linux/fs/binfmt_misc.c
<<
>>
Prefs
   1/*
   2 *  binfmt_misc.c
   3 *
   4 *  Copyright (C) 1997 Richard G√ľnther
   5 *
   6 *  binfmt_misc detects binaries via a magic or filename extension and invokes
   7 *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
   8 *  binfmt_mz.
   9 *
  10 *  1997-04-25 first version
  11 *  [...]
  12 *  1997-05-19 cleanup
  13 *  1997-06-26 hpa: pass the real filename rather than argv[0]
  14 *  1997-06-30 minor cleanup
  15 *  1997-08-09 removed extension stripping, locking cleanup
  16 *  2001-02-28 AV: rewritten into something that resembles C. Original didn't.
  17 */
  18
  19#include <linux/module.h>
  20#include <linux/init.h>
  21#include <linux/sched.h>
  22#include <linux/binfmts.h>
  23#include <linux/slab.h>
  24#include <linux/ctype.h>
  25#include <linux/file.h>
  26#include <linux/pagemap.h>
  27#include <linux/namei.h>
  28#include <linux/mount.h>
  29#include <linux/syscalls.h>
  30#include <linux/fs.h>
  31
  32#include <asm/uaccess.h>
  33
  34enum {
  35        VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
  36};
  37
  38static LIST_HEAD(entries);
  39static int enabled = 1;
  40
  41enum {Enabled, Magic};
  42#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
  43#define MISC_FMT_OPEN_BINARY (1<<30)
  44#define MISC_FMT_CREDENTIALS (1<<29)
  45
  46typedef struct {
  47        struct list_head list;
  48        unsigned long flags;            /* type, status, etc. */
  49        int offset;                     /* offset of magic */
  50        int size;                       /* size of magic/mask */
  51        char *magic;                    /* magic or filename extension */
  52        char *mask;                     /* mask, NULL for exact match */
  53        char *interpreter;              /* filename of interpreter */
  54        char *name;
  55        struct dentry *dentry;
  56} Node;
  57
  58static DEFINE_RWLOCK(entries_lock);
  59static struct file_system_type bm_fs_type;
  60static struct vfsmount *bm_mnt;
  61static int entry_count;
  62
  63/* 
  64 * Check if we support the binfmt
  65 * if we do, return the node, else NULL
  66 * locking is done in load_misc_binary
  67 */
  68static Node *check_file(struct linux_binprm *bprm)
  69{
  70        char *p = strrchr(bprm->interp, '.');
  71        struct list_head *l;
  72
  73        list_for_each(l, &entries) {
  74                Node *e = list_entry(l, Node, list);
  75                char *s;
  76                int j;
  77
  78                if (!test_bit(Enabled, &e->flags))
  79                        continue;
  80
  81                if (!test_bit(Magic, &e->flags)) {
  82                        if (p && !strcmp(e->magic, p + 1))
  83                                return e;
  84                        continue;
  85                }
  86
  87                s = bprm->buf + e->offset;
  88                if (e->mask) {
  89                        for (j = 0; j < e->size; j++)
  90                                if ((*s++ ^ e->magic[j]) & e->mask[j])
  91                                        break;
  92                } else {
  93                        for (j = 0; j < e->size; j++)
  94                                if ((*s++ ^ e->magic[j]))
  95                                        break;
  96                }
  97                if (j == e->size)
  98                        return e;
  99        }
 100        return NULL;
 101}
 102
 103/*
 104 * the loader itself
 105 */
 106static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 107{
 108        Node *fmt;
 109        struct file * interp_file = NULL;
 110        char iname[BINPRM_BUF_SIZE];
 111        const char *iname_addr = iname;
 112        int retval;
 113        int fd_binary = -1;
 114
 115        retval = -ENOEXEC;
 116        if (!enabled)
 117                goto _ret;
 118
 119        retval = -ENOEXEC;
 120        if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
 121                goto _ret;
 122
 123        /* to keep locking time low, we copy the interpreter string */
 124        read_lock(&entries_lock);
 125        fmt = check_file(bprm);
 126        if (fmt)
 127                strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
 128        read_unlock(&entries_lock);
 129        if (!fmt)
 130                goto _ret;
 131
 132        if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
 133                retval = remove_arg_zero(bprm);
 134                if (retval)
 135                        goto _ret;
 136        }
 137
 138        if (fmt->flags & MISC_FMT_OPEN_BINARY) {
 139
 140                /* if the binary should be opened on behalf of the
 141                 * interpreter than keep it open and assign descriptor
 142                 * to it */
 143                fd_binary = get_unused_fd();
 144                if (fd_binary < 0) {
