1 /* 2 * binfmt_misc.c 3 * 4 * Copyright (C) 1997 Richard G�nther 5 * 6 * binfmt_misc detects binaries via a magic or filename extension and invokes 7 * a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and 8 * binfmt_mz. 9 * 10 * 1997-04-25 first version 11 * [...] 12 * 1997-05-19 cleanup 13 * 1997-06-26 hpa: pass the real filename rather than argv[0] 14 * 1997-06-30 minor cleanup 15 * 1997-08-09 removed extension stripping, locking cleanup 16 * 2001-02-28 AV: rewritten into something that resembles C. Original didn't. 17 */ 18 19 #include <linux/module.h> 20 #include <linux/init.h> 21 22 #include <linux/binfmts.h> 23 #include <linux/slab.h> 24 #include <linux/ctype.h> 25 #include <linux/file.h> 26 #include <linux/pagemap.h> 27 #include <linux/namei.h> 28 #include <linux/mount.h> 29 #include <linux/syscalls.h> 30 31 #include <asm/uaccess.h> 32 33 enum { 34 VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */ 35 }; 36 37 static LIST_HEAD(entries); 38 static int enabled = 1; 39 40 enum {Enabled, Magic}; 41 #define MISC_FMT_PRESERVE_ARGV0 (1<<31) 42 #define MISC_FMT_OPEN_BINARY (1<<30) 43 #define MISC_FMT_CREDENTIALS (1<<29) 44 45 typedef struct { 46 struct list_head list; 47 unsigned long flags; /* type, status, etc. */ 48 int offset; /* offset of magic */ 49 int size; /* size of magic/mask */ 50 char *magic; /* magic or filename extension */ 51 char *mask; /* mask, NULL for exact match */ 52 char *interpreter; /* filename of interpreter */ 53 char *name; 54 struct dentry *dentry; 55 } Node; 56 57 static DEFINE_RWLOCK(entries_lock); 58 static struct file_system_type bm_fs_type; 59 static struct vfsmount *bm_mnt; 60 static int entry_count; 61 62 /* 63 * Check if we support the binfmt 64 * if we do, return the node, else NULL 65 * locking is done in load_misc_binary 66 */ 67 static Node *check_file(struct linux_binprm *bprm) 68 { 69 char *p = strrchr(bprm->interp, '.'); 70 struct list_head *l; 71 72 list_for_each(l, &entries) { 73 Node *e = list_entry(l, Node, list); 74 char *s; 75 int j; 76 77 if (!test_bit(Enabled, &e->flags)) 78 continue; 79 80 if (!test_bit(Magic, &e->flags)) { 81 if (p && !strcmp(e->magic, p + 1)) 82 return e; 83 continue; 84 } 85 86 s = bprm->buf + e->offset; 87 if (e->mask) { 88 for (j = 0; j < e->size; j++) 89 if ((*s++ ^ e->magic[j]) & e->mask[j]) 90 break; 91 } else { 92 for (j = 0; j < e->size; j++) 93 if ((*s++ ^ e->magic[j])) 94 break; 95 } 96 if (j == e->size) 97 return e; 98 } 99 return NULL; 100 } 101 102 /* 103 * the loader itself 104 */ 105 static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) 106 { 107 Node *fmt; 108 struct file * interp_file = NULL; 109 char iname[BINPRM_BUF_SIZE]; 110 char *iname_addr = iname; 111 int retval; 112 int fd_binary = -1; 113 struct files_struct *files = NULL; 114 115 retval = -ENOEXEC; 116 if (!enabled) 117 goto _ret; 118 119 /* to keep locking time low, we copy the interpreter string */ 120 read_lock(&entries_lock); 121 fmt = check_file(bprm); 122 if (fmt) 123 strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE); 124 read_unlock(&entries_lock); 125 if (!fmt) 126 goto _ret; 127 128 if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) { 129 remove_arg_zero(bprm); 130 } 131 132 if (fmt->flags & MISC_FMT_OPEN_BINARY) { 133 134 files = current->files; 135 retval = unshare_files(); 136 if (retval < 0) 137 goto _ret; 138 if (files == current->files) { 139 put_files_struct(files); 140 files = NULL; 141 } 142 /* if the binary should be opened on behalf of the 143 * interpreter than keep it