1 /* 2 * binfmt_misc.c 3 * 4 * Copyright (C) 1997 Richard Günther 5 * 6 * binfmt_misc detects binaries via a magic or filename extension and invokes 7 * a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and 8 * binfmt_mz. 9 * 10 * 1997-04-25 first version 11 * [...] 12 * 1997-05-19 cleanup 13 * 1997-06-26 hpa: pass the real filename rather than argv[0] 14 * 1997-06-30 minor cleanup 15 * 1997-08-09 removed extension stripping, locking cleanup 16 * 2001-02-28 AV: rewritten into something that resembles C. Original didn't. 17 */ 18 19 #include <linux/module.h> 20 #include <linux/init.h> 21 #include <linux/sched.h> 22 #include <linux/binfmts.h> 23 #include <linux/slab.h> 24 #include <linux/ctype.h> 25 #include <linux/file.h> 26 #include <linux/pagemap.h> 27 #include <linux/namei.h> 28 #include <linux/mount.h> 29 #include <linux/syscalls.h> 30 #include <linux/fs.h> 31 32 #include <asm/uaccess.h> 33 34 enum { 35 VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */ 36 }; 37 38 static LIST_HEAD(entries); 39 static int enabled = 1; 40 41 enum {Enabled, Magic}; 42 #define MISC_FMT_PRESERVE_ARGV0 (1<<31) 43 #define MISC_FMT_OPEN_BINARY (1<<30) 44 #define MISC_FMT_CREDENTIALS (1<<29) 45 46 typedef struct { 47 struct list_head list; 48 unsigned long flags; /* type, status, etc. */ 49 int offset; /* offset of magic */ 50 int size; /* size of magic/mask */ 51 char *magic; /* magic or filename extension */ 52 char *mask; /* mask, NULL for exact match */ 53 char *interpreter; /* filename of interpreter */ 54 char *name; 55 struct dentry *dentry; 56 } Node; 57 58 static DEFINE_RWLOCK(entries_lock); 59 static struct file_system_type bm_fs_type; 60 static struct vfsmount *bm_mnt; 61 static int entry_count; 62 63 /* 64 * Check if we support the binfmt 65 * if we do, return the node, else NULL 66 * locking is done in load_misc_binary 67 */ 68 static Node *check_file(struct linux_binprm *bprm) 69 { 70 char *p = strrchr(bprm->interp, '.'); 71 struct list_head *l; 72 73 list_for_each(l, &entries) { 74 Node *e = list_entry(l, Node, list); 75 char *s; 76 int j; 77 78 if (!test_bit(Enabled, &e->flags)) 79 continue; 80 81 if (!test_bit(Magic, &e->flags)) { 82 if (p && !strcmp(e->magic, p + 1)) 83 return e; 84 continue; 85 } 86 87 s = bprm->buf + e->offset; 88 if (e->mask) { 89 for (j = 0; j < e->size; j++) 90 if ((*s++ ^ e->magic[j]) & e->mask[j]) 91 break; 92 } else { 93 for (j = 0; j < e->size; j++) 94 if ((*s++ ^ e->magic[j])) 95 break; 96 } 97 if (j == e->size) 98 return e; 99 } 100 return NULL; 101 } 102 103 /* 104 * the loader itself 105 */ 106 static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) 107 { 108 Node *fmt; 109 struct file * interp_file = NULL; 110 char iname[BINPRM_BUF_SIZE]; 111 char *iname_addr = iname; 112 int retval; 113 int fd_binary = -1; 114 115 retval = -ENOEXEC; 116 if (!enabled) 117 goto _ret; 118 119 retval = -ENOEXEC; 120 if (bprm->recursion_depth > BINPRM_MAX_RECURSION) 121 goto _ret; 122 123 /* to keep locking time low, we copy the interpreter string */ 124 read_lock(&entries_lock); 125 fmt = check_file(bprm); 126 if (fmt) 127 strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE); 128 read_unlock(&entries_lock); 129 if (!fmt) 130 goto _ret; 131 132 if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) { 133 retval = remove_arg_zero(bprm); 134 if (retval) 135 goto _ret; 136 } 137 138 if (fmt->flags & MISC_FMT_OPEN_BINARY) { 139 140 /* if the binary should be opened