 145                        retval = fd_binary;
 146                        goto _ret;
 147                }
 148                fd_install(fd_binary, bprm->file);
 149
 150                /* if the binary is not readable than enforce mm->dumpable=0
 151                   regardless of the interpreter's permissions */
 152                would_dump(bprm, bprm->file);
 153
 154                allow_write_access(bprm->file);
 155                bprm->file = NULL;
 156
 157                /* mark the bprm that fd should be passed to interp */
 158                bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
 159                bprm->interp_data = fd_binary;
 160
 161        } else {
 162                allow_write_access(bprm->file);
 163                fput(bprm->file);
 164                bprm->file = NULL;
 165        }
 166        /* make argv[1] be the path to the binary */
 167        retval = copy_strings_kernel (1, &bprm->interp, bprm);
 168        if (retval < 0)
 169                goto _error;
 170        bprm->argc++;
 171
 172        /* add the interp as argv[0] */
 173        retval = copy_strings_kernel (1, &iname_addr, bprm);
 174        if (retval < 0)
 175                goto _error;
 176        bprm->argc ++;
 177
 178        bprm->interp = iname;   /* for binfmt_script */
 179
 180        interp_file = open_exec (iname);
 181        retval = PTR_ERR (interp_file);
 182        if (IS_ERR (interp_file))
 183                goto _error;
 184
 185        bprm->file = interp_file;
 186        if (fmt->flags & MISC_FMT_CREDENTIALS) {
 187                /*
 188                 * No need to call prepare_binprm(), it's already been
 189                 * done.  bprm->buf is stale, update from interp_file.
 190                 */
 191                memset(bprm->buf, 0, BINPRM_BUF_SIZE);
 192                retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
 193        } else
 194                retval = prepare_binprm (bprm);
 195
 196        if (retval < 0)
 197                goto _error;
 198
 199        bprm->recursion_depth++;
 200
 201        retval = search_binary_handler (bprm, regs);
 202        if (retval < 0)
 203                goto _error;
 204
 205_ret:
 206        return retval;
 207_error:
 208        if (fd_binary > 0)
 209                sys_close(fd_binary);
 210        bprm->interp_flags = 0;
 211        bprm->interp_data = 0;
 212        goto _ret;
 213}
 214
 215/* Command parsers */
 216
 217/*
 218 * parses and copies one argument enclosed in del from *sp to *dp,
 219 * recognising the \x special.
 220 * returns pointer to the copied argument or NULL in case of an
 221 * error (and sets err) or null argument length.
 222 */
 223static char *scanarg(char *s, char del)
 224{
 225        char c;
 226
 227        while ((c = *s++) != del) {
 228                if (c == '\\' && *s == 'x') {
 229                        s++;
 230                        if (!isxdigit(*s++))
 231                                return NULL;
 232                        if (!isxdigit(*s++))
 233                                return NULL;
 234                }
 235        }
 236        return s;
 237}
 238
 239static int unquote(char *from)
 240{
 241        char c = 0, *s = from, *p = from;
 242
 243        while ((c = *s++) != '\0') {
 244                if (c == '\\' && *s == 'x') {
 245                        s++;
 246                        c = toupper(*s++);
 247                        *p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
 248                        c = toupper(*s++);
 249                        *p++ |= c - (isdigit(c) ? '0' : 'A' - 10);
 250                        continue;
 251                }
 252                *p++ = c;
 253        }
 254        return p - from;
 255}
 256
 257static char * check_special_flags (char * sfs, Node * e)
 258{
 259        char * p = sfs;
 260        int cont = 1;
 261
 262        /* special flags */
 263        while (cont) {
 264                switch (*p) {
 265                        case 'P':
 266                                p++;
 267                                e->flags |= MISC_FMT_PRESERVE_ARGV0;
 268                                break;
 269                        case 'O':
 270                                p++;
 271                                e->flags |= MISC_FMT_OPEN_BINARY;
 272                                break;
 273                        case 'C':
 274                                p++;
 275                                /* this flags also implies the
 276                                   open-binary flag */
 277                                e->flags |= (MISC_FMT_CREDENTIALS |
 278                                                MISC_FMT_OPEN_BINARY);
 279                                break;
 280                        default:
 281                                cont = 0;