open and assign descriptor 144 * to it */ 145 fd_binary = get_unused_fd(); 146 if (fd_binary < 0) { 147 retval = fd_binary; 148 goto _unshare; 149 } 150 fd_install(fd_binary, bprm->file); 151 152 /* if the binary is not readable than enforce mm->dumpable=0 153 regardless of the interpreter's permissions */ 154 if (file_permission(bprm->file, MAY_READ)) 155 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP; 156 157 allow_write_access(bprm->file); 158 bprm->file = NULL; 159 160 /* mark the bprm that fd should be passed to interp */ 161 bprm->interp_flags |= BINPRM_FLAGS_EXECFD; 162 bprm->interp_data = fd_binary; 163 164 } else { 165 allow_write_access(bprm->file); 166 fput(bprm->file); 167 bprm->file = NULL; 168 } 169 /* make argv[1] be the path to the binary */ 170 retval = copy_strings_kernel (1, &bprm->interp, bprm); 171 if (retval < 0) 172 goto _error; 173 bprm->argc++; 174 175 /* add the interp as argv[0] */ 176 retval = copy_strings_kernel (1, &iname_addr, bprm); 177 if (retval < 0) 178 goto _error; 179 bprm->argc ++; 180 181 bprm->interp = iname; /* for binfmt_script */ 182 183 interp_file = open_exec (iname); 184 retval = PTR_ERR (interp_file); 185 if (IS_ERR (interp_file)) 186 goto _error; 187 188 bprm->file = interp_file; 189 if (fmt->flags & MISC_FMT_CREDENTIALS) { 190 /* 191 * No need to call prepare_binprm(), it's already been 192 * done. bprm->buf is stale, update from interp_file. 193 */ 194 memset(bprm->buf, 0, BINPRM_BUF_SIZE); 195 retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE); 196 } else 197 retval = prepare_binprm (bprm); 198 199 if (retval < 0) 200 goto _error; 201 202 retval = search_binary_handler (bprm, regs); 203 if (retval < 0) 204 goto _error; 205 206 if (files) { 207 put_files_struct(files); 208 files = NULL; 209 } 210 _ret: 211 return retval; 212 _error: 213 if (fd_binary > 0) 214 sys_close(fd_binary); 215 bprm->interp_flags = 0; 216 bprm->interp_data = 0; 217 _unshare: 218 if (files) 219 reset_files_struct(current, files); 220 goto _ret; 221 } 222 223 /* Command parsers */ 224 225 /* 226 * parses and copies one argument enclosed in del from *sp to *dp, 227 * recognising the \x special. 228 * returns pointer to the copied argument or NULL in case of an 229 * error (and sets err) or null argument length. 230 */ 231 static char *scanarg(char *s, char del) 232 { 233 char c; 234 235 while ((c = *s++) != del) { 236 if (c == '\\' && *s == 'x') { 237 s++; 238 if (!isxdigit(*s++)) 239 return NULL; 240 if (!isxdigit(*s++)) 241 return NULL; 242 } 243 } 244 return s; 245 } 246 247 static int unquote(char *from) 248 { 249 char c = 0, *s = from, *p = from; 250 251 while ((c = *s++) != '\0') { 252 if (c == '\\' && *s == 'x') { 253 s++; 254 c = toupper(*s++); 255 *p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4; 256 c = toupper(*s++); 257 *p++ |= c - (isdigit(c) ? '0' : 'A' - 10); 258 continue; 259 } 260 *p++ = c; 261 } 262 return p - from; 263 } 264 265 static char * check_special_flags (char * sfs, Node * e) 266 { 267 char * p = sfs; 268 int cont = 1; 269 270 /* special flags */ 271 while (cont) { 272 switch (*p) { 273 case 'P': 274 p++; 275 e->flags |= MISC_FMT_PRESERVE_ARGV0; 276 break; 277 case 'O': 278 p++; 279 e->flags |= MISC_FMT_OPEN_BINARY; 280 break; 281 case 'C': 282 p++; 283 /* this flags also implies the 284 open-binary flag */ 285 e->flags |= (MISC_FMT_CREDENTIALS | 286 MISC_FMT_OPEN_BINARY); 287 break; 288 default: 289 cont = 0; 290 } 291 } 292 293 return p; 294 } 295 /* 296 * This registers a new binary format, it