1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/fs/exec.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8 /*
9 * #!-checking implemented by tytso.
10 */
11 /*
12 * Demand-loading implemented 01.12.91 - no need to read anything but
13 * the header into memory. The inode of the executable is put into
14 * "current->executable", and page faults do the actual loading. Clean.
15 *
16 * Once more I can proudly say that linux stood up to being changed: it
17 * was less than 2 hours work to get demand-loading completely implemented.
18 *
19 * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,
20 * current->executable is only used by the procfs. This allows a dispatch
21 * table to check for several different types of binary formats. We keep
22 * trying until we recognize the file or we run out of supported binary
23 * formats.
24 */
25
26 #include <linux/kernel_read_file.h>
27 #include <linux/slab.h>
28 #include <linux/file.h>
29 #include <linux/fdtable.h>
30 #include <linux/mm.h>
31 #include <linux/stat.h>
32 #include <linux/fcntl.h>
33 #include <linux/swap.h>
34 #include <linux/string.h>
35 #include <linux/init.h>
36 #include <linux/sched/mm.h>
37 #include <linux/sched/coredump.h>
38 #include <linux/sched/signal.h>
39 #include <linux/sched/numa_balancing.h>
40 #include <linux/sched/task.h>
41 #include <linux/pagemap.h>
42 #include <linux/perf_event.h>
43 #include <linux/highmem.h>
44 #include <linux/spinlock.h>
45 #include <linux/key.h>
46 #include <linux/personality.h>
47 #include <linux/binfmts.h>
48 #include <linux/utsname.h>
49 #include <linux/pid_namespace.h>
50 #include <linux/module.h>
51 #include <linux/namei.h>
52 #include <linux/mount.h>
53 #include <linux/security.h>
54 #include <linux/syscalls.h>
55 #include <linux/tsacct_kern.h>
56 #include <linux/cn_proc.h>
57 #include <linux/audit.h>
58 #include <linux/kmod.h>
59 #include <linux/fsnotify.h>
60 #include <linux/fs_struct.h>
61 #include <linux/oom.h>
62 #include <linux/compat.h>
63 #include <linux/vmalloc.h>
64 #include <linux/io_uring.h>
65 #include <linux/syscall_user_dispatch.h>
66 #include <linux/coredump.h>
67 #include <linux/time_namespace.h>
68 #include <linux/user_events.h>
69 #include <linux/rseq.h>
70 #include <linux/ksm.h>
71
72 #include <linux/uaccess.h>
73 #include <asm/mmu_context.h>
74 #include <asm/tlb.h>
75
76 #include <trace/events/task.h>
77 #include "internal.h"
78
79 #include <trace/events/sched.h>
80
81 static int bprm_creds_from_file(struct linux_binprm *bprm);
82
83 int suid_dumpable = 0;
84
85 static LIST_HEAD(formats);
86 static DEFINE_RWLOCK(binfmt_lock);
87
88 void __register_binfmt(struct linux_binfmt * fmt, int insert)
89 {
90 write_lock(&binfmt_lock);
91 insert ? list_add(&fmt->lh, &formats) :
92 list_add_tail(&fmt->lh, &formats);
93 write_unlock(&binfmt_lock);
94 }
95
96 EXPORT_SYMBOL(__register_binfmt);
97
98 void unregister_binfmt(struct linux_binfmt * fmt)
99 {
100 write_lock(&binfmt_lock);
101 list_del(&fmt->lh);
102 write_unlock(&binfmt_lock);
103 }
104
105 EXPORT_SYMBOL(unregister_binfmt);
106
107 static inline void put_binfmt(struct linux_binfmt * fmt)
108 {
109 module_put(fmt->module);
110 }
111
112 bool path_noexec(const struct path *path)
113 {
114 return (path->mnt->mnt_flags & MNT_NOEXEC) ||
115 (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
116 }
117
118 #ifdef CONFIG_USELIB
119 /*
120 * Note that a shared library must be both readable and executable due to
121 * security reasons.
122 *
123 * Also note that we take the address to load from the file itself.
124 */
125 SYSCALL_DEFINE1(uselib, const char __user *, library)
126 {
127 struct linux_binfmt *fmt;
128 struct file *file;
129 struct filename *tmp = getname(library);
130 int error = PTR_ERR(tmp);
131 static const struct open_flags uselib_flags = {
132 .open_flag = O_LARGEFILE | O_RDONLY,
133 .acc_mode = MAY_READ | MAY_EXEC,
134 .intent = LOOKUP_OPEN,
135 .lookup_flags = LOOKUP_FOLLOW,
136 };
137
138 if (IS_ERR(tmp))
139 goto out;
140
141 file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);
142 putname(tmp);
143 error = PTR_ERR(file);
144 if (IS_ERR(file))
145 goto out;
146
147 /*
148 * Check do_open_execat() for an explanation.
149 */
150 error = -EACCES;
151 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
152 path_noexec(&file->f_path))
153 goto exit;
154
155 error = -ENOEXEC;
156
157 read_lock(&binfmt_lock);
158 list_for_each_entry(fmt, &formats, lh) {
159 if (!fmt->load_shlib)
160 continue;
161 if (!try_module_get(fmt->module))
162 continue;
163 read_unlock(&binfmt_lock);
164 error = fmt->load_shlib(file);
165 read_lock(&binfmt_lock);
166 put_binfmt(fmt);
167 if (error != -ENOEXEC)
168 break;
169 }
170 read_unlock(&binfmt_lock);
171 exit:
172 fput(file);
173 out:
174 return error;
175 }
176 #endif /* #ifdef CONFIG_USELIB */
177
178 #ifdef CONFIG_MMU
179 /*
180 * The nascent bprm->mm is not visible until exec_mmap() but it can
181 * use a lot of memory, account these pages in current->mm temporary
182 * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we
183 * change the counter back via acct_arg_size(0).
184 */
185 static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
186 {
187 struct mm_struct *mm = current->mm;
188 long diff = (long)(pages - bprm->vma_pages);
189
190 if (!mm || !diff)
191 return;
192
193 bprm->vma_pages = pages;
194 add_mm_counter(mm, MM_ANONPAGES, diff);
195 }
196
197 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
198 int write)
199 {
200 struct page *page;
201 struct vm_area_struct *vma = bprm->vma;
202 struct mm_struct *mm = bprm->mm;
203 int ret;
204
205 /*
206 * Avoid relying on expanding the stack down in GUP (which
207 * does not work for STACK_GROWSUP anyway), and just do it
208 * by hand ahead of time.
209 */
210 if (write && pos < vma->vm_start) {
211 mmap_write_lock(mm);
212 ret = expand_downwards(vma, pos);
213 if (unlikely(ret < 0)) {
214 mmap_write_unlock(mm);
215 return NULL;
216 }
217 mmap_write_downgrade(mm);
218 } else
219 mmap_read_lock(mm);
220
221 /*
222 * We are doing an exec(). 'current' is the process
223 * doing the exec and 'mm' is the new process's mm.
224 */
225 ret = get_user_pages_remote(mm, pos, 1,
226 write ? FOLL_WRITE : 0,
227 &page, NULL);
228 mmap_read_unlock(mm);
229 if (ret <= 0)
230 return NULL;
231
232 if (write)
233 acct_arg_size(bprm, vma_pages(vma));
234
235 return page;
236 }
237
238 static void put_arg_page(struct page *page)
239 {
240 put_page(page);
241 }
242
243 static void free_arg_pages(struct linux_binprm *bprm)
244 {
245 }
246
247 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
248 struct page *page)
249 {
250 flush_cache_page(bprm->vma, pos, page_to_pfn(page));
251 }
252
253 static int __bprm_mm_init(struct linux_binprm *bprm)
254 {
255 int err;
256 struct vm_area_struct *vma = NULL;
257 struct mm_struct *mm = bprm->mm;
258
259 bprm->vma = vma = vm_area_alloc(mm);
260 if (!vma)
261 return -ENOMEM;
262 vma_set_anonymous(vma);
263
264 if (mmap_write_lock_killable(mm)) {
265 err = -EINTR;
266 goto err_free;
267 }
268
269 /*
270 * Need to be called with mmap write lock
271 * held, to avoid race with ksmd.
272 */
273 err = ksm_execve(mm);
274 if (err)
275 goto err_ksm;
276
277 /*
278 * Place the stack at the largest stack address the architecture
279 * supports. Later, we'll move this to an appropriate place. We don't
280 * use STACK_TOP because that can depend on attributes which aren't
281 * configured yet.