 282                }
 283        }
 284
 285        return p;
 286}
 287/*
 288 * This registers a new binary format, it recognises the syntax
 289 * ':name:type:offset:magic:mask:interpreter:flags'
 290 * where the ':' is the IFS, that can be chosen with the first char
 291 */
 292static Node *create_entry(const char __user *buffer, size_t count)
 293{
 294        Node *e;
 295        int memsize, err;
 296        char *buf, *p;
 297        char del;
 298
 299        /* some sanity checks */
 300        err = -EINVAL;
 301        if ((count < 11) || (count > 256))
 302                goto out;
 303
 304        err = -ENOMEM;
 305        memsize = sizeof(Node) + count + 8;
 306        e = kmalloc(memsize, GFP_USER);
 307        if (!e)
 308                goto out;
 309
 310        p = buf = (char *)e + sizeof(Node);
 311
 312        memset(e, 0, sizeof(Node));
 313        if (copy_from_user(buf, buffer, count))
 314                goto Efault;
 315
 316        del = *p++;     /* delimeter */
 317
 318        memset(buf+count, del, 8);
 319
 320        e->name = p;
 321        p = strchr(p, del);
 322        if (!p)
 323                goto Einval;
 324        *p++ = '\0';
 325        if (!e->name[0] ||
 326            !strcmp(e->name, ".") ||
 327            !strcmp(e->name, "..") ||
 328            strchr(e->name, '/'))
 329                goto Einval;
 330        switch (*p++) {
 331                case 'E': e->flags = 1<<Enabled; break;
 332                case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
 333                default: goto Einval;
 334        }
 335        if (*p++ != del)
 336                goto Einval;
 337        if (test_bit(Magic, &e->flags)) {
 338                char *s = strchr(p, del);
 339                if (!s)
 340                        goto Einval;
 341                *s++ = '\0';
 342                e->offset = simple_strtoul(p, &p, 10);
 343                if (*p++)
 344                        goto Einval;
 345                e->magic = p;
 346                p = scanarg(p, del);
 347                if (!p)
 348                        goto Einval;
 349                p[-1] = '\0';
 350                if (!e->magic[0])
 351                        goto Einval;
 352                e->mask = p;
 353                p = scanarg(p, del);
 354                if (!p)
 355                        goto Einval;
 356                p[-1] = '\0';
 357                if (!e->mask[0])
 358                        e->mask = NULL;
 359                e->size = unquote(e->magic);
 360                if (e->mask && unquote(e->mask) != e->size)
 361                        goto Einval;
 362                if (e->size + e->offset > BINPRM_BUF_SIZE)
 363                        goto Einval;
 364        } else {
 365                p = strchr(p, del);
 366                if (!p)
 367                        goto Einval;
 368                *p++ = '\0';
 369                e->magic = p;
 370                p = strchr(p, del);
 371                if (!p)
 372                        goto Einval;
 373                *p++ = '\0';
 374                if (!e->magic[0] || strchr(e->magic, '/'))
 375                        goto Einval;
 376                p = strchr(p, del);
 377                if (!p)
 378                        goto Einval;
 379                *p++ = '\0';
 380        }
 381        e->interpreter = p;
 382        p = strchr(p, del);
 383        if (!p)
 384                goto Einval;
 385        *p++ = '\0';
 386        if (!e->interpreter[0])
 387                goto Einval;
 388
 389
 390        p = check_special_flags (p, e);
 391
 392        if (*p == '\n')
 393                p++;
 394        if (p != buf + count)
 395                goto Einval;
 396        return e;
 397
 398out:
 399        return ERR_PTR(err);
 400
 401Efault:
 402        kfree(e);
 403        return ERR_PTR(-EFAULT);
 404Einval:
 405        kfree(e);
 406        return ERR_PTR(-EINVAL);
 407}
 408
 409/*
 410 * Set status of entry/binfmt_misc:
 411 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc
 412 */
 413static int parse_command(const char __user *buffer, size_t count)
 414{
 415        char s[4];
 416
 417        if (!count)
 418                return 0;
 419        if (count > 3)
 420                return -EINVAL;
 421        if (copy_from_user(s, buffer, count))
 422                return -EFAULT;
 423        if (s[count-1] == '\n')
 424                count--;
 425        if (count == 1 && s[0] == '0')
 426                return 1;
 427        if (count == 1 && s[0] == '1')
 428                return 2;
 429        if (count == 2 && s[0] == '-' && s[1] == '1')
 430                return 3;
 431        return -EINVAL;
 432}
 433
 434/* generic stuff */
 435
 436static void entry_status(Node *e, char *page)
 437{
 438        char *dp;
 439        char *status = "disabled";
