linux/fs/binfmt_misc.c
<<
>>
Prefs
   1/*
   2 *  binfmt_misc.c
   3 *
   4 *  Copyright (C) 1997 Richard G√ľnther
   5 *
   6 *  binfmt_misc detects binaries via a magic or filename extension and invokes
   7 *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
   8 *  binfmt_mz.
   9 *
  10 *  1997-04-25 first version
  11 *  [...]
  12 *  1997-05-19 cleanup
  13 *  1997-06-26 hpa: pass the real filename rather than argv[0]
  14 *  1997-06-30 minor cleanup
  15 *  1997-08-09 removed extension stripping, locking cleanup
  16 *  2001-02-28 AV: rewritten into something that resembles C. Original didn't.
  17 */
  18
  19#include <linux/module.h>
  20#include <linux/init.h>
  21#include <linux/sched.h>
  22#include <linux/magic.h>
  23#include <linux/binfmts.h>
  24#include <linux/slab.h>
  25#include <linux/ctype.h>
  26#include <linux/file.h>
  27#include <linux/pagemap.h>
  28#include <linux/namei.h>
  29#include <linux/mount.h>
  30#include <linux/syscalls.h>
  31#include <linux/fs.h>
  32
  33#include <asm/uaccess.h>
  34
  35enum {
  36        VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
  37};
  38
  39static LIST_HEAD(entries);
  40static int enabled = 1;
  41
  42enum {Enabled, Magic};
  43#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
  44#define MISC_FMT_OPEN_BINARY (1<<30)
  45#define MISC_FMT_CREDENTIALS (1<<29)
  46
  47typedef struct {
  48        struct list_head list;
  49        unsigned long flags;            /* type, status, etc. */
  50        int offset;                     /* offset of magic */
  51        int size;                       /* size of magic/mask */
  52        char *magic;                    /* magic or filename extension */
  53        char *mask;                     /* mask, NULL for exact match */
  54        char *interpreter;              /* filename of interpreter */
  55        char *name;
  56        struct dentry *dentry;
  57} Node;
  58
  59static DEFINE_RWLOCK(entries_lock);
  60static struct file_system_type bm_fs_type;
  61static struct vfsmount *bm_mnt;
  62static int entry_count;
  63
  64/* 
  65 * Check if we support the binfmt
  66 * if we do, return the node, else NULL
  67 * locking is done in load_misc_binary
  68 */
  69static Node *check_file(struct linux_binprm *bprm)
  70{
  71        char *p = strrchr(bprm->interp, '.');
  72        struct list_head *l;
  73
  74        list_for_each(l, &entries) {
  75                Node *e = list_entry(l, Node, list);
  76                char *s;
  77                int j;
  78
  79                if (!test_bit(Enabled, &e->flags))
  80                        continue;
  81
  82                if (!test_bit(Magic, &e->flags)) {
  83                        if (p && !strcmp(e->magic, p + 1))
  84                                return e;
  85                        continue;
  86                }
  87
  88                s = bprm->buf + e->offset;
  89                if (e->mask) {
  90                        for (j = 0; j < e->size; j++)
  91                                if ((*s++ ^ e->magic[j]) & e->mask[j])
  92                                        break;
  93                } else {
  94                        for (j = 0; j < e->size; j++)
  95                                if ((*s++ ^ e->magic[j]))
  96                                        break;
  97                }
  98                if (j == e->size)
  99                        return e;
 100        }
 101        return NULL;
 102}
 103
 104/*
 105 * the loader itself
 106 */
 107static int load_misc_binary(struct linux_binprm *bprm)
 108{
 109        Node *fmt;
 110        struct file * interp_file = NULL;
 111        char iname[BINPRM_BUF_SIZE];
 112        const char *iname_addr = iname;
 113        int retval;
 114        int fd_binary = -1;
 115
 116        retval = -ENOEXEC;
 117        if (!enabled)
 118                goto _ret;
 119
 120        /* to keep locking time low, we copy the interpreter string */
 121        read_lock(&entries_lock);
 122        fmt = check_file(bprm);
 123        if (fmt)
 124                strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
 125        read_unlock(&entries_lock);
 126        if (!fmt)
 127                goto _ret;
 128
 129        if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
 130                retval = remove_arg_zero(bprm);
 131                if (retval)
 132                        goto _ret;
 133        }
 134
 135        if (fmt->flags & MISC_FMT_OPEN_BINARY) {
 136
 137                /* if the binary should be opened on behalf of the
 138                 * interpreter than keep it open and assign descriptor
 139                 * to it */
 140                fd_binary = get_unused_fd();
 141                if (fd_binary < 0) {
 142                        retval = fd_binary;
 143                        goto _ret;