282 */
283 BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);
284 vma->vm_end = STACK_TOP_MAX;
285 vma->vm_start = vma->vm_end - PAGE_SIZE;
286 vm_flags_init(vma, VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP);
287 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
288
289 err = insert_vm_struct(mm, vma);
290 if (err)
291 goto err;
292
293 mm->stack_vm = mm->total_vm = 1;
294 mmap_write_unlock(mm);
295 bprm->p = vma->vm_end - sizeof(void *);
296 return 0;
297 err:
298 ksm_exit(mm);
299 err_ksm:
300 mmap_write_unlock(mm);
301 err_free:
302 bprm->vma = NULL;
303 vm_area_free(vma);
304 return err;
305 }
306
307 static bool valid_arg_len(struct linux_binprm *bprm, long len)
308 {
309 return len <= MAX_ARG_STRLEN;
310 }
311
312 #else
313
314 static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
315 {
316 }
317
318 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
319 int write)
320 {
321 struct page *page;
322
323 page = bprm->page[pos / PAGE_SIZE];
324 if (!page && write) {
325 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
326 if (!page)
327 return NULL;
328 bprm->page[pos / PAGE_SIZE] = page;
329 }
330
331 return page;
332 }
333
334 static void put_arg_page(struct page *page)
335 {
336 }
337
338 static void free_arg_page(struct linux_binprm *bprm, int i)
339 {
340 if (bprm->page[i]) {
341 __free_page(bprm->page[i]);
342 bprm->page[i] = NULL;
343 }
344 }
345
346 static void free_arg_pages(struct linux_binprm *bprm)
347 {
348 int i;
349
350 for (i = 0; i < MAX_ARG_PAGES; i++)
351 free_arg_page(bprm, i);
352 }
353
354 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
355 struct page *page)
356 {
357 }
358
359 static int __bprm_mm_init(struct linux_binprm *bprm)
360 {
361 bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
362 return 0;
363 }
364
365 static bool valid_arg_len(struct linux_binprm *bprm, long len)
366 {
367 return len <= bprm->p;
368 }
369
370 #endif /* CONFIG_MMU */
371
372 /*
373 * Create a new mm_struct and populate it with a temporary stack
374 * vm_area_struct. We don't have enough context at this point to set the stack
375 * flags, permissions, and offset, so we use temporary values. We'll update
376 * them later in setup_arg_pages().
377 */
378 static int bprm_mm_init(struct linux_binprm *bprm)
379 {
380 int err;
381 struct mm_struct *mm = NULL;
382
383 bprm->mm = mm = mm_alloc();
384 err = -ENOMEM;
385 if (!mm)
386 goto err;
387
388 /* Save current stack limit for all calculations made during exec. */
389 task_lock(current->group_leader);
390 bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
391 task_unlock(current->group_leader);
392
393 err = __bprm_mm_init(bprm);
394 if (err)
395 goto err;
396
397 return 0;
398
399 err:
400 if (mm) {
401 bprm->mm = NULL;
402 mmdrop(mm);
403 }
404
405 return err;
406 }
407
408 struct user_arg_ptr {
409 #ifdef CONFIG_COMPAT
410 bool is_compat;
411 #endif
412 union {
413 const char __user *const __user *native;
414 #ifdef CONFIG_COMPAT
415 const compat_uptr_t __user *compat;
416 #endif
417 } ptr;
418 };
419
420 static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
421 {
422 const char __user *native;
423
424 #ifdef CONFIG_COMPAT
425 if (unlikely(argv.is_compat)) {
426 compat_uptr_t compat;
427
428 if (get_user(compat, argv.ptr.compat + nr))
429 return ERR_PTR(-EFAULT);
430
431 return compat_ptr(compat);
432 }
433 #endif
434
435 if (get_user(native, argv.ptr.native + nr))
436 return ERR_PTR(-EFAULT);
437
438 return native;
439 }
440
441 /*
442 * count() counts the number of strings in array ARGV.
443 */
444 static int count(struct user_arg_ptr argv, int max)
445 {
446 int i = 0;
447
448 if (argv.ptr.native != NULL) {
449 for (;;) {
450 const char __user *p = get_user_arg_ptr(argv, i);
451
452 if (!p)
453 break;
454
455 if (IS_ERR(p))
456 return -EFAULT;
457
458 if (i >= max)
459 return -E2BIG;
460 ++i;
461
462 if (fatal_signal_pending(current))
463 return -ERESTARTNOHAND;
464 cond_resched();
465 }
466 }
467 return i;
468 }
469
470 static int count_strings_kernel(const char *const *argv)
471 {
472 int i;
473
474 if (!argv)
475 return 0;
476
477 for (i = 0; argv[i]; ++i) {
478 if (i >= MAX_ARG_STRINGS)
479 return -E2BIG;
480 if (fatal_signal_pending(current))
481 return -ERESTARTNOHAND;
482 cond_resched();
483 }
484 return i;
485 }
486
487 static inline int bprm_set_stack_limit(struct linux_binprm *bprm,
488 unsigned long limit)
489 {
490 #ifdef CONFIG_MMU
491 /* Avoid a pathological bprm->p. */
492 if (bprm->p < limit)
493 return -E2BIG;
494 bprm->argmin = bprm->p - limit;
495 #endif
496 return 0;
497 }
498 static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)
499 {
500 #ifdef CONFIG_MMU
501 return bprm->p < bprm->argmin;
502 #else
503 return false;
504 #endif
505 }
506
507 /*
508 * Calculate bprm->argmin from:
509 * - _STK_LIM
510 * - ARG_MAX
511 * - bprm->rlim_stack.rlim_cur
512 * - bprm->argc
513 * - bprm->envc
514 * - bprm->p
515 */
516 static int bprm_stack_limits(struct linux_binprm *bprm)
517 {
518 unsigned long limit, ptr_size;
519
520 /*
521 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
522 * (whichever is smaller) for the argv+env strings.
523 * This ensures that:
524 * - the remaining binfmt code will not run out of stack space,
525 * - the program will have a reasonable amount of stack left
526 * to work from.
527 */
528 limit = _STK_LIM / 4 * 3;
529 limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
530 /*
531 * We've historically supported up to 32 pages (ARG_MAX)
532 * of argument strings even with small stacks
533 */
534 limit = max_t(unsigned long, limit, ARG_MAX);
535 /* Reject totally pathological counts. */
536 if (bprm->argc < 0 || bprm->envc < 0)
537 return -E2BIG;
538 /*
539 * We must account for the size of all the argv and envp pointers to
540 * the argv and envp strings, since they will also take up space in
541 * the stack. They aren't stored until much later when we can't
542 * signal to the parent that the child has run out of stack space.
543 * Instead, calculate it here so it's possible to fail gracefully.
544 *
545 * In the case of argc = 0, make sure there is space for adding a
546 * empty string (which will bump argc to 1), to ensure confused
547 * userspace programs don't start processing from argv[1], thinking
548 * argc can never be 0, to keep them from walking envp by accident.
549 * See do_execveat_common().
550 */
551 if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||
552 check_mul_overflow(ptr_size, sizeof(void *), &ptr_size))
553 return -E2BIG;
554 if (limit <= ptr_size)
555 return -E2BIG;
556 limit -= ptr_size;
557
558 return bprm_set_stack_limit(bprm, limit);
559 }
560
561 /*
562 * 'copy_strings()' copies argument/environment strings from the old
563 * processes's memory to the new process's stack. The call to get_user_pages()
564 * ensures the destination page is created and not swapped out.
565 */
566 static int copy_strings(int argc, struct user_arg_ptr argv,
567 struct linux_binprm *bprm)
568 {
569 struct page *kmapped_page = NULL;
570 char *kaddr = NULL;
571 unsigned long kpos = 0;
572 int ret;
573
574 while (argc-- > 0) {
575 const char __user *str;
576 int len;
577 unsigned long pos;
578
579 ret = -EFAULT;
580 str = get_user_arg_ptr(argv, argc);
581 if (IS_ERR(str))
582 goto out;
583
584 len = strnlen_user(str, MAX_ARG_STRLEN);
585 if (!len)
586 goto out;
587
588 ret = -E2BIG;
589 if (!valid_arg_len(bprm, len))
590 goto out;
591
592 /* We're going to work our way backwards. */
593 pos = bprm->p;
594 str += len;
595 bprm->p -= len;
596 if (bprm_hit_stack_limit(bprm))
597 goto out;
598
599 while (len > 0) {
600 int offset, bytes_to_copy;
601
602 if (fatal_signal_pending(current)) {
603 ret = -ERESTARTNOHAND;
604 goto out;
605 }
606 cond_resched();
607
608 offset = pos % PAGE_SIZE;
609 if (offset == 0)
610 offset = PAGE_SIZE;
611
612 bytes_to_copy = offset;
613 if (bytes_to_copy > len)
614 bytes_to_copy = len;
615
616 offset -= bytes_to_copy;
617 pos -= bytes_to_copy;
618 str -= bytes_to_copy;
619 len -= bytes_to_copy;
620
621 if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
622 struct page *page;
623
624 page = get_arg_page(bprm, pos, 1);
625 if (!page) {
626 ret = -E2BIG;
627 goto out;
628 }
629
630 if (kmapped_page) {
631 flush_dcache_page(kmapped_page);
632 kunmap_local(kaddr);
633 put_arg_page(kmapped_page);
634 }
635 kmapped_page = page;
636 kaddr = kmap_local_page(kmapped_page);
637 kpos = pos & PAGE_MASK;
638 flush_arg_page(bprm, kpos, kmapped_page);
639 }
640 if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
641 ret = -EFAULT;
642 goto out;
643 }
644 }
645 }
646 ret = 0;
647 out:
648 if (kmapped_page) {
649 flush_dcache_page(kmapped_page);
650 kunmap_local(kaddr);
651 put_arg_page(kmapped_page);
652 }
653 return ret;
654 }
655
656 /*
657 * Copy and argument/environment string from the kernel to the processes stack.