 440        const char * flags = "flags: ";
 441
 442        if (test_bit(Enabled, &e->flags))
 443                status = "enabled";
 444
 445        if (!VERBOSE_STATUS) {
 446                sprintf(page, "%s\n", status);
 447                return;
 448        }
 449
 450        sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
 451        dp = page + strlen(page);
 452
 453        /* print the special flags */
 454        sprintf (dp, "%s", flags);
 455        dp += strlen (flags);
 456        if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
 457                *dp ++ = 'P';
 458        }
 459        if (e->flags & MISC_FMT_OPEN_BINARY) {
 460                *dp ++ = 'O';
 461        }
 462        if (e->flags & MISC_FMT_CREDENTIALS) {
 463                *dp ++ = 'C';
 464        }
 465        *dp ++ = '\n';
 466
 467
 468        if (!test_bit(Magic, &e->flags)) {
 469                sprintf(dp, "extension .%s\n", e->magic);
 470        } else {
 471                int i;
 472
 473                sprintf(dp, "offset %i\nmagic ", e->offset);
 474                dp = page + strlen(page);
 475                for (i = 0; i < e->size; i++) {
 476                        sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
 477                        dp += 2;
 478                }
 479                if (e->mask) {
 480                        sprintf(dp, "\nmask ");
 481                        dp += 6;
 482                        for (i = 0; i < e->size; i++) {
 483                                sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
 484                                dp += 2;
 485                        }
 486                }
 487                *dp++ = '\n';
 488                *dp = '\0';
 489        }
 490}
 491
 492static struct inode *bm_get_inode(struct super_block *sb, int mode)
 493{
 494        struct inode * inode = new_inode(sb);
 495
 496        if (inode) {
 497                inode->i_ino = get_next_ino();
 498                inode->i_mode = mode;
 499                inode->i_atime = inode->i_mtime = inode->i_ctime =
 500                        current_fs_time(inode->i_sb);
 501        }
 502        return inode;
 503}
 504
 505static void bm_evict_inode(struct inode *inode)
 506{
 507        end_writeback(inode);
 508        kfree(inode->i_private);
 509}
 510
 511static void kill_node(Node *e)
 512{
 513        struct dentry *dentry;
 514
 515        write_lock(&entries_lock);
 516        dentry = e->dentry;
 517        if (dentry) {
 518                list_del_init(&e->list);
 519                e->dentry = NULL;
 520        }
 521        write_unlock(&entries_lock);
 522
 523        if (dentry) {
 524                dentry->d_inode->i_nlink--;
 525                d_drop(dentry);
 526                dput(dentry);
 527                simple_release_fs(&bm_mnt, &entry_count);
 528        }
 529}
 530
 531/* /<entry> */
 532
 533static ssize_t
 534bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
 535{
 536        Node *e = file->f_path.dentry->d_inode->i_private;
 537        ssize_t res;
 538        char *page;
 539
 540        if (!(page = (char*) __get_free_page(GFP_KERNEL)))
 541                return -ENOMEM;
 542
 543        entry_status(e, page);
 544
 545        res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));
 546
 547        free_page((unsigned long) page);
 548        return res;
 549}
 550
 551static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
 552                                size_t count, loff_t *ppos)
 553{
 554        struct dentry *root;
 555        Node *e = file->f_path.dentry->d_inode->i_private;
 556        int res = parse_command(buffer, count);
 557
 558        switch (res) {
 559                case 1: clear_bit(Enabled, &e->flags);
 560                        break;
 561                case 2: set_bit(Enabled, &e->flags);
 562                        break;
 563                case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
 564                        mutex_lock(&root->d_inode->i_mutex);
 565
 566                        kill_node(e);
 567
 568                        mutex_unlock(&root->d_inode->i_mutex);
 569                        dput(root);
 570                        break;
 571                default: return res;
 572        }
 573        return count;
 574}
 575
 576static const struct file_operations bm_entry_operations = {
 577        .read           = bm_entry_read,
 578        .write          = bm_entry_write,
 579        .llseek         = default_llseek,
 580};
 581
 582/* /register */
 583
 584static ssize_t bm_register_write(struct file *file, const char __user *buffer,
 585                               size_t count, loff_t *ppos)
 586{
 587        Node *e;
 588        struct inode *inode;
 589        struct dentry *root, *dentry;
 590        struct super_block *sb = file->f_path.mnt->mnt_sb;