on behalf of the 141 * interpreter than keep it open and assign descriptor 142 * to it */ 143 fd_binary = get_unused_fd(); 144 if (fd_binary < 0) { 145 retval = fd_binary; 146 goto _ret; 147 } 148 fd_install(fd_binary, bprm->file); 149 150 /* if the binary is not readable than enforce mm->dumpable=0 151 regardless of the interpreter's permissions */ 152 if (file_permission(bprm->file, MAY_READ)) 153 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP; 154 155 allow_write_access(bprm->file); 156 bprm->file = NULL; 157 158 /* mark the bprm that fd should be passed to interp */ 159 bprm->interp_flags |= BINPRM_FLAGS_EXECFD; 160 bprm->interp_data = fd_binary; 161 162 } else { 163 allow_write_access(bprm->file); 164 fput(bprm->file); 165 bprm->file = NULL; 166 } 167 /* make argv[1] be the path to the binary */ 168 retval = copy_strings_kernel (1, &bprm->interp, bprm); 169 if (retval < 0) 170 goto _error; 171 bprm->argc++; 172 173 /* add the interp as argv[0] */ 174 retval = copy_strings_kernel (1, &iname_addr, bprm); 175 if (retval < 0) 176 goto _error; 177 bprm->argc ++; 178 179 bprm->interp = iname; /* for binfmt_script */ 180 181 interp_file = open_exec (iname); 182 retval = PTR_ERR (interp_file); 183 if (IS_ERR (interp_file)) 184 goto _error; 185 186 bprm->file = interp_file; 187 if (fmt->flags & MISC_FMT_CREDENTIALS) { 188 /* 189 * No need to call prepare_binprm(), it's already been 190 * done. bprm->buf is stale, update from interp_file. 191 */ 192 memset(bprm->buf, 0, BINPRM_BUF_SIZE); 193 retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE); 194 } else 195 retval = prepare_binprm (bprm); 196 197 if (retval < 0) 198 goto _error; 199 200 bprm->recursion_depth++; 201 202 retval = search_binary_handler (bprm, regs); 203 if (retval < 0) 204 goto _error; 205 206 _ret: 207 return retval; 208 _error: 209 if (fd_binary > 0) 210 sys_close(fd_binary); 211 bprm->interp_flags = 0; 212 bprm->interp_data = 0; 213 goto _ret; 214 } 215 216 /* Command parsers */ 217 218 /* 219 * parses and copies one argument enclosed in del from *sp to *dp, 220 * recognising the \x special. 221 * returns pointer to the copied argument or NULL in case of an 222 * error (and sets err) or null argument length. 223 */ 224 static char *scanarg(char *s, char del) 225 { 226 char c; 227 228 while ((c = *s++) != del) { 229 if (c == '\\' && *s == 'x') { 230 s++; 231 if (!isxdigit(*s++)) 232 return NULL; 233 if (!isxdigit(*s++)) 234 return NULL; 235 } 236 } 237 return s; 238 } 239 240 static int unquote(char *from) 241 { 242 char c = 0, *s = from, *p = from; 243 244 while ((c = *s++) != '\0') { 245 if (c == '\\' && *s == 'x') { 246 s++; 247 c = toupper(*s++); 248 *p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4; 249 c = toupper(*s++); 250 *p++ |= c - (isdigit(c) ? '0' : 'A' - 10); 251 continue; 252 } 253 *p++ = c; 254 } 255 return p - from; 256 } 257 258 static char * check_special_flags (char * sfs, Node * e) 259 { 260 char * p = sfs; 261 int cont = 1; 262 263 /* special flags */ 264 while (cont) { 265 switch (*p) { 266 case 'P': 267 p++; 268 e->flags |= MISC_FMT_PRESERVE_ARGV0; 269 break; 270 case 'O': 271 p++; 272 e->flags |= MISC_FMT_OPEN_BINARY; 273 break; 274 case 'C': 275 p++; 276 /* this flags also implies the 277 open-binary flag */ 278 e->flags |= (MISC_FMT_CREDENTIALS | 279 MISC_FMT_OPEN_BINARY); 280 break; 281 default: 282 cont = 0; 283 } 284 } 285 286 return p; 287 } 288 /* 289 * This registers a new