658 */
659 int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
660 {
661 int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;
662 unsigned long pos = bprm->p;
663
664 if (len == 0)
665 return -EFAULT;
666 if (!valid_arg_len(bprm, len))
667 return -E2BIG;
668
669 /* We're going to work our way backwards. */
670 arg += len;
671 bprm->p -= len;
672 if (bprm_hit_stack_limit(bprm))
673 return -E2BIG;
674
675 while (len > 0) {
676 unsigned int bytes_to_copy = min_t(unsigned int, len,
677 min_not_zero(offset_in_page(pos), PAGE_SIZE));
678 struct page *page;
679
680 pos -= bytes_to_copy;
681 arg -= bytes_to_copy;
682 len -= bytes_to_copy;
683
684 page = get_arg_page(bprm, pos, 1);
685 if (!page)
686 return -E2BIG;
687 flush_arg_page(bprm, pos & PAGE_MASK, page);
688 memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
689 put_arg_page(page);
690 }
691
692 return 0;
693 }
694 EXPORT_SYMBOL(copy_string_kernel);
695
696 static int copy_strings_kernel(int argc, const char *const *argv,
697 struct linux_binprm *bprm)
698 {
699 while (argc-- > 0) {
700 int ret = copy_string_kernel(argv[argc], bprm);
701 if (ret < 0)
702 return ret;
703 if (fatal_signal_pending(current))
704 return -ERESTARTNOHAND;
705 cond_resched();
706 }
707 return 0;
708 }
709
710 #ifdef CONFIG_MMU
711
712 /*
713 * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX. Once
714 * the binfmt code determines where the new stack should reside, we shift it to
715 * its final location. The process proceeds as follows:
716 *
717 * 1) Use shift to calculate the new vma endpoints.
718 * 2) Extend vma to cover both the old and new ranges. This ensures the
719 * arguments passed to subsequent functions are consistent.
720 * 3) Move vma's page tables to the new range.
721 * 4) Free up any cleared pgd range.
722 * 5) Shrink the vma to cover only the new range.
723 */
724 static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
725 {
726 struct mm_struct *mm = vma->vm_mm;
727 unsigned long old_start = vma->vm_start;
728 unsigned long old_end = vma->vm_end;
729 unsigned long length = old_end - old_start;
730 unsigned long new_start = old_start - shift;
731 unsigned long new_end = old_end - shift;
732 VMA_ITERATOR(vmi, mm, new_start);
733 struct vm_area_struct *next;
734 struct mmu_gather tlb;
735
736 BUG_ON(new_start > new_end);
737
738 /*
739 * ensure there are no vmas between where we want to go
740 * and where we are
741 */
742 if (vma != vma_next(&vmi))
743 return -EFAULT;
744
745 vma_iter_prev_range(&vmi);
746 /*
747 * cover the whole range: [new_start, old_end)
748 */
749 if (vma_expand(&vmi, vma, new_start, old_end, vma->vm_pgoff, NULL))
750 return -ENOMEM;
751
752 /*
753 * move the page tables downwards, on failure we rely on
754 * process cleanup to remove whatever mess we made.
755 */
756 if (length != move_page_tables(vma, old_start,
757 vma, new_start, length, false, true))
758 return -ENOMEM;
759
760 lru_add_drain();
761 tlb_gather_mmu(&tlb, mm);
762 next = vma_next(&vmi);
763 if (new_end > old_start) {
764 /*
765 * when the old and new regions overlap clear from new_end.
766 */
767 free_pgd_range(&tlb, new_end, old_end, new_end,
768 next ? next->vm_start : USER_PGTABLES_CEILING);
769 } else {
770 /*
771 * otherwise, clean from old_start; this is done to not touch
772 * the address space in [new_end, old_start) some architectures
773 * have constraints on va-space that make this illegal (IA64) -
774 * for the others its just a little faster.
775 */
776 free_pgd_range(&tlb, old_start, old_end, new_end,
777 next ? next->vm_start : USER_PGTABLES_CEILING);
778 }
779 tlb_finish_mmu(&tlb);
780
781 vma_prev(&vmi);
782 /* Shrink the vma to just the new range */
783 return vma_shrink(&vmi, vma, new_start, new_end, vma->vm_pgoff);
784 }
785
786 /*
787 * Finalizes the stack vm_area_struct. The flags and permissions are updated,
788 * the stack is optionally relocated, and some extra space is added.
789 */
790 int setup_arg_pages(struct linux_binprm *bprm,
791 unsigned long stack_top,
792 int executable_stack)
793 {
794 unsigned long ret;
795 unsigned long stack_shift;
796 struct mm_struct *mm = current->mm;
797 struct vm_area_struct *vma = bprm->vma;
798 struct vm_area_struct *prev = NULL;
799 unsigned long vm_flags;
800 unsigned long stack_base;
801 unsigned long stack_size;
802 unsigned long stack_expand;
803 unsigned long rlim_stack;
804 struct mmu_gather tlb;
805 struct vma_iterator vmi;
806
807 #ifdef CONFIG_STACK_GROWSUP
808 /* Limit stack size */
809 stack_base = bprm->rlim_stack.rlim_max;
810
811 stack_base = calc_max_stack_size(stack_base);
812
813 /* Add space for stack randomization. */
814 if (current->flags & PF_RANDOMIZE)
815 stack_base += (STACK_RND_MASK << PAGE_SHIFT);
816
817 /* Make sure we didn't let the argument array grow too large. */
818 if (vma->vm_end - vma->vm_start > stack_base)
819 return -ENOMEM;
820
821 stack_base = PAGE_ALIGN(stack_top - stack_base);
822
823 stack_shift = vma->vm_start - stack_base;
824 mm->arg_start = bprm->p - stack_shift;
825 bprm->p = vma->vm_end - stack_shift;
826 #else
827 stack_top = arch_align_stack(stack_top);
828 stack_top = PAGE_ALIGN(stack_top);
829
830 if (unlikely(stack_top < mmap_min_addr) ||
831 unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
832 return -ENOMEM;
833
834 stack_shift = vma->vm_end - stack_top;
835
836 bprm->p -= stack_shift;
837 mm->arg_start = bprm->p;
838 #endif
839
840 if (bprm->loader)
841 bprm->loader -= stack_shift;
842 bprm->exec -= stack_shift;
843
844 if (mmap_write_lock_killable(mm))
845 return -EINTR;
846
847 vm_flags = VM_STACK_FLAGS;
848
849 /*
850 * Adjust stack execute permissions; explicitly enable for
851 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
852 * (arch default) otherwise.
853 */
854 if (unlikely(executable_stack == EXSTACK_ENABLE_X))
855 vm_flags |= VM_EXEC;
856 else if (executable_stack == EXSTACK_DISABLE_X)
857 vm_flags &= ~VM_EXEC;
858 vm_flags |= mm->def_flags;
859 vm_flags |= VM_STACK_INCOMPLETE_SETUP;
860
861 vma_iter_init(&vmi, mm, vma->vm_start);
862
863 tlb_gather_mmu(&tlb, mm);
864 ret = mprotect_fixup(&vmi, &tlb, vma, &prev, vma->vm_start, vma->vm_end,
865 vm_flags);
866 tlb_finish_mmu(&tlb);
867
868 if (ret)
869 goto out_unlock;
870 BUG_ON(prev != vma);
871
872 if (unlikely(vm_flags & VM_EXEC)) {
873 pr_warn_once("process '%pD4' started with executable stack\n",
874 bprm->file);
875 }
876
877 /* Move stack pages down in memory. */
878 if (stack_shift) {
879 ret = shift_arg_pages(vma, stack_shift);
880 if (ret)
881 goto out_unlock;
882 }
883
884 /* mprotect_fixup is overkill to remove the temporary stack flags */
885 vm_flags_clear(vma, VM_STACK_INCOMPLETE_SETUP);
886
887 stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
888 stack_size = vma->vm_end - vma->vm_start;
889 /*
890 * Align this down to a page boundary as expand_stack
891 * will align it up.