 144                }
 145                fd_install(fd_binary, bprm->file);
 146
 147                /* if the binary is not readable than enforce mm->dumpable=0
 148                   regardless of the interpreter's permissions */
 149                would_dump(bprm, bprm->file);
 150
 151                allow_write_access(bprm->file);
 152                bprm->file = NULL;
 153
 154                /* mark the bprm that fd should be passed to interp */
 155                bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
 156                bprm->interp_data = fd_binary;
 157
 158        } else {
 159                allow_write_access(bprm->file);
 160                fput(bprm->file);
 161                bprm->file = NULL;
 162        }
 163        /* make argv[1] be the path to the binary */
 164        retval = copy_strings_kernel (1, &bprm->interp, bprm);
 165        if (retval < 0)
 166                goto _error;
 167        bprm->argc++;
 168
 169        /* add the interp as argv[0] */
 170        retval = copy_strings_kernel (1, &iname_addr, bprm);
 171        if (retval < 0)
 172                goto _error;
 173        bprm->argc ++;
 174
 175        /* Update interp in case binfmt_script needs it. */
 176        retval = bprm_change_interp(iname, bprm);
 177        if (retval < 0)
 178                goto _error;
 179
 180        interp_file = open_exec (iname);
 181        retval = PTR_ERR (interp_file);
 182        if (IS_ERR (interp_file))
 183                goto _error;
 184
 185        bprm->file = interp_file;
 186        if (fmt->flags & MISC_FMT_CREDENTIALS) {
 187                /*
 188                 * No need to call prepare_binprm(), it's already been
 189                 * done.  bprm->buf is stale, update from interp_file.
 190                 */
 191                memset(bprm->buf, 0, BINPRM_BUF_SIZE);
 192                retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
 193        } else
 194                retval = prepare_binprm (bprm);
 195
 196        if (retval < 0)
 197                goto _error;
 198
 199        retval = search_binary_handler(bprm);
 200        if (retval < 0)
 201                goto _error;
 202
 203_ret:
 204        return retval;
 205_error:
 206        if (fd_binary > 0)
 207                sys_close(fd_binary);
 208        bprm->interp_flags = 0;
 209        bprm->interp_data = 0;
 210        goto _ret;
 211}
 212
 213/* Command parsers */
 214
 215/*
 216 * parses and copies one argument enclosed in del from *sp to *dp,
 217 * recognising the \x special.
 218 * returns pointer to the copied argument or NULL in case of an
 219 * error (and sets err) or null argument length.
 220 */
 221static char *scanarg(char *s, char del)
 222{
 223        char c;
 224
 225        while ((c = *s++) != del) {
 226                if (c == '\\' && *s == 'x') {
 227                        s++;
 228                        if (!isxdigit(*s++))
 229                                return NULL;
 230                        if (!isxdigit(*s++))
 231                                return NULL;
 232                }
 233        }
 234        return s;
 235}
 236
 237static int unquote(char *from)
 238{
 239        char c = 0, *s = from, *p = from;
 240
 241        while ((c = *s++) != '\0') {
 242                if (c == '\\' && *s == 'x') {
 243                        s++;
 244                        c = toupper(*s++);
 245                        *p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
 246                        c = toupper(*s++);
 247                        *p++ |= c - (isdigit(c) ? '0' : 'A' - 10);
 248                        continue;
 249                }
 250                *p++ = c;
 251        }
 252        return p - from;
 253}
 254
 255static char * check_special_flags (char * sfs, Node * e)
 256{
 257        char * p = sfs;
 258        int cont = 1;
 259
 260        /* special flags */
 261        while (cont) {
 262                switch (*p) {
 263                        case 'P':
 264                                p++;
 265                                e->flags |= MISC_FMT_PRESERVE_ARGV0;
 266                                break;
 267                        case 'O':
 268                                p++;
 269                                e->flags |= MISC_FMT_OPEN_BINARY;
 270                                break;
 271                        case 'C':
 272                                p++;
 273                                /* this flags also implies the
 274                                   open-binary flag */
 275                                e->flags |= (MISC_FMT_CREDENTIALS |
 276                                                MISC_FMT_OPEN_BINARY);
 277                                break;
 278                        default:
 279                                cont = 0;