binary format, it recognises the syntax 290 * ':name:type:offset:magic:mask:interpreter:flags' 291 * where the ':' is the IFS, that can be chosen with the first char 292 */ 293 static Node *create_entry(const char __user *buffer, size_t count) 294 { 295 Node *e; 296 int memsize, err; 297 char *buf, *p; 298 char del; 299 300 /* some sanity checks */ 301 err = -EINVAL; 302 if ((count < 11) || (count > 256)) 303 goto out; 304 305 err = -ENOMEM; 306 memsize = sizeof(Node) + count + 8; 307 e = kmalloc(memsize, GFP_USER); 308 if (!e) 309 goto out; 310 311 p = buf = (char *)e + sizeof(Node); 312 313 memset(e, 0, sizeof(Node)); 314 if (copy_from_user(buf, buffer, count)) 315 goto Efault; 316 317 del = *p++; /* delimeter */ 318 319 memset(buf+count, del, 8); 320 321 e->name = p; 322 p = strchr(p, del); 323 if (!p) 324 goto Einval; 325 *p++ = '\0'; 326 if (!e->name[0] || 327 !strcmp(e->name, ".") || 328 !strcmp(e->name, "..") || 329 strchr(e->name, '/')) 330 goto Einval; 331 switch (*p++) { 332 case 'E': e->flags = 1<<Enabled; break; 333 case 'M': e->flags = (1<<Enabled) | (1<<Magic); break; 334 default: goto Einval; 335 } 336 if (*p++ != del) 337 goto Einval; 338 if (test_bit(Magic, &e->flags)) { 339 char *s = strchr(p, del); 340 if (!s) 341 goto Einval; 342 *s++ = '\0'; 343 e->offset = simple_strtoul(p, &p, 10); 344 if (*p++) 345 goto Einval; 346 e->magic = p; 347 p = scanarg(p, del); 348 if (!p) 349 goto Einval; 350 p[-1] = '\0'; 351 if (!e->magic[0]) 352 goto Einval; 353 e->mask = p; 354 p = scanarg(p, del); 355 if (!p) 356 goto Einval; 357 p[-1] = '\0'; 358 if (!e->mask[0]) 359 e->mask = NULL; 360 e->size = unquote(e->magic); 361 if (e->mask && unquote(e->mask) != e->size) 362 goto Einval; 363 if (e->size + e->offset > BINPRM_BUF_SIZE) 364 goto Einval; 365 } else { 366 p = strchr(p, del); 367 if (!p) 368 goto Einval; 369 *p++ = '\0'; 370 e->magic = p; 371 p = strchr(p, del); 372 if (!p) 373 goto Einval; 374 *p++ = '\0'; 375 if (!e->magic[0] || strchr(e->magic, '/')) 376 goto Einval; 377 p = strchr(p, del); 378 if (!p) 379 goto Einval; 380 *p++ = '\0'; 381 } 382 e->interpreter = p; 383 p = strchr(p, del); 384 if (!p) 385 goto Einval; 386 *p++ = '\0'; 387 if (!e->interpreter[0]) 388 goto Einval; 389 390 391 p = check_special_flags (p, e); 392 393 if (*p == '\n') 394 p++; 395 if (p != buf + count) 396 goto Einval; 397 return e; 398 399 out: 400 return ERR_PTR(err); 401 402 Efault: 403 kfree(e); 404 return ERR_PTR(-EFAULT); 405 Einval: 406 kfree(e); 407 return ERR_PTR(-EINVAL); 408 } 409 410 /* 411 * Set status of entry/binfmt_misc: 412 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc 413 */ 414 static int parse_command(const char __user *buffer, size_t count) 415 { 416 char s[4]; 417 418 if (!count) 419 return 0; 420 if (count > 3) 421 return -EINVAL; 422 if (copy_from_user(s, buffer, count)) 423 return -EFAULT; 424 if (s[count-1] == '\n') 425 count--; 426 if (count == 1 && s[0] == '0') 427 return 1; 428 if (count == 1 && s[0] == '1') 429 return 2; 430 if (count == 2 && s[0] == '-' && s[1] == '1') 431 return 3; 432 return -EINVAL; 433 } 434 435 /* generic stuff */ 436 437 static void entry_status(Node *e, char *page) 438 { 439 char *dp; 440 char *status = "disabled"; 441 const char * flags = "flags: "; 442 443 if (test_bit(Enabled, &e->flags)) 444 status = "enabled"; 445 446 if (!VERBOSE_STATUS) { 447 sprintf(page, "%s\n", status); 448 return; 449 } 450 451 sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter); 452 dp = page + strlen(page); 453 454 /* print the special flags */ 455 sprintf (dp, "%s", flags); 456 dp += strlen (flags); 457 if (e->flags & MISC_FMT_PRESERVE_ARGV0) { 458 *dp ++ = 'P'; 459 } 460 if (e->flags & MISC_FMT_OPEN_BINARY) { 461 *dp ++ = 'O'; 462 } 463 if (e->flags & MISC_FMT_CREDENTIALS) { 464 *dp ++ = 'C'; 465 } 466 *dp ++ = '\n'; 467 468 469 if (!test_bit(Magic, &e->flags)) { 470 sprintf(dp, "extension .