recognises the syntax 297 * ':name:type:offset:magic:mask:interpreter:flags' 298 * where the ':' is the IFS, that can be chosen with the first char 299 */ 300 static Node *create_entry(const char __user *buffer, size_t count) 301 { 302 Node *e; 303 int memsize, err; 304 char *buf, *p; 305 char del; 306 307 /* some sanity checks */ 308 err = -EINVAL; 309 if ((count < 11) || (count > 256)) 310 goto out; 311 312 err = -ENOMEM; 313 memsize = sizeof(Node) + count + 8; 314 e = kmalloc(memsize, GFP_USER); 315 if (!e) 316 goto out; 317 318 p = buf = (char *)e + sizeof(Node); 319 320 memset(e, 0, sizeof(Node)); 321 if (copy_from_user(buf, buffer, count)) 322 goto Efault; 323 324 del = *p++; /* delimeter */ 325 326 memset(buf+count, del, 8); 327 328 e->name = p; 329 p = strchr(p, del); 330 if (!p) 331 goto Einval; 332 *p++ = '\0'; 333 if (!e->name[0] || 334 !strcmp(e->name, ".") || 335 !strcmp(e->name, "..") || 336 strchr(e->name, '/')) 337 goto Einval; 338 switch (*p++) { 339 case 'E': e->flags = 1<<Enabled; break; 340 case 'M': e->flags = (1<<Enabled) | (1<<Magic); break; 341 default: goto Einval; 342 } 343 if (*p++ != del) 344 goto Einval; 345 if (test_bit(Magic, &e->flags)) { 346 char *s = strchr(p, del); 347 if (!s) 348 goto Einval; 349 *s++ = '\0'; 350 e->offset = simple_strtoul(p, &p, 10); 351 if (*p++) 352 goto Einval; 353 e->magic = p; 354 p = scanarg(p, del); 355 if (!p) 356 goto Einval; 357 p[-1] = '\0'; 358 if (!e->magic[0]) 359 goto Einval; 360 e->mask = p; 361 p = scanarg(p, del); 362 if (!p) 363 goto Einval; 364 p[-1] = '\0'; 365 if (!e->mask[0]) 366 e->mask = NULL; 367 e->size = unquote(e->magic); 368 if (e->mask && unquote(e->mask) != e->size) 369 goto Einval; 370 if (e->size + e->offset > BINPRM_BUF_SIZE) 371 goto Einval; 372 } else { 373 p = strchr(p, del); 374 if (!p) 375 goto Einval; 376 *p++ = '\0'; 377 e->magic = p; 378 p = strchr(p, del); 379 if (!p) 380 goto Einval; 381 *p++ = '\0'; 382 if (!e->magic[0] || strchr(e->magic, '/')) 383 goto Einval; 384 p = strchr(p, del); 385 if (!p) 386 goto Einval; 387 *p++ = '\0'; 388 } 389 e->interpreter = p; 390 p = strchr(p, del); 391 if (!p) 392 goto Einval; 393 *p++ = '\0'; 394 if (!e->interpreter[0]) 395 goto Einval; 396 397 398 p = check_special_flags (p, e); 399 400 if (*p == '\n') 401 p++; 402 if (p != buf + count) 403 goto Einval; 404 return e; 405 406 out: 407 return ERR_PTR(err); 408 409 Efault: 410 kfree(e); 411 return ERR_PTR(-EFAULT); 412 Einval: 413 kfree(e); 414 return ERR_PTR(-EINVAL); 415 } 416 417 /* 418 * Set status of entry/binfmt_misc: 419 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc 420 */ 421 static int parse_command(const char __user *buffer, size_t count) 422 { 423 char s[4]; 424 425 if (!count) 426 return 0; 427 if (count > 3) 428 return -EINVAL; 429 if (copy_from_user(s, buffer, count)) 430 return -EFAULT; 431 if (s[count-1] == '\n') 432 count--; 433 if (count == 1 && s[0] == '0') 434 return 1; 435 if (count == 1 && s[0] == '1') 436 return 2; 437 if (count == 2 && s[0] == '-' && s[1] == '1') 438 return 3; 439 return -EINVAL; 440 } 441 442 /* generic stuff */ 443 444 static void entry_status(Node *e, char *page) 445 { 446 char *dp; 447 char *status = "disabled"; 448 const char * flags = "flags: "; 449 450 if (test_bit(Enabled, &e->flags)) 451 status = "enabled"; 452 453 if (!VERBOSE_STATUS) { 454 sprintf(page, "%s\n", status); 455 return; 456 } 457 458 sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter); 459 dp = page + strlen(page); 460 461 /* print the special flags */ 462 sprintf (dp, "%s", flags); 463 dp += strlen (flags); 464 if (e->flags & MISC_FMT_PRESERVE_ARGV0) { 465 *dp ++ = 'P'; 466 } 467 if (e->flags & MISC_FMT_OPEN_BINARY) { 468 *dp ++ = 'O'; 469 } 470 if (e->flags & MISC_FMT_CREDENTIALS) { 471 *dp ++ = 'C'; 472 } 473 *dp ++ = '\n'; 474 475 476 if (!test_bit(Magic, &e->flags)) { 477 sprintf(dp, "extension .