 280                }
 281        }
 282
 283        return p;
 284}
 285/*
 286 * This registers a new binary format, it recognises the syntax
 287 * ':name:type:offset:magic:mask:interpreter:flags'
 288 * where the ':' is the IFS, that can be chosen with the first char
 289 */
 290static Node *create_entry(const char __user *buffer, size_t count)
 291{
 292        Node *e;
 293        int memsize, err;
 294        char *buf, *p;
 295        char del;
 296
 297        /* some sanity checks */
 298        err = -EINVAL;
 299        if ((count < 11) || (count > 256))
 300                goto out;
 301
 302        err = -ENOMEM;
 303        memsize = sizeof(Node) + count + 8;
 304        e = kmalloc(memsize, GFP_USER);
 305        if (!e)
 306                goto out;
 307
 308        p = buf = (char *)e + sizeof(Node);
 309
 310        memset(e, 0, sizeof(Node));
 311        if (copy_from_user(buf, buffer, count))
 312                goto Efault;
 313
 314        del = *p++;     /* delimeter */
 315
 316        memset(buf+count, del, 8);
 317
 318        e->name = p;
 319        p = strchr(p, del);
 320        if (!p)
 321                goto Einval;
 322        *p++ = '\0';
 323        if (!e->name[0] ||
 324            !strcmp(e->name, ".") ||
 325            !strcmp(e->name, "..") ||
 326            strchr(e->name, '/'))
 327                goto Einval;
 328        switch (*p++) {
 329                case 'E': e->flags = 1<<Enabled; break;
 330                case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
 331                default: goto Einval;
 332        }
 333        if (*p++ != del)
 334                goto Einval;
 335        if (test_bit(Magic, &e->flags)) {
 336                char *s = strchr(p, del);
 337                if (!s)
 338                        goto Einval;
 339                *s++ = '\0';
 340                e->offset = simple_strtoul(p, &p, 10);
 341                if (*p++)
 342                        goto Einval;
 343                e->magic = p;
 344                p = scanarg(p, del);
 345                if (!p)
 346                        goto Einval;
 347                p[-1] = '\0';
 348                if (!e->magic[0])
 349                        goto Einval;
 350                e->mask = p;
 351                p = scanarg(p, del);
 352                if (!p)
 353                        goto Einval;
 354                p[-1] = '\0';
 355                if (!e->mask[0])
 356                        e->mask = NULL;
 357                e->size = unquote(e->magic);
 358                if (e->mask && unquote(e->mask) != e->size)
 359                        goto Einval;
 360                if (e->size + e->offset > BINPRM_BUF_SIZE)
 361                        goto Einval;
 362        } else {
 363                p = strchr(p, del);
 364                if (!p)
 365                        goto Einval;
 366                *p++ = '\0';
 367                e->magic = p;
 368                p = strchr(p, del);
 369                if (!p)
 370                        goto Einval;
 371                *p++ = '\0';
 372                if (!e->magic[0] || strchr(e->magic, '/'))
 373                        goto Einval;
 374                p = strchr(p, del);
 375                if (!p)
 376                        goto Einval;
 377                *p++ = '\0';
 378        }
 379        e->interpreter = p;
 380        p = strchr(p, del);
 381        if (!p)
 382                goto Einval;
 383        *p++ = '\0';
 384        if (!e->interpreter[0])
 385                goto Einval;
 386
 387
 388        p = check_special_flags (p, e);
 389
 390        if (*p == '\n')
 391                p++;
 392        if (p != buf + count)
 393                goto Einval;
 394        return e;
 395
 396out:
 397        return ERR_PTR(err);
 398
 399Efault:
 400        kfree(e);
 401        return ERR_PTR(-EFAULT);
 402Einval:
 403        kfree(e);
 404        return ERR_PTR(-EINVAL);
 405}
 406
 407/*
 408 * Set status of entry/binfmt_misc:
 409 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc
 410 */
 411static int parse_command(const char __user *buffer, size_t count)
 412{
 413        char s[4];
 414
 415        if (!count)
 416                return 0;
 417        if (count > 3)
 418                return -EINVAL;
 419        if (copy_from_user(s, buffer, count))
 420                return -EFAULT;
 421        if (s[count-1] == '\n')
 422                count--;
 423        if (count == 1 && s[0] == '0')
 424                return 1;
 425        if (count == 1 && s[0] == '1')
 426                return 2;
 427        if (count == 2 && s[0] == '-' && s[1] == '1')
 428                return 3;
 429        return -EINVAL;
 430}
 431
 432/* generic stuff */
 433
 434static void entry_status(Node *e, char *page)
 435{