 591        int err = 0;
 592
 593        e = create_entry(buffer, count);
 594
 595        if (IS_ERR(e))
 596                return PTR_ERR(e);
 597
 598        root = dget(sb->s_root);
 599        mutex_lock(&root->d_inode->i_mutex);
 600        dentry = lookup_one_len(e->name, root, strlen(e->name));
 601        err = PTR_ERR(dentry);
 602        if (IS_ERR(dentry))
 603                goto out;
 604
 605        err = -EEXIST;
 606        if (dentry->d_inode)
 607                goto out2;
 608
 609        inode = bm_get_inode(sb, S_IFREG | 0644);
 610
 611        err = -ENOMEM;
 612        if (!inode)
 613                goto out2;
 614
 615        err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
 616        if (err) {
 617                iput(inode);
 618                inode = NULL;
 619                goto out2;
 620        }
 621
 622        e->dentry = dget(dentry);
 623        inode->i_private = e;
 624        inode->i_fop = &bm_entry_operations;
 625
 626        d_instantiate(dentry, inode);
 627        write_lock(&entries_lock);
 628        list_add(&e->list, &entries);
 629        write_unlock(&entries_lock);
 630
 631        err = 0;
 632out2:
 633        dput(dentry);
 634out:
 635        mutex_unlock(&root->d_inode->i_mutex);
 636        dput(root);
 637
 638        if (err) {
 639                kfree(e);
 640                return -EINVAL;
 641        }
 642        return count;
 643}
 644
 645static const struct file_operations bm_register_operations = {
 646        .write          = bm_register_write,
 647        .llseek         = noop_llseek,
 648};
 649
 650/* /status */
 651
 652static ssize_t
 653bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
 654{
 655        char *s = enabled ? "enabled\n" : "disabled\n";
 656
 657        return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
 658}
 659
 660static ssize_t bm_status_write(struct file * file, const char __user * buffer,
 661                size_t count, loff_t *ppos)
 662{
 663        int res = parse_command(buffer, count);
 664        struct dentry *root;
 665
 666        switch (res) {
 667                case 1: enabled = 0; break;
 668                case 2: enabled = 1; break;
 669                case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
 670                        mutex_lock(&root->d_inode->i_mutex);
 671
 672                        while (!list_empty(&entries))
 673                                kill_node(list_entry(entries.next, Node, list));
 674
 675                        mutex_unlock(&root->d_inode->i_mutex);
 676                        dput(root);
 677                default: return res;
 678        }
 679        return count;
 680}
 681
 682static const struct file_operations bm_status_operations = {
 683        .read           = bm_status_read,
 684        .write          = bm_status_write,
 685        .llseek         = default_llseek,
 686};
 687
 688/* Superblock handling */
 689
 690static const struct super_operations s_ops = {
 691        .statfs         = simple_statfs,
 692        .evict_inode    = bm_evict_inode,
 693};
 694
 695static int bm_fill_super(struct super_block * sb, void * data, int silent)
 696{
 697        static struct tree_descr bm_files[] = {
 698                [2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
 699                [3] = {"register", &bm_register_operations, S_IWUSR},
 700                /* last one */ {""}
 701        };
 702        int err = simple_fill_super(sb, 0x42494e4d, bm_files);
 703        if (!err)
 704                sb->s_op = &s_ops;
 705        return err;
 706}
 707
 708static struct dentry *bm_mount(struct file_system_type *fs_type,
 709        int flags, const char *dev_name, void *data)
 710{
 711        return mount_single(fs_type, flags, data, bm_fill_super);
 712}
 713
 714static struct linux_binfmt misc_format = {
 715        .module = THIS_MODULE,
 716        .load_binary = load_misc_binary,
 717};
 718
 719static struct file_system_type bm_fs_type = {
 720        .owner          = THIS_MODULE,
 721        .name           = "binfmt_misc",
 722        .mount          = bm_mount,
 723        .kill_sb        = kill_litter_super,
 724};
 725
 726static int __init init_misc_binfmt(void)
 727{
 728        int err = register_filesystem(&bm_fs_type);
 729        if (!err) {
 730                err = insert_binfmt(&misc_format);
 731                if (err)
 732                        unregister_filesystem(&bm_fs_type);
 733        }
 734        return err;
 735}
 736
 737static void __exit exit_misc_binfmt(void)
 738{
 739        unregister_binfmt(&misc_format);
 740        unregister_filesystem(&bm_fs_type);
 741}
 742
 743core_initcall(init_misc_binfmt);
 744module_exit(exit_misc_binfmt);
 745MODULE_LICENSE("GPL");
 746
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.