%s\n", e->magic); 471 } else { 472 int i; 473 474 sprintf(dp, "offset %i\nmagic ", e->offset); 475 dp = page + strlen(page); 476 for (i = 0; i < e->size; i++) { 477 sprintf(dp, "%02x", 0xff & (int) (e->magic[i])); 478 dp += 2; 479 } 480 if (e->mask) { 481 sprintf(dp, "\nmask "); 482 dp += 6; 483 for (i = 0; i < e->size; i++) { 484 sprintf(dp, "%02x", 0xff & (int) (e->mask[i])); 485 dp += 2; 486 } 487 } 488 *dp++ = '\n'; 489 *dp = '\0'; 490 } 491 } 492 493 static struct inode *bm_get_inode(struct super_block *sb, int mode) 494 { 495 struct inode * inode = new_inode(sb); 496 497 if (inode) { 498 inode->i_mode = mode; 499 inode->i_uid = 0; 500 inode->i_gid = 0; 501 inode->i_blocks = 0; 502 inode->i_atime = inode->i_mtime = inode->i_ctime = 503 current_fs_time(inode->i_sb); 504 } 505 return inode; 506 } 507 508 static void bm_clear_inode(struct inode *inode) 509 { 510 kfree(inode->i_private); 511 } 512 513 static void kill_node(Node *e) 514 { 515 struct dentry *dentry; 516 517 write_lock(&entries_lock); 518 dentry = e->dentry; 519 if (dentry) { 520 list_del_init(&e->list); 521 e->dentry = NULL; 522 } 523 write_unlock(&entries_lock); 524 525 if (dentry) { 526 dentry->d_inode->i_nlink--; 527 d_drop(dentry); 528 dput(dentry); 529 simple_release_fs(&bm_mnt, &entry_count); 530 } 531 } 532 533 /* /<entry> */ 534 535 static ssize_t 536 bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos) 537 { 538 Node *e = file->f_path.dentry->d_inode->i_private; 539 ssize_t res; 540 char *page; 541 542 if (!(page = (char*) __get_free_page(GFP_KERNEL))) 543 return -ENOMEM; 544 545 entry_status(e, page); 546 547 res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page)); 548 549 free_page((unsigned long) page); 550 return res; 551 } 552 553 static ssize_t bm_entry_write(struct file *file, const char __user *buffer, 554 size_t count, loff_t *ppos) 555 { 556 struct dentry *root; 557 Node *e = file->f_path.dentry->d_inode->i_private; 558 int res = parse_command(buffer, count); 559 560 switch (res) { 561 case 1: clear_bit(Enabled, &e->flags); 562 break; 563 case 2: set_bit(Enabled, &e->flags); 564 break; 565 case 3: root = dget(file->f_path.mnt->mnt_sb->s_root); 566 mutex_lock(&root->d_inode->i_mutex); 567 568 kill_node(e); 569 570 mutex_unlock(&root->d_inode->i_mutex); 571 dput(root); 572 break; 573 default: return res; 574 } 575 return count; 576 } 577 578 static const struct file_operations bm_entry_operations = { 579 .read = bm_entry_read, 580 .write = bm_entry_write, 581 }; 582 583 /* /register */ 584 585 static ssize_t bm_register_write(struct file *file, const char __user *buffer, 586 size_t count, loff_t *ppos) 587 { 588 Node *e; 589 struct inode *inode; 590 struct dentry *root, *dentry; 591 struct super_block *sb = file->f_path.mnt->mnt_sb; 592 int err = 0; 593 594 e = create_entry(buffer, count); 595 596 if (IS_ERR(e)) 597 return PTR_ERR(e); 598 599 root = dget(sb->s_root); 600 mutex_lock(&root->d_inode->i_mutex); 601 dentry = lookup_one_len(e->name, root, strlen(e->name)); 