 436        char *dp;
 437        char *status = "disabled";
 438        const char * flags = "flags: ";
 439
 440        if (test_bit(Enabled, &e->flags))
 441                status = "enabled";
 442
 443        if (!VERBOSE_STATUS) {
 444                sprintf(page, "%s\n", status);
 445                return;
 446        }
 447
 448        sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
 449        dp = page + strlen(page);
 450
 451        /* print the special flags */
 452        sprintf (dp, "%s", flags);
 453        dp += strlen (flags);
 454        if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
 455                *dp ++ = 'P';
 456        }
 457        if (e->flags & MISC_FMT_OPEN_BINARY) {
 458                *dp ++ = 'O';
 459        }
 460        if (e->flags & MISC_FMT_CREDENTIALS) {
 461                *dp ++ = 'C';
 462        }
 463        *dp ++ = '\n';
 464
 465
 466        if (!test_bit(Magic, &e->flags)) {
 467                sprintf(dp, "extension .%s\n", e->magic);
 468        } else {
 469                int i;
 470
 471                sprintf(dp, "offset %i\nmagic ", e->offset);
 472                dp = page + strlen(page);
 473                for (i = 0; i < e->size; i++) {
 474                        sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
 475                        dp += 2;
 476                }
 477                if (e->mask) {
 478                        sprintf(dp, "\nmask ");
 479                        dp += 6;
 480                        for (i = 0; i < e->size; i++) {
 481                                sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
 482                                dp += 2;
 483                        }
 484                }
 485                *dp++ = '\n';
 486                *dp = '\0';
 487        }
 488}
 489
 490static struct inode *bm_get_inode(struct super_block *sb, int mode)
 491{
 492        struct inode * inode = new_inode(sb);
 493
 494        if (inode) {
 495                inode->i_ino = get_next_ino();
 496                inode->i_mode = mode;
 497                inode->i_atime = inode->i_mtime = inode->i_ctime =
 498                        current_fs_time(inode->i_sb);
 499        }
 500        return inode;
 501}
 502
 503static void bm_evict_inode(struct inode *inode)
 504{
 505        clear_inode(inode);
 506        kfree(inode->i_private);
 507}
 508
 509static void kill_node(Node *e)
 510{
 511        struct dentry *dentry;
 512
 513        write_lock(&entries_lock);
 514        dentry = e->dentry;
 515        if (dentry) {
 516                list_del_init(&e->list);
 517                e->dentry = NULL;
 518        }
 519        write_unlock(&entries_lock);
 520
 521        if (dentry) {
 522                drop_nlink(dentry->d_inode);
 523                d_drop(dentry);
 524                dput(dentry);
 525                simple_release_fs(&bm_mnt, &entry_count);
 526        }
 527}
 528
 529/* /<entry> */
 530
 531static ssize_t
 532bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
 533{
 534        Node *e = file->f_path.dentry->d_inode->i_private;
 535        ssize_t res;
 536        char *page;
 537
 538        if (!(page = (char*) __get_free_page(GFP_KERNEL)))
 539                return -ENOMEM;
 540
 541        entry_status(e, page);
 542
 543        res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));
 544
 545        free_page((unsigned long) page);
 546        return res;
 547}
 548
 549static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
 550                                size_t count, loff_t *ppos)
 551{
 552        struct dentry *root;
 553        Node *e = file->f_path.dentry->d_inode->i_private;
 554        int res = parse_command(buffer, count);
 555
 556        switch (res) {
 557                case 1: clear_bit(Enabled, &e->flags);
 558                        break;
 559                case 2: set_bit(Enabled, &e->flags);
 560                        break;
 561                case 3: root = dget(file->f_path.dentry->d_sb->s_root);
 562                        mutex_lock(&root->d_inode->i_mutex);
 563
 564                        kill_node(e);
 565
 566                        mutex_unlock(&root->d_inode->i_mutex);
 567                        dput(root);
 568                        break;
 569                default: return res;
 570        }
 571        return count;
 572}
 573
 574static const struct file_operations bm_entry_operations = {
 575        .read           = bm_entry_read,
 576        .write          = bm_entry_write,
 577        .llseek         = default_llseek,
 578};
 579
 580/* /register */
 581
 582static ssize_t bm_register_write(struct file *file, const char __user *buffer,
 583                               size_t count, loff_t *ppos)
 584{
 585        Node *e;
 586        struct inode *inode;
