
678 change_euid(newcred, euip);
679 if (attr.va_mode & VSGID)
680 change_egid(newcred, attr.va_gid);
681 #ifdef MAC
682 if (will_transition) {
683 mac_vnode_execve_transition(oldcred, newcred, imgp->vp,
684 interplabel, imgp);
685 }
686 #endif
687 /*
688 * Implement correct POSIX saved-id behavior.
689 *
690 * XXXMAC: Note that the current logic will save the
691 * uid and gid if a MAC domain transition occurs, even
692 * though maybe it shouldn't.
693 */
694 change_svuid(newcred, newcred->cr_uid);
695 change_svgid(newcred, newcred->cr_gid);
696 p->p_ucred = newcred;
697 newcred = NULL;
698 } else {
699 if (oldcred->cr_uid == oldcred->cr_ruid &&
700 oldcred->cr_gid == oldcred->cr_rgid)
701 p->p_flag &= ~P_SUGID;
702 /*
703 * Implement correct POSIX saved-id behavior.
704 *
705 * XXX: It's not clear that the existing behavior is
706 * POSIX-compliant. A number of sources indicate that the
707 * saved uid/gid should only be updated if the new ruid is
708 * not equal to the old ruid, or the new euid is not equal
709 * to the old euid and the new euid is not equal to the old
710 * ruid. The FreeBSD code always updates the saved uid/gid.
711 * Also, this code uses the new (replaced) euid and egid as
712 * the source, which may or may not be the right ones to use.
713 */
714 if (oldcred->cr_svuid != oldcred->cr_uid ||
715 oldcred->cr_svgid != oldcred->cr_gid) {
716 crcopy(newcred, oldcred);
717 change_svuid(newcred, newcred->cr_uid);
718 change_svgid(newcred, newcred->cr_gid);
719 p->p_ucred = newcred;
720 newcred = NULL;
721 }
722 }
723
724 /*
725 * Store the vp for use in procfs. This vnode was referenced prior
726 * to locking the proc lock.
727 */
728 textvp = p->p_textvp;
729 p->p_textvp = binvp;
730
731 #ifdef KDTRACE_HOOKS
732 /*
733 * Tell the DTrace fasttrap provider about the exec if it
734 * has declared an interest.
735 */
736 if (dtrace_fasttrap_exec)
737 dtrace_fasttrap_exec(p);
738 #endif
739
740 /*
741 * Notify others that we exec'd, and clear the P_INEXEC flag
742 * as we're now a bona fide freshly-execed process.
743 */
744 KNOTE_LOCKED(&p->p_klist, NOTE_EXEC);
745 p->p_flag &= ~P_INEXEC;
746
747 /*
748 * If tracing the process, trap to debugger so breakpoints
749 * can be set before the program executes.
750 * Use tdsignal to deliver signal to current thread, use
751 * psignal may cause the signal to be delivered to wrong thread
752 * because that thread will exit, remember we are going to enter
753 * single thread mode.
754 */
755 if (p->p_flag & P_TRACED)
756 tdsignal(p, td, SIGTRAP, NULL);
757
758 /* clear "fork but no exec" flag, as we _are_ execing */
759 p->p_acflag &= ~AFORK;
760
761 /*
762 * Free any previous argument cache and replace it with
763 * the new argument cache, if any.
764 */
765 oldargs = p->p_args;
766 p->p_args = newargs;
767 newargs = NULL;
768
769 #ifdef HWPMC_HOOKS
770 /*
771 * Check if system-wide sampling is in effect or if the
772 * current process is using PMCs. If so, do exec() time
773 * processing. This processing needs to happen AFTER the
774 * P_INEXEC flag is cleared.
775 *
776 * The proc lock needs to be released before taking the PMC
777 * SX.