602 err = PTR_ERR(dentry); 603 if (IS_ERR(dentry)) 604 goto out; 605 606 err = -EEXIST; 607 if (dentry->d_inode) 608 goto out2; 609 610 inode = bm_get_inode(sb, S_IFREG | 0644); 611 612 err = -ENOMEM; 613 if (!inode) 614 goto out2; 615 616 err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count); 617 if (err) { 618 iput(inode); 619 inode = NULL; 620 goto out2; 621 } 622 623 e->dentry = dget(dentry); 624 inode->i_private = e; 625 inode->i_fop = &bm_entry_operations; 626 627 d_instantiate(dentry, inode); 628 write_lock(&entries_lock); 629 list_add(&e->list, &entries); 630 write_unlock(&entries_lock); 631 632 err = 0; 633 out2: 634 dput(dentry); 635 out: 636 mutex_unlock(&root->d_inode->i_mutex); 637 dput(root); 638 639 if (err) { 640 kfree(e); 641 return -EINVAL; 642 } 643 return count; 644 } 645 646 static const struct file_operations bm_register_operations = { 647 .write = bm_register_write, 648 }; 649 650 /* /status */ 651 652 static ssize_t 653 bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) 654 { 655 char *s = enabled ? "enabled" : "disabled"; 656 657 return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s)); 658 } 659 660 static ssize_t bm_status_write(struct file * file, const char __user * buffer, 661 size_t count, loff_t *ppos) 662 { 663 int res = parse_command(buffer, count); 664 struct dentry *root; 665 666 switch (res) { 667 case 1: enabled = 0; break; 668 case 2: enabled = 1; break; 669 case 3: root = dget(file->f_path.mnt->mnt_sb->s_root); 670 mutex_lock(&root->d_inode->i_mutex); 671 672 while (!list_empty(&entries)) 673 kill_node(list_entry(entries.next, Node, list)); 674 675 mutex_unlock(&root->d_inode->i_mutex); 676 dput(root); 677 default: return res; 678 } 679 return count; 680 } 681 682 static const struct file_operations bm_status_operations = { 683 .read = bm_status_read, 684 .write = bm_status_write, 685 }; 686 687 /* Superblock handling */ 688 689 static const struct super_operations s_ops = { 690 .statfs = simple_statfs, 691 .clear_inode = bm_clear_inode, 692 }; 693 694 static int bm_fill_super(struct super_block * sb, void * data, int silent) 695 { 696 static struct tree_descr bm_files[] = { 697 [2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO}, 698 [3] = {"register", &bm_register_operations, S_IWUSR}, 699 /* last one */ {""} 700 }; 701 int err = simple_fill_super(sb, 0x42494e4d, bm_files); 702 if (!err) 703 sb->s_op = &s_ops; 704 return err; 705 } 706 707 static int bm_get_sb(struct file_system_type *fs_type, 708 int flags, const char *dev_name, void *data, struct vfsmount *mnt) 709 { 710 return get_sb_single(fs_type, flags, data, bm_fill_super, mnt); 711 } 712 713 static struct linux_binfmt misc_format = { 714 .module = THIS_MODULE, 715 .load_binary = load_misc_binary, 716 }; 717 718 static struct file_system_type bm_fs_type = { 719 .owner = THIS_MODULE, 720 .name = "binfmt_misc", 721 .get_sb = bm_get_sb, 722 .kill_sb = kill_litter_super, 723 }; 724 725 static int __init init_misc_binfmt(void) 726 { 727 int err = register_filesystem(&bm_fs_type); 728 if (!err) { 729 err = register_binfmt(&misc_format); 730 if (err) 731 unregister_filesystem(&bm_fs_type); 732 } 733 return err; 734 } 735 736 static void __exit exit_misc_binfmt(void) 737 { 738 unregister_binfmt(&misc_format); 739 unregister_filesystem(&bm_fs_type); 740 } 741 742 core_initcall(init_misc_binfmt); 743 module_exit(exit_misc_binfmt); 744 MODULE_LICENSE("GPL"); 745