%s\n", e->magic); 478 } else { 479 int i; 480 481 sprintf(dp, "offset %i\nmagic ", e->offset); 482 dp = page + strlen(page); 483 for (i = 0; i < e->size; i++) { 484 sprintf(dp, "%02x", 0xff & (int) (e->magic[i])); 485 dp += 2; 486 } 487 if (e->mask) { 488 sprintf(dp, "\nmask "); 489 dp += 6; 490 for (i = 0; i < e->size; i++) { 491 sprintf(dp, "%02x", 0xff & (int) (e->mask[i])); 492 dp += 2; 493 } 494 } 495 *dp++ = '\n'; 496 *dp = '\0'; 497 } 498 } 499 500 static struct inode *bm_get_inode(struct super_block *sb, int mode) 501 { 502 struct inode * inode = new_inode(sb); 503 504 if (inode) { 505 inode->i_mode = mode; 506 inode->i_uid = 0; 507 inode->i_gid = 0; 508 inode->i_blocks = 0; 509 inode->i_atime = inode->i_mtime = inode->i_ctime = 510 current_fs_time(inode->i_sb); 511 } 512 return inode; 513 } 514 515 static void bm_clear_inode(struct inode *inode) 516 { 517 kfree(inode->i_private); 518 } 519 520 static void kill_node(Node *e) 521 { 522 struct dentry *dentry; 523 524 write_lock(&entries_lock); 525 dentry = e->dentry; 526 if (dentry) { 527 list_del_init(&e->list); 528 e->dentry = NULL; 529 } 530 write_unlock(&entries_lock); 531 532 if (dentry) { 533 dentry->d_inode->i_nlink--; 534 d_drop(dentry); 535 dput(dentry); 536 simple_release_fs(&bm_mnt, &entry_count); 537 } 538 } 539 540 /* /<entry> */ 541 542 static ssize_t 543 bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos) 544 { 545 Node *e = file->f_path.dentry->d_inode->i_private; 546 loff_t pos = *ppos; 547 ssize_t res; 548 char *page; 549 int len; 550 551 if (!(page = (char*) __get_free_page(GFP_KERNEL))) 552 return -ENOMEM; 553 554 entry_status(e, page); 555 len = strlen(page); 556 557 res = -EINVAL; 558 if (pos < 0) 559 goto out; 560 res = 0; 561 if (pos >= len) 562 goto out; 563 if (len < pos + nbytes) 564 nbytes = len - pos; 565 res = -EFAULT; 566 if (copy_to_user(buf, page + pos, nbytes)) 567 goto out; 568 *ppos = pos + nbytes; 569 res = nbytes; 570 out: 571 free_page((unsigned long) page); 572 return res; 573 } 574 575 static ssize_t bm_entry_write(struct file *file, const char __user *buffer, 576 size_t count, loff_t *ppos) 577 { 578 struct dentry *root; 579 Node *e = file->f_path.dentry->d_inode->i_private; 580 int res = parse_command(buffer, count); 581 582 switch (res) { 583 case 1: clear_bit(Enabled, &e->flags); 584 break; 585 case 2: set_bit(Enabled, &e->flags); 586 break; 587 case 3: root = dget(file->f_path.mnt->mnt_sb->s_root); 588 mutex_lock(&root->d_inode->i_mutex); 589 590 kill_node(e); 591 592 mutex_unlock(&root->d_inode->i_mutex); 593 dput(root); 594 break; 595 default: return res; 596 } 597 return count; 598 } 599 600 static const struct file_operations bm_entry_operations = { 601 .read = bm_entry_read, 602 .write = bm_entry_write, 603 }; 604 605 /* /register */ 606 607 static ssize_t bm_register_write(struct file *file, const char __user *buffer, 608 size_t count, loff_t *ppos) 609 { 610 Node *e; 611 struct inode *inode; 612 struct dentry *root, *dentry; 613 struct super_block *sb = file->f_path.mnt->mnt_sb; 614 int err = 0; 615 616 e = create_entry(buffer, count); 617 618 if (IS_ERR(e)) 619 return PTR_ERR(e); 620 621 root = dget(sb->s_root); 622 