778 */
779 if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
780 PROC_UNLOCK(p);
781 pe.pm_credentialschanged = credential_changing;
782 pe.pm_entryaddr = imgp->entry_addr;
783
784 PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
785 } else
786 PROC_UNLOCK(p);
787 #else /* !HWPMC_HOOKS */
788 PROC_UNLOCK(p);
789 #endif
790
791 /* Set values passed into the program in registers. */
792 if (p->p_sysent->sv_setregs)
793 (*p->p_sysent->sv_setregs)(td, imgp->entry_addr,
794 (u_long)(uintptr_t)stack_base, imgp->ps_strings);
795 else
796 exec_setregs(td, imgp->entry_addr,
797 (u_long)(uintptr_t)stack_base, imgp->ps_strings);
798
799 vfs_mark_atime(imgp->vp, td);
800
801 done1:
802
803 /*
804 * Free any resources malloc'd earlier that we didn't use.
805 */
806 uifree(euip);
807 if (newcred == NULL)
808 crfree(oldcred);
809 else
810 crfree(newcred);
811 VOP_UNLOCK(imgp->vp, 0);
812
813 SDT_PROBE(proc, kernel, , exec_success, args->fname, 0, 0, 0, 0);
814
815 /*
816 * Handle deferred decrement of ref counts.
817 */
818 if (textvp != NULL) {
819 int tvfslocked;
820
821 tvfslocked = VFS_LOCK_GIANT(textvp->v_mount);
822 vrele(textvp);
823 VFS_UNLOCK_GIANT(tvfslocked);
824 }
825 if (binvp && error != 0)
826 vrele(binvp);
827 #ifdef KTRACE
828 if (tracevp != NULL) {
829 int tvfslocked;
830
831 tvfslocked = VFS_LOCK_GIANT(tracevp->v_mount);
832 vrele(tracevp);
833 VFS_UNLOCK_GIANT(tvfslocked);
834 }
835 if (tracecred != NULL)
836 crfree(tracecred);
837 #endif
838 vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY);
839 pargs_drop(oldargs);
840 pargs_drop(newargs);
841 if (oldsigacts != NULL)
842 sigacts_free(oldsigacts);
843
844 exec_fail_dealloc:
845
846 /*
847 * free various allocated resources
848 */
849 if (imgp->firstpage != NULL)
850 exec_unmap_first_page(imgp);
851
852 if (imgp->vp != NULL) {
853 if (args->fname)
854 NDFREE(ndp, NDF_ONLY_PNBUF);
855 if (imgp->opened)
856 VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td);
857 vput(imgp->vp);
858 }
859
860 if (imgp->object != NULL)
861 vm_object_deallocate(imgp->object);
862
863 if (error == 0) {
864 /*
865 * Stop the process here if its stop event mask has
866 * the S_EXEC bit set.
867 */
868 STOPEVENT(p, S_EXEC, 0);
869 goto done2;
870 }
871
872 exec_fail:
873 /* we're done here, clear P_INEXEC */
874 PROC_LOCK(p);
875 p->p_flag &= ~P_INEXEC;
876 PROC_UNLOCK(p);
877
878 SDT_PROBE(proc, kernel, , exec_failure, error, 0, 0, 0, 0);
879
880 done2:
881 #ifdef MAC
882 mac_execve_exit(imgp);
883 if (interplabel != NULL)
884 mac_vnode_label_free(interplabel);
885 #endif
886 VFS_UNLOCK_GIANT(vfslocked);
887 exec_free_args(args);
888
889 if (error && imgp->vmspace_destroyed) {
890 /* sorry, no more process anymore. exit gracefully */
891 exit1(td, W_EXITCODE(0, SIGABRT));
892 /* NOT REACHED */
893 }
894 return (error);
895 }
896
897 int
898 exec_map_first_page(imgp)
899 struct image_params *imgp;
900 {
901 int rv, i;
902 int initial_pagein;
903 vm_page_t ma[VM_INITIAL_PAGEIN];
904 vm_object_t object;
905
906 if (imgp->firstpage != NULL)
