2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* linux/fs/binfmt_script.c
|
|
|
|
*
|
2007-10-20 01:21:04 +04:00
|
|
|
* Copyright (C) 1996 Martin von Löwis
|
2005-04-17 02:20:36 +04:00
|
|
|
* original #!-checking implemented by tytso.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/stat.h>
|
|
|
|
#include <linux/binfmts.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/err.h>
|
|
|
|
#include <linux/fs.h>
|
|
|
|
|
2012-10-21 06:00:48 +04:00
|
|
|
static int load_script(struct linux_binprm *bprm)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
2010-08-18 02:52:56 +04:00
|
|
|
const char *i_arg, *i_name;
|
|
|
|
char *cp;
|
2005-04-17 02:20:36 +04:00
|
|
|
struct file *file;
|
|
|
|
int retval;
|
|
|
|
|
2012-12-18 04:03:20 +04:00
|
|
|
if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
|
2005-04-17 02:20:36 +04:00
|
|
|
return -ENOEXEC;
|
syscalls: implement execveat() system call
This patchset adds execveat(2) for x86, and is derived from Meredydd
Luff's patch from Sept 2012 (https://lkml.org/lkml/2012/9/11/528).
The primary aim of adding an execveat syscall is to allow an
implementation of fexecve(3) that does not rely on the /proc filesystem,
at least for executables (rather than scripts). The current glibc version
of fexecve(3) is implemented via /proc, which causes problems in sandboxed
or otherwise restricted environments.
Given the desire for a /proc-free fexecve() implementation, HPA suggested
(https://lkml.org/lkml/2006/7/11/556) that an execveat(2) syscall would be
an appropriate generalization.
Also, having a new syscall means that it can take a flags argument without
back-compatibility concerns. The current implementation just defines the
AT_EMPTY_PATH and AT_SYMLINK_NOFOLLOW flags, but other flags could be
added in future -- for example, flags for new namespaces (as suggested at
https://lkml.org/lkml/2006/7/11/474).
Related history:
- https://lkml.org/lkml/2006/12/27/123 is an example of someone
realizing that fexecve() is likely to fail in a chroot environment.
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514043 covered
documenting the /proc requirement of fexecve(3) in its manpage, to
"prevent other people from wasting their time".
- https://bugzilla.redhat.com/show_bug.cgi?id=241609 described a
problem where a process that did setuid() could not fexecve()
because it no longer had access to /proc/self/fd; this has since
been fixed.
This patch (of 4):
Add a new execveat(2) system call. execveat() is to execve() as openat()
is to open(): it takes a file descriptor that refers to a directory, and
resolves the filename relative to that.
In addition, if the filename is empty and AT_EMPTY_PATH is specified,
execveat() executes the file to which the file descriptor refers. This
replicates the functionality of fexecve(), which is a system call in other
UNIXen, but in Linux glibc it depends on opening "/proc/self/fd/<fd>" (and
so relies on /proc being mounted).
The filename fed to the executed program as argv[0] (or the name of the
script fed to a script interpreter) will be of the form "/dev/fd/<fd>"
(for an empty filename) or "/dev/fd/<fd>/<filename>", effectively
reflecting how the executable was found. This does however mean that
execution of a script in a /proc-less environment won't work; also, script
execution via an O_CLOEXEC file descriptor fails (as the file will not be
accessible after exec).
Based on patches by Meredydd Luff.
Signed-off-by: David Drysdale <drysdale@google.com>
Cc: Meredydd Luff <meredydd@senatehouse.org>
Cc: Shuah Khan <shuah.kh@samsung.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Rich Felker <dalias@aerifal.cx>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-12-13 03:57:29 +03:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the script filename will be inaccessible after exec, typically
|
|
|
|
* because it is a "/dev/fd/<fd>/.." path against an O_CLOEXEC fd, give
|
|
|
|
* up now (on the assumption that the interpreter will want to load
|
|
|
|
* this file).
|
|
|
|
*/
|
|
|
|
if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
|
|
|
|
return -ENOENT;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* This section does the #! interpretation.
|
|
|
|
* Sorta complicated, but hopefully it will work. -TYT
|
|
|
|
*/
|
|
|
|
|
|
|
|
allow_write_access(bprm->file);
|
|
|
|
fput(bprm->file);
|
|
|
|
bprm->file = NULL;
|
|
|
|
|
2019-01-04 02:28:07 +03:00
|
|
|
for (cp = bprm->buf+2;; cp++) {
|
|
|
|
if (cp >= bprm->buf + BINPRM_BUF_SIZE)
|
|
|
|
return -ENOEXEC;
|
|
|
|
if (!*cp || (*cp == '\n'))
|
|
|
|
break;
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
*cp = '\0';
|
2019-01-04 02:28:07 +03:00
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
while (cp > bprm->buf) {
|
|
|
|
cp--;
|
|
|
|
if ((*cp == ' ') || (*cp == '\t'))
|
|
|
|
*cp = '\0';
|
|
|
|
else
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
for (cp = bprm->buf+2; (*cp == ' ') || (*cp == '\t'); cp++);
|
2017-10-04 02:15:42 +03:00
|
|
|
if (*cp == '\0')
|
2005-04-17 02:20:36 +04:00
|
|
|
return -ENOEXEC; /* No interpreter name found */
|
|
|
|
i_name = cp;
|
|
|
|
i_arg = NULL;
|
|
|
|
for ( ; *cp && (*cp != ' ') && (*cp != '\t'); cp++)
|
|
|
|
/* nothing */ ;
|
|
|
|
while ((*cp == ' ') || (*cp == '\t'))
|
|
|
|
*cp++ = '\0';
|
|
|
|
if (*cp)
|
|
|
|
i_arg = cp;
|
|
|
|
/*
|
|
|
|
* OK, we've parsed out the interpreter name and
|
|
|
|
* (optional) argument.