 587        struct dentry *root, *dentry;
 588        struct super_block *sb = file->f_path.dentry->d_sb;
 589        int err = 0;
 590
 591        e = create_entry(buffer, count);
 592
 593        if (IS_ERR(e))
 594                return PTR_ERR(e);
 595
 596        root = dget(sb->s_root);
 597        mutex_lock(&root->d_inode->i_mutex);
 598        dentry = lookup_one_len(e->name, root, strlen(e->name));
 599        err = PTR_ERR(dentry);
 600        if (IS_ERR(dentry))
 601                goto out;
 602
 603        err = -EEXIST;
 604        if (dentry->d_inode)
 605                goto out2;
 606
 607        inode = bm_get_inode(sb, S_IFREG | 0644);
 608
 609        err = -ENOMEM;
 610        if (!inode)
 611                goto out2;
 612
 613        err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
 614        if (err) {
 615                iput(inode);
 616                inode = NULL;
 617                goto out2;
 618        }
 619
 620        e->dentry = dget(dentry);
 621        inode->i_private = e;
 622        inode->i_fop = &bm_entry_operations;
 623
 624        d_instantiate(dentry, inode);
 625        write_lock(&entries_lock);
 626        list_add(&e->list, &entries);
 627        write_unlock(&entries_lock);
 628
 629        err = 0;
 630out2:
 631        dput(dentry);
 632out:
 633        mutex_unlock(&root->d_inode->i_mutex);
 634        dput(root);
 635
 636        if (err) {
 637                kfree(e);
 638                return -EINVAL;
 639        }
 640        return count;
 641}
 642
 643static const struct file_operations bm_register_operations = {
 644        .write          = bm_register_write,
 645        .llseek         = noop_llseek,
 646};
 647
 648/* /status */
 649
 650static ssize_t
 651bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
 652{
 653        char *s = enabled ? "enabled\n" : "disabled\n";
 654
 655        return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
 656}
 657
 658static ssize_t bm_status_write(struct file * file, const char __user * buffer,
 659                size_t count, loff_t *ppos)
 660{
 661        int res = parse_command(buffer, count);
 662        struct dentry *root;
 663
 664        switch (res) {
 665                case 1: enabled = 0; break;
 666                case 2: enabled = 1; break;
 667                case 3: root = dget(file->f_path.dentry->d_sb->s_root);
 668                        mutex_lock(&root->d_inode->i_mutex);
 669
 670                        while (!list_empty(&entries))
 671                                kill_node(list_entry(entries.next, Node, list));
 672
 673                        mutex_unlock(&root->d_inode->i_mutex);
 674                        dput(root);
 675                default: return res;
 676        }
 677        return count;
 678}
 679
 680static const struct file_operations bm_status_operations = {
 681        .read           = bm_status_read,
 682        .write          = bm_status_write,
 683        .llseek         = default_llseek,
 684};
 685
 686/* Superblock handling */
 687
 688static const struct super_operations s_ops = {
 689        .statfs         = simple_statfs,
 690        .evict_inode    = bm_evict_inode,
 691};
 692
 693static int bm_fill_super(struct super_block * sb, void * data, int silent)
 694{
 695        static struct tree_descr bm_files[] = {
 696                [2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
 697                [3] = {"register", &bm_register_operations, S_IWUSR},
 698                /* last one */ {""}
 699        };
 700        int err = simple_fill_super(sb, BINFMTFS_MAGIC, bm_files);
 701        if (!err)
 702                sb->s_op = &s_ops;
 703        return err;
 704}
 705
 706static struct dentry *bm_mount(struct file_system_type *fs_type,
 707        int flags, const char *dev_name, void *data)
 708{
 709        return mount_single(fs_type, flags, data, bm_fill_super);
 710}
 711
 712static struct linux_binfmt misc_format = {
 713        .module = THIS_MODULE,
 714        .load_binary = load_misc_binary,
 715};
 716
 717static struct file_system_type bm_fs_type = {
 718        .owner          = THIS_MODULE,
 719        .name           = "binfmt_misc",
 720        .mount          = bm_mount,
 721        .kill_sb        = kill_litter_super,
 722};
 723
 724static int __init init_misc_binfmt(void)
 725{
 726        int err = register_filesystem(&bm_fs_type);
 727        if (!err)
 728                insert_binfmt(&misc_format);
 729        return err;
 730}
 731
 732static void __exit exit_misc_binfmt(void)
 733{
 734        unregister_binfmt(&misc_format);
 735        unregister_filesystem(&bm_fs_type);
 736}
 737
 738core_initcall(init_misc_binfmt);
 739module_exit(exit_misc_binfmt);
 740MODULE_LICENSE("GPL");
 741
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.