907 exec_unmap_first_page(imgp);
908
909 object = imgp->vp->v_object;
910 if (object == NULL)
911 return (EACCES);
912 VM_OBJECT_LOCK(object);
913 #if VM_NRESERVLEVEL > 0
914 if ((object->flags & OBJ_COLORED) == 0) {
915 object->flags |= OBJ_COLORED;
916 object->pg_color = 0;
917 }
918 #endif
919 ma[0] = vm_page_grab(object, 0, VM_ALLOC_NORMAL | VM_ALLOC_RETRY);
920 if ((ma[0]->valid & VM_PAGE_BITS_ALL) != VM_PAGE_BITS_ALL) {
921 initial_pagein = VM_INITIAL_PAGEIN;
922 if (initial_pagein > object->size)
923 initial_pagein = object->size;
924 for (i = 1; i < initial_pagein; i++) {
925 if ((ma[i] = vm_page_lookup(object, i)) != NULL) {
926 if (ma[i]->valid)
927 break;
928 if ((ma[i]->oflags & VPO_BUSY) || ma[i]->busy)
929 break;
930 vm_page_busy(ma[i]);
931 } else {
932 ma[i] = vm_page_alloc(object, i,
933 VM_ALLOC_NORMAL | VM_ALLOC_IFNOTCACHED);
934 if (ma[i] == NULL)
935 break;
936 }
937 }
938 initial_pagein = i;
939 rv = vm_pager_get_pages(object, ma, initial_pagein, 0);
940 ma[0] = vm_page_lookup(object, 0);
941 if ((rv != VM_PAGER_OK) || (ma[0] == NULL) ||
942 (ma[0]->valid == 0)) {
943 if (ma[0]) {
944 vm_page_lock_queues();
945 vm_page_free(ma[0]);
946 vm_page_unlock_queues();
947 }
948 VM_OBJECT_UNLOCK(object);
949 return (EIO);
950 }
951 }
952 vm_page_lock_queues();
953 vm_page_hold(ma[0]);
954 vm_page_unlock_queues();
955 vm_page_wakeup(ma[0]);
956 VM_OBJECT_UNLOCK(object);
957
958 imgp->firstpage = sf_buf_alloc(ma[0], 0);
959 imgp->image_header = (char *)sf_buf_kva(imgp->firstpage);
960
961 return (0);
962 }
963
964 void
965 exec_unmap_first_page(imgp)
966 struct image_params *imgp;
967 {
968 vm_page_t m;
969
970 if (imgp->firstpage != NULL) {
971 m = sf_buf_page(imgp->firstpage);
972 sf_buf_free(imgp->firstpage);
973 imgp->firstpage = NULL;
974 vm_page_lock_queues();
975 vm_page_unhold(m);
976 vm_page_unlock_queues();
977 }
978 }
979
980 /*
981 * Destroy old address space, and allocate a new stack
982 * The new stack is only SGROWSIZ large because it is grown
983 * automatically in trap.c.
984 */
985 int
986 exec_new_vmspace(imgp, sv)
987 struct image_params *imgp;
988 struct sysentvec *sv;
989 {
990 int error;
991 struct proc *p = imgp->proc;
992 struct vmspace *vmspace = p->p_vmspace;
993 vm_offset_t stack_addr;
994 vm_map_t map;
995 u_long ssiz;
996
997 imgp->vmspace_destroyed = 1;
998 imgp->sysent = sv;
999
1000 /* May be called with Giant held */
1001 EVENTHANDLER_INVOKE(process_exec, p, imgp);
1002
1003 /*
1004 * Blow away entire process VM, if address space not shared,
1005 * otherwise, create a new VM space so that other threads are
1006 * not disrupted
1007 */
1008 map = &vmspace->vm_map;
1009 if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv->sv_minuser &&
1010 vm_map_max(map) == sv->sv_maxuser) {
1011 shmexit(vmspace);
1012 pmap_remove_pages(vmspace_pmap(vmspace));
1013 vm_map_remove(map, vm_map_min(map), vm_map_max(map));
1014 } else {
1015 error = vmspace_exec(p, sv->sv_minuser, sv->sv_maxuser);
1016 if (error)
1017 return (error);
1018 vmspace = p->p_vmspace;
1019 map = &vmspace->vm_map;
|