usr/src/uts/common/exec/intp/intp.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  * Copyright 2012 Milan Jurik. All rights reserved.
  25  */
  26
  27 /*      Copyright (c) 1988 AT&T */
  28 /*        All Rights Reserved   */
  29
  30
  31 /* from S5R4 1.6 */
  32
  33 #include <sys/types.h>
  34 #include <sys/param.h>
  35 #include <sys/sysmacros.h>
  36 #include <sys/signal.h>
  37 #include <sys/cred.h>
  38 #include <sys/user.h>
  39 #include <sys/errno.h>
  40 #include <sys/vnode.h>
  41 #include <sys/proc.h>
  42 #include <sys/cmn_err.h>
  43 #include <sys/debug.h>
  44 #include <sys/pathname.h>
  45 #include <sys/disp.h>
  46 #include <sys/exec.h>
  47 #include <sys/kmem.h>
  48 #include <sys/note.h>
  49 #include <sys/sdt.h>
  50
  51 /*
  52  * This is the loadable module wrapper.
  53  */
  54 #include <sys/modctl.h>
  55
  56 extern int intpexec(struct vnode *, struct execa *, struct uarg *,
  57     struct intpdata *, int, long *, int, caddr_t, struct cred *, int);
  58
  59 static struct execsw esw = {
  60         intpmagicstr,
  61         0,
  62         2,
  63         intpexec,
  64         NULL
  65 };
  66
  67 /*
  68  * Module linkage information for the kernel.
  69  */
  70 extern struct mod_ops mod_execops;
  71
  72 static struct modlexec modlexec = {
  73         &mod_execops, "exec mod for interp", &esw
  74 };
  75
  76 static struct modlinkage modlinkage = {
  77         MODREV_1, (void *)&modlexec, NULL
  78 };
  79
  80 int
  81 _init()
  82 {
  83         return (mod_install(&modlinkage));
  84 }
  85
  86 int
  87 _fini()
  88 {
  89         return (mod_remove(&modlinkage));
  90 }
  91
  92 int
  93 _info(struct modinfo *modinfop)
  94 {
  95         return (mod_info(&modlinkage, modinfop));
  96 }
  97
  98
  99 /*
 100  * Crack open a '#!' line.
 101  */
 102 static int
 103 getintphead(struct vnode *vp, struct intpdata *idatap)
 104 {
 105         int error;
 106         char *cp, *linep = idatap->intp;
 107         ssize_t resid;
 108
 109         /*
 110          * Read the entire line and confirm that it starts with '#!'.
 111          */
 112         if (error = vn_rdwr(UIO_READ, vp, linep, INTPSZ, (offset_t)0,
 113             UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))
 114                 return (error);
 115         if (resid > INTPSZ-2 || linep[0] != '#' || linep[1] != '!')
 116                 return (ENOEXEC);
 117         /*
 118          * Blank all white space and find the newline.
 119          */
 120         for (cp = &linep[2]; cp < &linep[INTPSZ] && *cp != '\n'; cp++)
 121                 if (*cp == '\t')
 122                         *cp = ' ';
 123         if (cp >= &linep[INTPSZ])
 124                 return (ENOEXEC);
 125         ASSERT(*cp == '\n');
 126         *cp = '\0';
 127
 128         /*
 129          * Locate the beginning and end of the interpreter name.
 130          * In addition to the name, one additional argument may
 131          * optionally be included here, to be prepended to the
 132          * arguments provided on the command line.  Thus, for
 133          * example, you can say
 134          *
 135          *      #! /usr/bin/awk -f
 136          */
 137         for (cp = &linep[2]; *cp == ' '; cp++)
 138                 ;
 139         if (*cp == '\0')
 140                 return (ENOEXEC);
 141         idatap->intp_name[0] = cp;
 142         while (*cp && *cp != ' ')
 143                 cp++;
 144         if (*cp == '\0') {
 145                 idatap->intp_arg[0] = NULL;
 146         } else {
 147                 *cp++ = '\0';
 148                 while (*cp == ' ')
 149                         cp++;
 150                 if (*cp == '\0')
 151                         idatap->intp_arg[0] = NULL;
 152                 else {
 153                         idatap->intp_arg[0] = cp;
 154                         while (*cp && *cp != ' ')
 155                                 cp++;
 156                         *cp = '\0';
 157                 }
 158         }
 159         return (0);
 160 }
 161
 162 /*
 163  * We support nested interpreters up to a depth of INTP_MAXDEPTH (this value
 164  * matches the depth on Linux). When a nested interpreter is in use, the
 165  * previous name and argument must be passed along. We use the intpdata_t
 166  * name and argument arrays for this. In the normal, non-nested case, only the
 167  * first element in those arrays will be populated.