892 */
893 rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
894
895 stack_expand = min(rlim_stack, stack_size + stack_expand);
896
897 #ifdef CONFIG_STACK_GROWSUP
898 stack_base = vma->vm_start + stack_expand;
899 #else
900 stack_base = vma->vm_end - stack_expand;
901 #endif
902 current->mm->start_stack = bprm->p;
903 ret = expand_stack_locked(vma, stack_base);
904 if (ret)
905 ret = -EFAULT;
906
907 out_unlock:
908 mmap_write_unlock(mm);
909 return ret;
910 }
911 EXPORT_SYMBOL(setup_arg_pages);
912
913 #else
914
915 /*
916 * Transfer the program arguments and environment from the holding pages
917 * onto the stack. The provided stack pointer is adjusted accordingly.
918 */
919 int transfer_args_to_stack(struct linux_binprm *bprm,
920 unsigned long *sp_location)
921 {
922 unsigned long index, stop, sp;
923 int ret = 0;
924
925 stop = bprm->p >> PAGE_SHIFT;
926 sp = *sp_location;
927
928 for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {
929 unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
930 char *src = kmap_local_page(bprm->page[index]) + offset;
931 sp -= PAGE_SIZE - offset;
932 if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
933 ret = -EFAULT;
934 kunmap_local(src);
935 if (ret)
936 goto out;
937 }
938
939 bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
940 *sp_location = sp;
941
942 out:
943 return ret;
944 }
945 EXPORT_SYMBOL(transfer_args_to_stack);
946
947 #endif /* CONFIG_MMU */
948
949 /*
950 * On success, caller must call do_close_execat() on the returned
951 * struct file to close it.
952 */
953 static struct file *do_open_execat(int fd, struct filename *name, int flags)
954 {
955 struct file *file;
956 struct open_flags open_exec_flags = {
957 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
958 .acc_mode = MAY_EXEC,
959 .intent = LOOKUP_OPEN,
960 .lookup_flags = LOOKUP_FOLLOW,
961 };
962
963 if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
964 return ERR_PTR(-EINVAL);
965 if (flags & AT_SYMLINK_NOFOLLOW)
966 open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
967 if (flags & AT_EMPTY_PATH)
968 open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
969
970 file = do_filp_open(fd, name, &open_exec_flags);
971 if (IS_ERR(file))
972 return file;
973
974 /*
975 * In the past the regular type check was here. It moved to may_open() in
976 * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is
977 * an invariant that all non-regular files error out before we get here.
978 */
979 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
980 path_noexec(&file->f_path)) {
981 fput(file);
982 return ERR_PTR(-EACCES);
983 }
984
985 return file;
986 }
987
988 /**
989 * open_exec - Open a path name for execution
990 *
991 * @name: path name to open with the intent of executing it.
992 *
993 * Returns ERR_PTR on failure or allocated struct file on success.
994 *
995 * As this is a wrapper for the internal do_open_execat(). Also see
996 * do_close_execat().
997 */
998 struct file *open_exec(const char *name)
999 {
1000 struct filename *filename = getname_kernel(name);
1001 struct file *f = ERR_CAST(filename);
1002
1003 if (!IS_ERR(filename)) {
1004 f = do_open_execat(AT_FDCWD, filename, 0);
1005 putname(filename);
1006 }
1007 return f;
1008 }
1009 EXPORT_SYMBOL(open_exec);
1010
1011 #if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)
1012 ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)
1013 {
1014 ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);
1015 if (res > 0)
1016 flush_icache_user_range(addr, addr + len);
1017 return res;
1018 }
1019 EXPORT_SYMBOL(read_code);
1020 #endif
1021
1022 /*
1023 * Maps the mm_struct mm into the current task struct.
1024 * On success, this function returns with exec_update_lock
1025 * held for writing.
1026 */
1027 static int exec_mmap(struct mm_struct *mm)
1028 {
1029 struct task_struct *tsk;
1030 struct mm_struct *old_mm, *active_mm;
1031 int ret;
1032
1033 /* Notify parent that we're no longer interested in the old VM */
1034 tsk = current;
1035 old_mm = current->mm;
1036 exec_mm_release(tsk, old_mm);
1037
1038 ret = down_write_killable(&tsk->signal->exec_update_lock);
1039 if (ret)
1040 return ret;
1041
1042 if (old_mm) {
1043 /*
1044 * If there is a pending fatal signal perhaps a signal
1045 * whose default action is to create a coredump get
1046 * out and die instead of going through with the exec.
1047 */
1048 ret = mmap_read_lock_killable(old_mm);
1049 if (ret) {
1050 up_write(&tsk->signal->exec_update_lock);
1051 return ret;
1052 }
1053 }
1054
1055 task_lock(tsk);
1056 membarrier_exec_mmap(mm);
1057
1058 local_irq_disable();
1059 active_mm = tsk->active_mm;
1060 tsk->active_mm = mm;
1061 tsk->mm = mm;
1062 mm_init_cid(mm);
1063 /*
1064 * This prevents preemption while active_mm is being loaded and
1065 * it and mm are being updated, which could cause problems for
1066 * lazy tlb mm refcounting when these are updated by context
1067 * switches. Not all architectures can handle irqs off over
1068 * activate_mm yet.
1069 */
1070 if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1071 local_irq_enable();
1072 activate_mm(active_mm, mm);
1073 if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1074 local_irq_enable();
1075 lru_gen_add_mm(mm);
1076 task_unlock(tsk);
1077 lru_gen_use_mm(mm);
1078 if (old_mm) {
1079 mmap_read_unlock(old_mm);
1080 BUG_ON(active_mm != old_mm);
1081 setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
1082 mm_update_next_owner(old_mm);
1083 mmput(old_mm);
1084 return 0;
1085 }
1086 mmdrop_lazy_tlb(active_mm);
1087 return 0;
1088 }
1089
1090 static int de_thread(struct task_struct *tsk)
1091 {
1092 struct signal_struct *sig = tsk->signal;
1093 struct sighand_struct *oldsighand = tsk->sighand;
1094 spinlock_t *lock = &oldsighand->siglock;
1095
1096 if (thread_group_empty(tsk))
1097 goto no_thread_group;
1098
1099 /*
1100 * Kill all other threads in the thread group.
1101 */
1102 spin_lock_irq(lock);
1103 if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {
1104 /*
1105 * Another group action in progress, just
1106 * return so that the signal is processed.
1107 */
1108 spin_unlock_irq(lock);
1109 return -EAGAIN;
1110 }
1111
1112 sig->group_exec_task = tsk;
1113 sig->notify_count = zap_other_threads(tsk);
1114 if (!thread_group_leader(tsk))
1115 sig->notify_count--;
1116
1117 while (sig->notify_count) {
1118 __set_current_state(TASK_KILLABLE);
1119 spin_unlock_irq(lock);
1120 schedule();
1121 if (__fatal_signal_pending(tsk))
1122 goto killed;
1123 spin_lock_irq(lock);
1124 }
1125 spin_unlock_irq(lock);
1126
1127 /*
1128 * At this point all other threads have exited, all we have to
1129 * do is to wait for the thread group leader to become inactive,
1130 * and to assume its PID:
1131 */
1132 if (!thread_group_leader(tsk)) {
1133 struct task_struct *leader = tsk->group_leader;
1134
1135 for (;;) {
1136 cgroup_threadgroup_change_begin(tsk);
1137 write_lock_irq(&tasklist_lock);
1138 /*
1139 * Do this under tasklist_lock to ensure that
1140 * exit_notify() can't miss ->group_exec_task
1141 */
1142 sig->notify_count = -1;
1143 if (likely(leader->exit_state))
1144 break;
1145 __set_current_state(TASK_KILLABLE);
1146 write_unlock_irq(&tasklist_lock);
1147 cgroup_threadgroup_change_end(tsk);
1148 schedule();
1149 if (__fatal_signal_pending(tsk))
1150 goto killed;
1151 }
1152
1153 /*
1154 * The only record we have of the real-time age of a
1155 * process, regardless of execs it's done, is start_time.
1156 * All the past CPU time is accumulated in signal_struct
1157 * from sister threads now dead. But in this non-leader
1158 * exec, nothing survives from the original leader thread,
1159 * whose birth marks the true age of this process now.
1160 * When we take on its identity by switching to its PID, we
1161 * also take its birthdate (always earlier than our own).