mutex_lock(&root->d_inode->i_mutex); 623 dentry = lookup_one_len(e->name, root, strlen(e->name)); 624 err = PTR_ERR(dentry); 625 if (IS_ERR(dentry)) 626 goto out; 627 628 err = -EEXIST; 629 if (dentry->d_inode) 630 goto out2; 631 632 inode = bm_get_inode(sb, S_IFREG | 0644); 633 634 err = -ENOMEM; 635 if (!inode) 636 goto out2; 637 638 err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count); 639 if (err) { 640 iput(inode); 641 inode = NULL; 642 goto out2; 643 } 644 645 e->dentry = dget(dentry); 646 inode->i_private = e; 647 inode->i_fop = &bm_entry_operations; 648 649 d_instantiate(dentry, inode); 650 write_lock(&entries_lock); 651 list_add(&e->list, &entries); 652 write_unlock(&entries_lock); 653 654 err = 0; 655 out2: 656 dput(dentry); 657 out: 658 mutex_unlock(&root->d_inode->i_mutex); 659 dput(root); 660 661 if (err) { 662 kfree(e); 663 return -EINVAL; 664 } 665 return count; 666 } 667 668 static const struct file_operations bm_register_operations = { 669 .write = bm_register_write, 670 }; 671 672 /* /status */ 673 674 static ssize_t 675 bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) 676 { 677 char *s = enabled ? "enabled" : "disabled"; 678 679 return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s)); 680 } 681 682 static ssize_t bm_status_write(struct file * file, const char __user * buffer, 683 size_t count, loff_t *ppos) 684 { 685 int res = parse_command(buffer, count); 686 struct dentry *root; 687 688 switch (res) { 689 case 1: enabled = 0; break; 690 case 2: enabled = 1; break; 691 case 3: root = dget(file->f_path.mnt->mnt_sb->s_root); 692 mutex_lock(&root->d_inode->i_mutex); 693 694 while (!list_empty(&entries)) 695 kill_node(list_entry(entries.next, Node, list)); 696 697 mutex_unlock(&root->d_inode->i_mutex); 698 dput(root); 699 default: return res; 700 } 701 return count; 702 } 703 704 static const struct file_operations bm_status_operations = { 705 .read = bm_status_read, 706 .write = bm_status_write, 707 }; 708 709 /* Superblock handling */ 710 711 static const struct super_operations s_ops = { 712 .statfs = simple_statfs, 713 .clear_inode = bm_clear_inode, 714 }; 715 716 static int bm_fill_super(struct super_block * sb, void * data, int silent) 717 { 718 static struct tree_descr bm_files[] = { 719 [2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO}, 720 [3] = {"register", &bm_register_operations, S_IWUSR}, 721 /* last one */ {""} 722 }; 723 int err = simple_fill_super(sb, 0x42494e4d, bm_files); 724 if (!err) 725 sb->s_op = &s_ops; 726 return err; 727 } 728 729 static int bm_get_sb(struct file_system_type *fs_type, 730 int flags, const char *dev_name, void *data, struct vfsmount *mnt) 731 { 732 return get_sb_single(fs_type, flags, data, bm_fill_super, mnt); 733 } 734 735 static struct linux_binfmt misc_format = { 736 .module = THIS_MODULE, 737 .load_binary = load_misc_binary, 738 }; 739 740 static struct file_system_type bm_fs_type = { 741 .owner = THIS_MODULE, 742 .name = "binfmt_misc", 743 .get_sb = bm_get_sb, 744 .kill_sb = kill_litter_super, 745 }; 746 747 static int __init init_misc_binfmt(void) 748 { 749 int err = register_filesystem(&bm_fs_type); 750 if (!err) { 751 err = register_binfmt(&misc_format); 752 if (err) 753 unregister_filesystem(&bm_fs_type); 754 } 755 return err; 756 } 757 758 static void __exit exit_misc_binfmt(void) 759 { 760 unregister_binfmt(&misc_format); 761 unregister_filesystem(&bm_fs_type); 762 } 763 764 core_initcall(init_misc_binfmt); 765 module_exit(exit_misc_binfmt); 766 MODULE_LICENSE("GPL"); 767