 168  *
 169  * For setid scripts the "script hole" is a security race condition between
 170  * when we exec the interpreter and when the interpreter reads the script. We
 171  * handle this below for the initial script, but we don't allow setid scripts
 172  * when using nested interpreters. Because gexec only modifies the credentials
 173  * for a setid script at level 0, then if we come back through for a nested
 174  * interpreter we know that args->fname will be set (the first script is setid)
 175  * and we can return an error. If an intermediate nested interpreter is setid
 176  * then it will not be run with different credentials because of the gexec
 177  * handling, so it is effectively no longer setid and we don't have to worry
 178  * about the "script hole".
 179  */
 180 int
 181 intpexec(
 182         struct vnode *vp,
 183         struct execa *uap,
 184         struct uarg *args,
 185         struct intpdata *idatap,
 186         int level,
 187         long *execsz,
 188         int setid,
 189         caddr_t exec_file,
 190         struct cred *cred,
 191         int brand_action)
 192 {
 193         _NOTE(ARGUNUSED(brand_action))
 194         vnode_t *nvp;
 195         int error = 0;
 196         struct intpdata idata;
 197         struct pathname intppn;
 198         struct pathname resolvepn;
 199         char *opath;
 200         char devfd[19]; /* 32-bit int fits in 10 digits + 8 for "/dev/fd/" */
 201         int fd = -1;
 202
 203         if (level >= INTP_MAXDEPTH) {   /* Can't recurse past maxdepth */
 204                 error = ELOOP;
 205                 goto bad;
 206         }
 207
 208         if (level == 0)
 209                 ASSERT(idatap == NULL);
 210
 211         bzero(&idata, sizeof (intpdata_t));
 212
 213         /*
 214          * Allocate a buffer to read in the interpreter pathname.
 215          */
 216         idata.intp = kmem_alloc(INTPSZ, KM_SLEEP);
 217         if (error = getintphead(vp, &idata))
 218                 goto fail;
 219
 220         /*
 221          * Look the new vnode up.
 222          */
 223         if (error = pn_get(idata.intp_name[0], UIO_SYSSPACE, &intppn))
 224                 goto fail;
 225         pn_alloc(&resolvepn);
 226         if (error = lookuppn(&intppn, &resolvepn, FOLLOW, NULLVPP, &nvp)) {
 227                 pn_free(&resolvepn);
 228                 pn_free(&intppn);
 229                 goto fail;
 230         }
 231
 232         if (level > 0) {
 233                 /*
 234                  * We have a nested interpreter. The previous name(s) and
 235                  * argument(s) need to be passed along. We also keep track
 236                  * of how often this zone uses nested interpreters.
 237                  */
 238                 int i;
 239
 240                 atomic_inc_32(&curproc->p_zone->zone_nested_intp);
 241
 242                 ASSERT(idatap != NULL);
 243                 /* since we're shifting up, loop stops one short */
 244                 for (i = 0; i < (INTP_MAXDEPTH - 1); i++) {
 245                         idata.intp_name[i + 1] = idatap->intp_name[i];
 246                         idata.intp_arg[i + 1] = idatap->intp_arg[i];
 247                 }
 248
 249                 DTRACE_PROBE3(nested__intp, int, level, void *, &idata,
 250                     void *, nvp);
 251         }
 252
 253         opath = args->pathname;
 254         args->pathname = resolvepn.pn_path;
 255         /* don't free resolvepn until we are done with args */
 256         pn_free(&intppn);
 257
 258         /*
 259          * Disallow setuid or additional privilege execution for nested
 260          * interpreters.
 261          */
 262         if (level > 0 && args->fname != NULL) {
 263                 error = ENOEXEC;
 264                 goto done;
 265         }
 266
 267         /*
 268          * When we're executing a set-uid script resulting in uids
 269          * mismatching or when we execute with additional privileges,
 270          * we close the "replace script between exec and open by shell"
 271          * hole by passing the script as /dev/fd parameter.
 272          */
 273         if ((setid & EXECSETID_PRIVS) != 0 ||
 274             (setid & (EXECSETID_UGIDS|EXECSETID_SETID)) ==
 275             (EXECSETID_UGIDS|EXECSETID_SETID)) {
 276                 (void) strcpy(devfd, "/dev/fd/");
 277                 if (error = execopen(&vp, &fd))
 278                         goto done;
 279                 numtos(fd, &devfd[8]);
 280                 args->fname = devfd;
 281         }
 282
 283         error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred,
 284             EBA_NONE);
 285
 286         if (!error) {
 287                 /*
 288                  * Close this executable as the interpreter
 289                  * will open and close it later on.
 290                  */
 291                 (void) fop_close(vp, FREAD, 1, (offset_t)0, cred, NULL);
 292         }
 293 done:
 294         VN_RELE(nvp);
 295         args->pathname = opath;
 296         pn_free(&resolvepn);
 297 fail:
 298         kmem_free(idata.intp, INTPSZ);
 299         if (error && fd != -1)
 300                 (void) execclose(fd);
 301 bad:
 302         return (error);
 303 }