1162 */
1163 tsk->start_time = leader->start_time;
1164 tsk->start_boottime = leader->start_boottime;
1165
1166 BUG_ON(!same_thread_group(leader, tsk));
1167 /*
1168 * An exec() starts a new thread group with the
1169 * TGID of the previous thread group. Rehash the
1170 * two threads with a switched PID, and release
1171 * the former thread group leader:
1172 */
1173
1174 /* Become a process group leader with the old leader's pid.
1175 * The old leader becomes a thread of the this thread group.
1176 */
1177 exchange_tids(tsk, leader);
1178 transfer_pid(leader, tsk, PIDTYPE_TGID);
1179 transfer_pid(leader, tsk, PIDTYPE_PGID);
1180 transfer_pid(leader, tsk, PIDTYPE_SID);
1181
1182 list_replace_rcu(&leader->tasks, &tsk->tasks);
1183 list_replace_init(&leader->sibling, &tsk->sibling);
1184
1185 tsk->group_leader = tsk;
1186 leader->group_leader = tsk;
1187
1188 tsk->exit_signal = SIGCHLD;
1189 leader->exit_signal = -1;
1190
1191 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
1192 leader->exit_state = EXIT_DEAD;
1193 /*
1194 * We are going to release_task()->ptrace_unlink() silently,
1195 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
1196 * the tracer won't block again waiting for this thread.
1197 */
1198 if (unlikely(leader->ptrace))
1199 __wake_up_parent(leader, leader->parent);
1200 write_unlock_irq(&tasklist_lock);
1201 cgroup_threadgroup_change_end(tsk);
1202
1203 release_task(leader);
1204 }
1205
1206 sig->group_exec_task = NULL;
1207 sig->notify_count = 0;
1208
1209 no_thread_group:
1210 /* we have changed execution domain */
1211 tsk->exit_signal = SIGCHLD;
1212
1213 BUG_ON(!thread_group_leader(tsk));
1214 return 0;
1215
1216 killed:
1217 /* protects against exit_notify() and __exit_signal() */
1218 read_lock(&tasklist_lock);
1219 sig->group_exec_task = NULL;
1220 sig->notify_count = 0;
1221 read_unlock(&tasklist_lock);
1222 return -EAGAIN;
1223 }
1224
1225
1226 /*
1227 * This function makes sure the current process has its own signal table,
1228 * so that flush_signal_handlers can later reset the handlers without
1229 * disturbing other processes. (Other processes might share the signal
1230 * table via the CLONE_SIGHAND option to clone().)
1231 */
1232 static int unshare_sighand(struct task_struct *me)
1233 {
1234 struct sighand_struct *oldsighand = me->sighand;
1235
1236 if (refcount_read(&oldsighand->count) != 1) {
1237 struct sighand_struct *newsighand;
1238 /*
1239 * This ->sighand is shared with the CLONE_SIGHAND
1240 * but not CLONE_THREAD task, switch to the new one.
1241 */
1242 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1243 if (!newsighand)
1244 return -ENOMEM;
1245
1246 refcount_set(&newsighand->count, 1);
1247
1248 write_lock_irq(&tasklist_lock);
1249 spin_lock(&oldsighand->siglock);
1250 memcpy(newsighand->action, oldsighand->action,
1251 sizeof(newsighand->action));
1252 rcu_assign_pointer(me->sighand, newsighand);
1253 spin_unlock(&oldsighand->siglock);
1254 write_unlock_irq(&tasklist_lock);
1255
1256 __cleanup_sighand(oldsighand);
1257 }
1258 return 0;
1259 }
1260
1261 char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
1262 {
1263 task_lock(tsk);
1264 /* Always NUL terminated and zero-padded */
1265 strscpy_pad(buf, tsk->comm, buf_size);
1266 task_unlock(tsk);
1267 return buf;
1268 }
1269 EXPORT_SYMBOL_GPL(__get_task_comm);
1270
1271 /*
1272 * These functions flushes out all traces of the currently running executable
1273 * so that a new one can be started
1274 */
1275
1276 void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
1277 {
1278 task_lock(tsk);
1279 trace_task_rename(tsk, buf);
1280 strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));
1281 task_unlock(tsk);
1282 perf_event_comm(tsk, exec);
1283 }
1284
1285 /*
1286 * Calling this is the point of no return. None of the failures will be
1287 * seen by userspace since either the process is already taking a fatal
1288 * signal (via de_thread() or coredump), or will have SEGV raised
1289 * (after exec_mmap()) by search_binary_handler (see below).
1290 */
1291 int begin_new_exec(struct linux_binprm * bprm)
1292 {
1293 struct task_struct *me = current;
1294 int retval;
1295
1296 /* Once we are committed compute the creds */
1297 retval = bprm_creds_from_file(bprm);
1298 if (retval)
1299 return retval;
1300
1301 /*
1302 * This tracepoint marks the point before flushing the old exec where
1303 * the current task is still unchanged, but errors are fatal (point of
1304 * no return). The later "sched_process_exec" tracepoint is called after
1305 * the current task has successfully switched to the new exec.
1306 */
1307 trace_sched_prepare_exec(current, bprm);
1308
1309 /*
1310 * Ensure all future errors are fatal.
1311 */
1312 bprm->point_of_no_return = true;
1313
1314 /*
1315 * Make this the only thread in the thread group.
1316 */
1317 retval = de_thread(me);
1318 if (retval)
1319 goto out;
1320
1321 /*
1322 * Cancel any io_uring activity across execve
1323 */
1324 io_uring_task_cancel();
1325
1326 /* Ensure the files table is not shared. */
1327 retval = unshare_files();
1328 if (retval)
1329 goto out;
1330
1331 /*
1332 * Must be called _before_ exec_mmap() as bprm->mm is
1333 * not visible until then. Doing it here also ensures
1334 * we don't race against replace_mm_exe_file().
1335 */
1336 retval = set_mm_exe_file(bprm->mm, bprm->file);
1337 if (retval)
1338 goto out;
1339
1340 /* If the binary is not readable then enforce mm->dumpable=0 */
1341 would_dump(bprm, bprm->file);
1342 if (bprm->have_execfd)
1343 would_dump(bprm, bprm->executable);
1344
1345 /*
1346 * Release all of the old mmap stuff
1347 */
1348 acct_arg_size(bprm, 0);
1349 retval = exec_mmap(bprm->mm);
1350 if (retval)
1351 goto out;
1352
1353 bprm->mm = NULL;
1354
1355 retval = exec_task_namespaces();
1356 if (retval)
1357 goto out_unlock;
1358
1359 #ifdef CONFIG_POSIX_TIMERS
1360 spin_lock_irq(&me->sighand->siglock);
1361 posix_cpu_timers_exit(me);
1362 spin_unlock_irq(&me->sighand->siglock);
1363 exit_itimers(me);
1364 flush_itimer_signals();
1365 #endif
1366
1367 /*
1368 * Make the signal table private.
1369 */
1370 retval = unshare_sighand(me);
1371 if (retval)
1372 goto out_unlock;
1373
1374 me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |
1375 PF_NOFREEZE | PF_NO_SETAFFINITY);
1376 flush_thread();
1377 me->personality &= ~bprm->per_clear;
1378
1379 clear_syscall_work_syscall_user_dispatch(me);
1380
1381 /*
1382 * We have to apply CLOEXEC before we change whether the process is
1383 * dumpable (in setup_new_exec) to avoid a race with a process in userspace
1384 * trying to access the should-be-closed file descriptors of a process
1385 * undergoing exec(2).
1386 */
1387 do_close_on_exec(me->files);
1388
1389 if (bprm->secureexec) {
1390 /* Make sure parent cannot signal privileged process. */
1391 me->pdeath_signal = 0;
1392
1393 /*
1394 * For secureexec, reset the stack limit to sane default to
1395 * avoid bad behavior from the prior rlimits. This has to
1396 * happen before arch_pick_mmap_layout(), which examines
1397 * RLIMIT_STACK, but after the point of no return to avoid
1398 * needing to clean up the change on failure.
1399 */
1400 if (bprm->rlim_stack.rlim_cur > _STK_LIM)
1401 bprm->rlim_stack.rlim_cur = _STK_LIM;
1402 }
1403
1404 me->sas_ss_sp = me->sas_ss_size = 0;
1405
1406 /*
1407 * Figure out dumpability. Note that this checking only of current
1408 * is wrong, but userspace depends on it. This should be testing
1409 * bprm->secureexec instead.