|
|
|
|
* Splice in (1) the interpreter's name for argv[0]
|
|
|
|
* (2) (optional) argument to interpreter
|
|
|
|
* (3) filename of shell script (replace argv[0])
|
|
|
|
*
|
|
|
|
* This is done in reverse order, because of how the
|
|
|
|
* user environment and arguments are stored.
|
|
|
|
*/
|
2007-07-19 12:48:16 +04:00
|
|
|
retval = remove_arg_zero(bprm);
|
|
|
|
if (retval)
|
|
|
|
return retval;
|
2005-04-17 02:20:36 +04:00
|
|
|
retval = copy_strings_kernel(1, &bprm->interp, bprm);
|
2017-10-04 02:15:42 +03:00
|
|
|
if (retval < 0)
|
|
|
|
return retval;
|
2005-04-17 02:20:36 +04:00
|
|
|
bprm->argc++;
|
|
|
|
if (i_arg) {
|
|
|
|
retval = copy_strings_kernel(1, &i_arg, bprm);
|
2017-10-04 02:15:42 +03:00
|
|
|
if (retval < 0)
|
|
|
|
return retval;
|
2005-04-17 02:20:36 +04:00
|
|
|
bprm->argc++;
|
|
|
|
}
|
|
|
|
retval = copy_strings_kernel(1, &i_name, bprm);
|
2017-10-04 02:15:42 +03:00
|
|
|
if (retval)
|
|
|
|
return retval;
|
2005-04-17 02:20:36 +04:00
|
|
|
bprm->argc++;
|
2017-10-04 02:15:42 +03:00
|
|
|
retval = bprm_change_interp(i_name, bprm);
|
exec: do not leave bprm->interp on stack
If a series of scripts are executed, each triggering module loading via
unprintable bytes in the script header, kernel stack contents can leak
into the command line.
Normally execution of binfmt_script and binfmt_misc happens recursively.
However, when modules are enabled, and unprintable bytes exist in the
bprm->buf, execution will restart after attempting to load matching
binfmt modules. Unfortunately, the logic in binfmt_script and
binfmt_misc does not expect to get restarted. They leave bprm->interp
pointing to their local stack. This means on restart bprm->interp is
left pointing into unused stack memory which can then be copied into the
userspace argv areas.
After additional study, it seems that both recursion and restart remains
the desirable way to handle exec with scripts, misc, and modules. As
such, we need to protect the changes to interp.
This changes the logic to require allocation for any changes to the
bprm->interp. To avoid adding a new kmalloc to every exec, the default
value is left as-is. Only when passing through binfmt_script or
binfmt_misc does an allocation take place.
For a proof of concept, see DoTest.sh from:
http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: halfdog <me@halfdog.net>
Cc: P J P <ppandit@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-12-21 03:05:16 +04:00
|
|
|
if (retval < 0)
|
|
|
|
return retval;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* OK, now restart the process with the interpreter's dentry.
|
|
|
|
*/
|
2017-10-04 02:15:42 +03:00
|
|
|
file = open_exec(i_name);
|
2005-04-17 02:20:36 +04:00
|
|
|
if (IS_ERR(file))
|
|
|
|
return PTR_ERR(file);
|
|
|
|
|
|
|
|
bprm->file = file;
|
|
|
|
retval = prepare_binprm(bprm);
|
|
|
|
if (retval < 0)
|
|
|
|
return retval;
|
2012-10-21 05:53:31 +04:00
|
|
|
return search_binary_handler(bprm);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static struct linux_binfmt script_format = {
|
|
|
|
.module = THIS_MODULE,
|
|
|
|
.load_binary = load_script,
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __init init_script_binfmt(void)
|
|
|
|
{
|
2012-03-17 11:05:16 +04:00
|
|
|
register_binfmt(&script_format);
|
|
|
|
return 0;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit exit_script_binfmt(void)
|
|
|
|
{
|
|
|
|
unregister_binfmt(&script_format);
|
|
|
|
}
|
|
|
|
|
|
|
|
core_initcall(init_script_binfmt);
|
|
|
|
module_exit(exit_script_binfmt);
|
|
|
|
MODULE_LICENSE("GPL");
|