1410 */
1411 if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
1412 !(uid_eq(current_euid(), current_uid()) &&
1413 gid_eq(current_egid(), current_gid())))
1414 set_dumpable(current->mm, suid_dumpable);
1415 else
1416 set_dumpable(current->mm, SUID_DUMP_USER);
1417
1418 perf_event_exec();
1419 __set_task_comm(me, kbasename(bprm->filename), true);
1420
1421 /* An exec changes our domain. We are no longer part of the thread
1422 group */
1423 WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);
1424 flush_signal_handlers(me, 0);
1425
1426 retval = set_cred_ucounts(bprm->cred);
1427 if (retval < 0)
1428 goto out_unlock;
1429
1430 /*
1431 * install the new credentials for this executable
1432 */
1433 security_bprm_committing_creds(bprm);
1434
1435 commit_creds(bprm->cred);
1436 bprm->cred = NULL;
1437
1438 /*
1439 * Disable monitoring for regular users
1440 * when executing setuid binaries. Must
1441 * wait until new credentials are committed
1442 * by commit_creds() above
1443 */
1444 if (get_dumpable(me->mm) != SUID_DUMP_USER)
1445 perf_event_exit_task(me);
1446 /*
1447 * cred_guard_mutex must be held at least to this point to prevent
1448 * ptrace_attach() from altering our determination of the task's
1449 * credentials; any time after this it may be unlocked.
1450 */
1451 security_bprm_committed_creds(bprm);
1452
1453 /* Pass the opened binary to the interpreter. */
1454 if (bprm->have_execfd) {
1455 retval = get_unused_fd_flags(0);
1456 if (retval < 0)
1457 goto out_unlock;
1458 fd_install(retval, bprm->executable);
1459 bprm->executable = NULL;
1460 bprm->execfd = retval;
1461 }
1462 return 0;
1463
1464 out_unlock:
1465 up_write(&me->signal->exec_update_lock);
1466 if (!bprm->cred)
1467 mutex_unlock(&me->signal->cred_guard_mutex);
1468
1469 out:
1470 return retval;
1471 }
1472 EXPORT_SYMBOL(begin_new_exec);
1473
1474 void would_dump(struct linux_binprm *bprm, struct file *file)
1475 {
1476 struct inode *inode = file_inode(file);
1477 struct mnt_idmap *idmap = file_mnt_idmap(file);
1478 if (inode_permission(idmap, inode, MAY_READ) < 0) {
1479 struct user_namespace *old, *user_ns;
1480 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
1481
1482 /* Ensure mm->user_ns contains the executable */
1483 user_ns = old = bprm->mm->user_ns;
1484 while ((user_ns != &init_user_ns) &&
1485 !privileged_wrt_inode_uidgid(user_ns, idmap, inode))
1486 user_ns = user_ns->parent;
1487
1488 if (old != user_ns) {
1489 bprm->mm->user_ns = get_user_ns(user_ns);
1490 put_user_ns(old);
1491 }
1492 }
1493 }
1494 EXPORT_SYMBOL(would_dump);
1495
1496 void setup_new_exec(struct linux_binprm * bprm)
1497 {
1498 /* Setup things that can depend upon the personality */
1499 struct task_struct *me = current;
1500
1501 arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);
1502
1503 arch_setup_new_exec();
1504
1505 /* Set the new mm task size. We have to do that late because it may
1506 * depend on TIF_32BIT which is only updated in flush_thread() on
1507 * some architectures like powerpc
1508 */
1509 me->mm->task_size = TASK_SIZE;
1510 up_write(&me->signal->exec_update_lock);
1511 mutex_unlock(&me->signal->cred_guard_mutex);
1512 }
1513 EXPORT_SYMBOL(setup_new_exec);
1514
1515 /* Runs immediately before start_thread() takes over. */
1516 void finalize_exec(struct linux_binprm *bprm)
1517 {
1518 /* Store any stack rlimit changes before starting thread. */
1519 task_lock(current->group_leader);
1520 current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
1521 task_unlock(current->group_leader);
1522 }
1523 EXPORT_SYMBOL(finalize_exec);
1524
1525 /*
1526 * Prepare credentials and lock ->cred_guard_mutex.
1527 * setup_new_exec() commits the new creds and drops the lock.
1528 * Or, if exec fails before, free_bprm() should release ->cred
1529 * and unlock.
1530 */
1531 static int prepare_bprm_creds(struct linux_binprm *bprm)
1532 {
1533 if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
1534 return -ERESTARTNOINTR;
1535
1536 bprm->cred = prepare_exec_creds();
1537 if (likely(bprm->cred))
1538 return 0;
1539
1540 mutex_unlock(¤t->signal->cred_guard_mutex);
1541 return -ENOMEM;
1542 }
1543
1544 /* Matches do_open_execat() */
1545 static void do_close_execat(struct file *file)
1546 {
1547 if (file)
1548 fput(file);
1549 }
1550
1551 static void free_bprm(struct linux_binprm *bprm)
1552 {
1553 if (bprm->mm) {
1554 acct_arg_size(bprm, 0);
1555 mmput(bprm->mm);
1556 }
1557 free_arg_pages(bprm);
1558 if (bprm->cred) {
1559 mutex_unlock(¤t->signal->cred_guard_mutex);
1560 abort_creds(bprm->cred);
1561 }
1562 do_close_execat(bprm->file);
1563 if (bprm->executable)
1564 fput(bprm->executable);
1565 /* If a binfmt changed the interp, free it. */
1566 if (bprm->interp != bprm->filename)
1567 kfree(bprm->interp);
1568 kfree(bprm->fdpath);
1569 kfree(bprm);
1570 }
1571
1572 static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)
1573 {
1574 struct linux_binprm *bprm;
1575 struct file *file;
1576 int retval = -ENOMEM;
1577
1578 file = do_open_execat(fd, filename, flags);
1579 if (IS_ERR(file))
1580 return ERR_CAST(file);
1581
1582 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1583 if (!bprm) {
1584 do_close_execat(file);
1585 return ERR_PTR(-ENOMEM);
1586 }
1587
1588 bprm->file = file;
1589
1590 if (fd == AT_FDCWD || filename->name[0] == '/') {
1591 bprm->filename = filename->name;
1592 } else {
1593 if (filename->name[0] == '\0')
1594 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
1595 else
1596 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
1597 fd, filename->name);
1598 if (!bprm->fdpath)
1599 goto out_free;
1600
1601 /*
1602 * Record that a name derived from an O_CLOEXEC fd will be
1603 * inaccessible after exec. This allows the code in exec to
1604 * choose to fail when the executable is not mmaped into the
1605 * interpreter and an open file descriptor is not passed to
1606 * the interpreter. This makes for a better user experience
1607 * than having the interpreter start and then immediately fail
1608 * when it finds the executable is inaccessible.
1609 */
1610 if (get_close_on_exec(fd))
1611 bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
1612
1613 bprm->filename = bprm->fdpath;
1614 }
1615 bprm->interp = bprm->filename;
1616
1617 retval = bprm_mm_init(bprm);
1618 if (!retval)
1619 return bprm;
1620
1621 out_free:
1622 free_bprm(bprm);
1623 return ERR_PTR(retval);
1624 }
1625
1626 int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
1627 {
1628 /* If a binfmt changed the interp, free it first. */
1629 if (bprm->interp != bprm->filename)
1630 kfree(bprm->interp);
1631 bprm->interp = kstrdup(interp, GFP_KERNEL);
1632 if (!bprm->interp)
1633 return -ENOMEM;
1634 return 0;
1635 }
1636 EXPORT_SYMBOL(bprm_change_interp);
1637
1638 /*
1639 * determine how safe it is to execute the proposed program
1640 * - the caller must hold ->cred_guard_mutex to protect against
1641 * PTRACE_ATTACH or seccomp thread-sync
1642 */
1643 static void check_unsafe_exec(struct linux_binprm *bprm)
1644 {
1645 struct task_struct *p = current, *t;
1646 unsigned n_fs;
1647
1648 if (p->ptrace)
1649 bprm->unsafe |= LSM_UNSAFE_PTRACE;
1650
1651 /*
1652 * This isn't strictly necessary, but it makes it harder for LSMs to
1653 * mess up.
1654 */
1655 if (task_no_new_privs(current))
1656 bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
1657
1658 /*
1659 * If another task is sharing our fs, we cannot safely
1660 * suid exec because the differently privileged task
1661 * will be able to manipulate the current directory, etc.
1662 * It would be nice to force an unshare instead...
1663 */
1664 n_fs = 1;
1665 spin_lock(&p->fs->lock);
1666 rcu_read_lock();
1667 for_other_threads(p, t) {
1668 if (t->fs == p->fs)
1669 n_fs++;
1670 }
1671 rcu_read_unlock();
1672
1673 /* "users" and "in_exec" locked for copy_fs() */
1674 if (p->fs->users > n_fs)
1675 bprm->unsafe |= LSM_UNSAFE_SHARE;
1676 else
1677 p->fs->in_exec = 1;
1678 spin_unlock(&p->fs->lock);
1679 }
1680
1681 static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
1682 {
1683 /* Handle suid and sgid on files */
1684 struct mnt_idmap *idmap;
1685 struct inode *inode = file_inode(file);
1686 unsigned int mode;
1687 vfsuid_t vfsuid;
1688 vfsgid_t vfsgid;
1689 int err;
1690
1691 if (!mnt_may_suid(file->f_path.mnt))
1692 return;
1693
1694 if (task_no_new_privs(current))
1695 return;
1696
1697 mode = READ_ONCE(inode->i_mode);
1698 if (!(mode & (S_ISUID|S_ISGID)))
1699 return;
1700
1701 idmap = file_mnt_idmap(file);
1702
1703 /* Be careful if suid/sgid is set */
1704 inode_lock(inode);
1705
1706 /* Atomically reload and check mode/uid/gid now that lock held. */
1707 mode = inode->i_mode;
1708 vfsuid = i_uid_into_vfsuid(idmap, inode);
1709 vfsgid = i_gid_into_vfsgid(idmap, inode);
1710 err = inode_permission(idmap, inode, MAY_EXEC);
1711 inode_unlock(inode);
1712
1713 /* Did the exec bit vanish out from under us? Give up. */
1714 if (err)
1715 return;
1716
1717 /* We ignore suid/sgid if there are no mappings for them in the ns */
1718 if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||
1719 !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))
1720 return;
1721
1722 if (mode & S_ISUID) {
1723 bprm->per_clear |= PER_CLEAR_ON_SETID;
1724 bprm->cred->euid = vfsuid_into_kuid(vfsuid);
1725 }
1726
1727 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1728 bprm->per_clear |= PER_CLEAR_ON_SETID;
1729 bprm->cred->egid = vfsgid_into_kgid(vfsgid);
1730 }
1731 }
1732
1733 /*
1734 * Compute brpm->cred based upon the final binary.
1735 */
1736 static int bprm_creds_from_file(struct linux_binprm *bprm)
1737 {
1738 /* Compute creds based on which file? */
1739 struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;
1740
1741 bprm_fill_uid(bprm, file);
1742 return security_bprm_creds_from_file(bprm, file);
1743 }
1744
1745 /*
1746 * Fill the binprm structure from the inode.
1747 * Read the first BINPRM_BUF_SIZE bytes
1748 *
1749 * This may be called multiple times for binary chains (scripts for example).
1750 */
1751 static int prepare_binprm(struct linux_binprm *bprm)
1752 {
1753 loff_t pos = 0;
1754
1755 memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1756 return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);
1757 }
1758
1759 /*
1760 * Arguments are '\0' separated strings found at the location bprm->p
1761 * points to; chop off the first by relocating brpm->p to right after
1762 * the first '\0' encountered.
1763 */
1764 int remove_arg_zero(struct linux_binprm *bprm)
1765 {
1766 unsigned long offset;
1767 char *kaddr;
1768 struct page *page;
1769
1770 if (!bprm->argc)
1771 return 0;
1772
1773 do {
1774 offset = bprm->p & ~PAGE_MASK;
1775 page = get_arg_page(bprm, bprm->p, 0);
1776 if (!page)
1777 return -EFAULT;
1778 kaddr = kmap_local_page(page);
1779
1780 for (; offset < PAGE_SIZE && kaddr[offset];
1781 offset++, bprm->p++)
1782 ;
1783
1784 kunmap_local(kaddr);
1785 put_arg_page(page);
1786 } while (offset == PAGE_SIZE);
1787
1788 bprm->p++;
1789 bprm->argc--;
1790
1791 return 0;
1792 }
1793 EXPORT_SYMBOL(remove_arg_zero);
1794
1795 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1796 /*
1797 * cycle the list of binary formats handler, until one recognizes the image
1798 */
1799 static int search_binary_handler(struct linux_binprm *bprm)
1800 {
1801 bool need_retry = IS_ENABLED(CONFIG_MODULES);
1802 struct linux_binfmt *fmt;
1803 int retval;
1804
1805 retval = prepare_binprm(bprm);
1806 if (retval < 0)
1807 return retval;
1808
1809 retval = security_bprm_check(bprm);
1810 if (retval)
1811 return retval;
1812
1813 retval = -ENOENT;
1814 retry:
1815 read_lock(&binfmt_lock);
1816 list_for_each_entry(fmt, &formats, lh) {
1817 if (!try_module_get(fmt->module))
1818 continue;
1819 read_unlock(&binfmt_lock);
1820
1821 retval = fmt->load_binary(bprm);
1822
1823 read_lock(&binfmt_lock);
1824 put_binfmt(fmt);
1825 if (bprm->point_of_no_return || (retval != -ENOEXEC)) {
1826 read_unlock(&binfmt_lock);
1827 return retval;
1828 }
1829 }
1830 read_unlock(&binfmt_lock);
1831
1832 if (need_retry) {
1833 if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&
1834 printable(bprm->buf[2]) && printable(bprm->buf[3]))
1835 return retval;
1836 if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)
1837 return retval;
1838 need_retry = false;
1839 goto retry;
1840 }
1841
1842 return retval;
1843 }
1844
1845 /* binfmt handlers will call back into begin_new_exec() on success. */
1846 static int exec_binprm(struct linux_binprm *bprm)
1847 {
1848 pid_t old_pid, old_vpid;
1849 int ret, depth;
1850
1851 /* Need to fetch pid before load_binary changes it */
1852 old_pid = current->pid;
1853 rcu_read_lock();
1854 old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1855 rcu_read_unlock();
1856
1857 /* This allows 4 levels of binfmt rewrites before failing hard. */
1858 for (depth = 0;; depth++) {
1859 struct file *exec;
1860 if (depth > 5)
1861 return -ELOOP;
1862
1863 ret = search_binary_handler(bprm);
1864 if (ret < 0)
1865 return ret;
1866 if (!bprm->interpreter)
1867 break;
1868
1869 exec = bprm->file;
1870 bprm->file = bprm->interpreter;
1871 bprm->interpreter = NULL;
1872
1873 if (unlikely(bprm->have_execfd)) {
1874 if (bprm->executable) {
1875 fput(exec);
1876 return -ENOEXEC;
1877 }
1878 bprm->executable = exec;
1879 } else
1880 fput(exec);
1881 }
1882
1883 audit_bprm(bprm);
1884 trace_sched_process_exec(current, old_pid, bprm);
1885 ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
1886 proc_exec_connector(current);
1887 return 0;
1888 }
1889
1890 static int bprm_execve(struct linux_binprm *bprm)
1891 {
1892 int retval;
1893
1894 retval = prepare_bprm_creds(bprm);
1895 if (retval)
1896 return retval;
1897
1898 /*
1899 * Check for unsafe execution states before exec_binprm(), which
1900 * will call back into begin_new_exec(), into bprm_creds_from_file(),
1901 * where setuid-ness is evaluated.
1902 */
1903 check_unsafe_exec(bprm);
1904 current->in_execve = 1;
1905 sched_mm_cid_before_execve(current);
1906
1907 sched_exec();
1908
1909 /* Set the unchanging part of bprm->cred */
1910 retval = security_bprm_creds_for_exec(bprm);
1911 if (retval)
1912 goto out;
1913
1914 retval = ccs_exec_binprm(bprm);
1915 if (retval < 0)
1916 goto out;
1917
1918 sched_mm_cid_after_execve(current);
1919 /* execve succeeded */
1920 current->fs->in_exec = 0;
1921 current->in_execve = 0;
1922 rseq_execve(current);
1923 user_events_execve(current);
1924 acct_update_integrals(current);
1925 task_numa_free(current, false);
1926 return retval;
1927
1928 out:
1929 /*
1930 * If past the point of no return ensure the code never
1931 * returns to the userspace process. Use an existing fatal
1932 * signal if present otherwise terminate the process with
1933 * SIGSEGV.
1934 */
1935 if (bprm->point_of_no_return && !fatal_signal_pending(current))
1936 force_fatal_sig(SIGSEGV);
1937
1938 sched_mm_cid_after_execve(current);
1939 current->fs->in_exec = 0;
1940 current->in_execve = 0;
1941
1942 return retval;
1943 }
1944
1945 static int do_execveat_common(int fd, struct filename *filename,
1946 struct user_arg_ptr argv,
1947 struct user_arg_ptr envp,
1948 int flags)
1949 {
1950 struct linux_binprm *bprm;
1951 int retval;
1952
1953 if (IS_ERR(filename))
1954 return PTR_ERR(filename);
1955
1956 /*
1957 * We move the actual failure in case of RLIMIT_NPROC excess from
1958 * set*uid() to execve() because too many poorly written programs
1959 * don't check setuid() return code. Here we additionally recheck
1960 * whether NPROC limit is still exceeded.
1961 */
1962 if ((current->flags & PF_NPROC_EXCEEDED) &&
1963 is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
1964 retval = -EAGAIN;
1965 goto out_ret;
1966 }
1967
1968 /* We're below the limit (still or again), so we don't want to make
1969 * further execve() calls fail. */
1970 current->flags &= ~PF_NPROC_EXCEEDED;
1971
1972 bprm = alloc_bprm(fd, filename, flags);
1973 if (IS_ERR(bprm)) {
1974 retval = PTR_ERR(bprm);
1975 goto out_ret;
1976 }
1977
1978 retval = count(argv, MAX_ARG_STRINGS);
1979 if (retval == 0)
1980 pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
1981 current->comm, bprm->filename);
1982 if (retval < 0)
1983 goto out_free;
1984 bprm->argc = retval;
1985
1986 retval = count(envp, MAX_ARG_STRINGS);
1987 if (retval < 0)
1988 goto out_free;
1989 bprm->envc = retval;
1990
1991 retval = bprm_stack_limits(bprm);
1992 if (retval < 0)
1993 goto out_free;
1994
1995 retval = copy_string_kernel(bprm->filename, bprm);
1996 if (retval < 0)
1997 goto out_free;
1998 bprm->exec = bprm->p;
1999
2000 retval = copy_strings(bprm->envc, envp, bprm);
2001 if (retval < 0)
2002 goto out_free;
2003
2004 retval = copy_strings(bprm->argc, argv, bprm);
2005 if (retval < 0)
2006 goto out_free;
2007
2008 /*
2009 * When argv is empty, add an empty string ("") as argv[0] to
2010 * ensure confused userspace programs that start processing
2011 * from argv[1] won't end up walking envp. See also
2012 * bprm_stack_limits().
2013 */
2014 if (bprm->argc == 0) {
2015 retval = copy_string_kernel("", bprm);
2016 if (retval < 0)
2017 goto out_free;
2018 bprm->argc = 1;
2019 }
2020
2021 retval = bprm_execve(bprm);
2022 out_free:
2023 free_bprm(bprm);
2024
2025 out_ret:
2026 putname(filename);
2027 return retval;
2028 }
2029
2030 int kernel_execve(const char *kernel_filename,
2031 const char *const *argv, const char *const *envp)
2032 {
2033 struct filename *filename;
2034 struct linux_binprm *bprm;
2035 int fd = AT_FDCWD;
2036 int retval;
2037
2038 /* It is non-sense for kernel threads to call execve */
2039 if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
2040 return -EINVAL;
2041
2042 filename = getname_kernel(kernel_filename);
2043 if (IS_ERR(filename))
2044 return PTR_ERR(filename);
2045
2046 bprm = alloc_bprm(fd, filename, 0);
2047 if (IS_ERR(bprm)) {
2048 retval = PTR_ERR(bprm);
2049 goto out_ret;
2050 }
2051
2052 retval = count_strings_kernel(argv);
2053 if (WARN_ON_ONCE(retval == 0))
2054 retval = -EINVAL;
2055 if (retval < 0)
2056 goto out_free;
2057 bprm->argc = retval;
2058
2059 retval = count_strings_kernel(envp);
2060 if (retval < 0)
2061 goto out_free;
2062 bprm->envc = retval;
2063
2064 retval = bprm_stack_limits(bprm);
2065 if (retval < 0)
2066 goto out_free;
2067
2068 retval = copy_string_kernel(bprm->filename, bprm);
2069 if (retval < 0)
2070 goto out_free;
2071 bprm->exec = bprm->p;
2072
2073 retval = copy_strings_kernel(bprm->envc, envp, bprm);
2074 if (retval < 0)
2075 goto out_free;
2076
2077 retval = copy_strings_kernel(bprm->argc, argv, bprm);
2078 if (retval < 0)
2079 goto out_free;
2080
2081 retval = bprm_execve(bprm);
2082 out_free:
2083 free_bprm(bprm);
2084 out_ret:
2085 putname(filename);
2086 return retval;
2087 }
2088
2089 static int do_execve(struct filename *filename,
2090 const char __user *const __user *__argv,
2091 const char __user *const __user *__envp)
2092 {
2093 struct user_arg_ptr argv = { .ptr.native = __argv };
2094 struct user_arg_ptr envp = { .ptr.native = __envp };
2095 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2096 }
2097
2098 static int do_execveat(int fd, struct filename *filename,
2099 const char __user *const __user *__argv,
2100 const char __user *const __user *__envp,
2101 int flags)
2102 {
2103 struct user_arg_ptr argv = { .ptr.native = __argv };
2104 struct user_arg_ptr envp = { .ptr.native = __envp };
2105
2106 return do_execveat_common(fd, filename, argv, envp, flags);
2107 }
2108
2109 #ifdef CONFIG_COMPAT
2110 static int compat_do_execve(struct filename *filename,
2111 const compat_uptr_t __user *__argv,
2112 const compat_uptr_t __user *__envp)
2113 {
2114 struct user_arg_ptr argv = {
2115 .is_compat = true,
2116 .ptr.compat = __argv,
2117 };
2118 struct user_arg_ptr envp = {
2119 .is_compat = true,
2120 .ptr.compat = __envp,
2121 };
2122 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2123 }
2124
2125 static int compat_do_execveat(int fd, struct filename *filename,
2126 const compat_uptr_t __user *__argv,
2127 const compat_uptr_t __user *__envp,
2128 int flags)
2129 {
2130 struct user_arg_ptr argv = {
2131 .is_compat = true,
2132 .ptr.compat = __argv,
2133 };
2134 struct user_arg_ptr envp = {
2135 .is_compat = true,
2136 .ptr.compat = __envp,
2137 };
2138 return do_execveat_common(fd, filename, argv, envp, flags);
2139 }
2140 #endif
2141
2142 void set_binfmt(struct linux_binfmt *new)
2143 {
2144 struct mm_struct *mm = current->mm;
2145
2146 if (mm->binfmt)
2147 module_put(mm->binfmt->module);
2148
2149 mm->binfmt = new;
2150 if (new)
2151 __module_get(new->module);
2152 }
2153 EXPORT_SYMBOL(set_binfmt);
2154
2155 /*
2156 * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
2157 */
2158 void set_dumpable(struct mm_struct *mm, int value)
2159 {
2160 if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))
2161 return;
2162
2163 set_mask_bits(&mm->flags, MMF_DUMPABLE_MASK, value);
2164 }
2165
2166 SYSCALL_DEFINE3(execve,
2167 const char __user *, filename,
2168 const char __user *const __user *, argv,
2169 const char __user *const __user *, envp)
2170 {
2171 return do_execve(getname(filename), argv, envp);
2172 }
2173
2174 SYSCALL_DEFINE5(execveat,
2175 int, fd, const char __user *, filename,
2176 const char __user *const __user *, argv,
2177 const char __user *const __user *, envp,
2178 int, flags)
2179 {
2180 return do_execveat(fd,
2181 getname_uflags(filename, flags),
2182 argv, envp, flags);
2183 }
2184
2185 #ifdef CONFIG_COMPAT
2186 COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
2187 const compat_uptr_t __user *, argv,
2188 const compat_uptr_t __user *, envp)
2189 {
2190 return compat_do_execve(getname(filename), argv, envp);
2191 }
2192
2193 COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
2194 const char __user *, filename,
2195 const compat_uptr_t __user *, argv,
2196 const compat_uptr_t __user *, envp,
2197 int, flags)
2198 {
2199 return compat_do_execveat(fd,
2200 getname_uflags(filename, flags),
2201 argv, envp, flags);
2202 }
2203 #endif
2204
2205 #ifdef CONFIG_SYSCTL
2206
2207 static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int write,
2208 void *buffer, size_t *lenp, loff_t *ppos)
2209 {
2210 int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
2211
2212 if (!error)
2213 validate_coredump_safety();
2214 return error;
2215 }
2216
2217 static struct ctl_table fs_exec_sysctls[] = {
2218 {
2219 .procname = "suid_dumpable",
2220 .data = &suid_dumpable,
2221 .maxlen = sizeof(int),
2222 .mode = 0644,
2223 .proc_handler = proc_dointvec_minmax_coredump,
2224 .extra1 = SYSCTL_ZERO,
2225 .extra2 = SYSCTL_TWO,
2226 },
2227 };
2228
2229 static int __init init_fs_exec_sysctls(void)
2230 {
2231 register_sysctl_init("fs", fs_exec_sysctls);
2232 return 0;
2233 }
2234
2235 fs_initcall(init_fs_exec_sysctls);
2236 #endif /* CONFIG_SYSCTL */
2237
2238 #ifdef CONFIG_EXEC_KUNIT_TEST
2239 #include "tests/exec_kunit.c"
2240 #endif
2241
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.