1046 lines · 25.1 KB · C
RawDownload
// SPDX-License-Identifier: GPL-2.0-only/* * binfmt_misc.c * * Copyright (C) 1997 Richard Günther * * binfmt_misc detects binaries via a magic or filename extension and invokes * a specified wrapper. See Documentation/admin-guide/binfmt-misc.rst for more details. */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/kernel.h>#include <linux/module.h>#include <linux/hex.h>#include <linux/init.h>#include <linux/sched/mm.h>#include <linux/magic.h>#include <linux/binfmts.h>#include <linux/slab.h>#include <linux/ctype.h>#include <linux/string_helpers.h>#include <linux/file.h>#include <linux/pagemap.h>#include <linux/namei.h>#include <linux/mount.h>#include <linux/fs_context.h>#include <linux/syscalls.h>#include <linux/fs.h>#include <linux/uaccess.h> #include "internal.h" #ifdef DEBUG# define USE_DEBUG 1#else# define USE_DEBUG 0#endif enum {	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */}; enum {Enabled, Magic};#define MISC_FMT_PRESERVE_ARGV0 (1UL << 31)#define MISC_FMT_OPEN_BINARY (1UL << 30)#define MISC_FMT_CREDENTIALS (1UL << 29)#define MISC_FMT_OPEN_FILE (1UL << 28) typedef struct {	struct list_head list;	unsigned long flags;		/* type, status, etc. */	int offset;			/* offset of magic */	int size;			/* size of magic/mask */	char *magic;			/* magic or filename extension */	char *mask;			/* mask, NULL for exact match */	const char *interpreter;	/* filename of interpreter */	char *name;	struct dentry *dentry;	struct file *interp_file;	refcount_t users;		/* sync removal with load_misc_binary() */} Node; static struct file_system_type bm_fs_type; /* * Max length of the register string.  Determined by: *  - 7 delimiters *  - name:   ~50 bytes *  - type:   1 byte *  - offset: 3 bytes (has to be smaller than BINPRM_BUF_SIZE) *  - magic:  128 bytes (512 in escaped form) *  - mask:   128 bytes (512 in escaped form) *  - interp: ~50 bytes *  - flags:  5 bytes * Round that up a bit, and then back off to hold the internal data * (like struct Node). */#define MAX_REGISTER_LENGTH 1920 /** * search_binfmt_handler - search for a binary handler for @bprm * @misc: handle to binfmt_misc instance * @bprm: binary for which we are looking for a handler * * Search for a binary type handler for @bprm in the list of registered binary * type handlers. * * Return: binary type list entry on success, NULL on failure */static Node *search_binfmt_handler(struct binfmt_misc *misc,				   struct linux_binprm *bprm){	char *p = strrchr(bprm->interp, '.');	Node *e; 	/* Walk all the registered handlers. */	list_for_each_entry(e, &misc->entries, list) {		char *s;		int j; 		/* Make sure this one is currently enabled. */		if (!test_bit(Enabled, &e->flags))			continue; 		/* Do matching based on extension if applicable. */		if (!test_bit(Magic, &e->flags)) {			if (p && !strcmp(e->magic, p + 1))				return e;			continue;		} 		/* Do matching based on magic & mask. */		s = bprm->buf + e->offset;		if (e->mask) {			for (j = 0; j < e->size; j++)				if ((*s++ ^ e->magic[j]) & e->mask[j])					break;		} else {			for (j = 0; j < e->size; j++)				if ((*s++ ^ e->magic[j]))					break;		}		if (j == e->size)			return e;	} 	return NULL;} /** * get_binfmt_handler - try to find a binary type handler * @misc: handle to binfmt_misc instance * @bprm: binary for which we are looking for a handler * * Try to find a binfmt handler for the binary type. If one is found take a * reference to protect against removal via bm_{entry,status}_write(). * * Return: binary type list entry on success, NULL on failure */static Node *get_binfmt_handler(struct binfmt_misc *misc,				struct linux_binprm *bprm){	Node *e; 	read_lock(&misc->entries_lock);	e = search_binfmt_handler(misc, bprm);	if (e)		refcount_inc(&e->users);	read_unlock(&misc->entries_lock);	return e;} /** * put_binfmt_handler - put binary handler node * @e: node to put * * Free node syncing with load_misc_binary() and defer final free to * load_misc_binary() in case it is using the binary type handler we were * requested to remove. */static void put_binfmt_handler(Node *e){	if (refcount_dec_and_test(&e->users)) {		if (e->flags & MISC_FMT_OPEN_FILE)			filp_close(e->interp_file, NULL);		kfree(e);	}} /** * load_binfmt_misc - load the binfmt_misc of the caller's user namespace * * To be called in load_misc_binary() to load the relevant struct binfmt_misc. * If a user namespace doesn't have its own binfmt_misc mount it can make use * of its ancestor's binfmt_misc handlers. This mimicks the behavior of * pre-namespaced binfmt_misc where all registered binfmt_misc handlers where * available to all user and user namespaces on the system. * * Return: the binfmt_misc instance of the caller's user namespace */static struct binfmt_misc *load_binfmt_misc(void){	const struct user_namespace *user_ns;	struct binfmt_misc *misc; 	user_ns = current_user_ns();	while (user_ns) {		/* Pairs with smp_store_release() in bm_fill_super(). */		misc = smp_load_acquire(&user_ns->binfmt_misc);		if (misc)			return misc; 		user_ns = user_ns->parent;	} 	return &init_binfmt_misc;} /* * the loader itself */static int load_misc_binary(struct linux_binprm *bprm){	Node *fmt;	struct file *interp_file = NULL;	int retval = -ENOEXEC;	struct binfmt_misc *misc; 	misc = load_binfmt_misc();	if (!misc->enabled)		return retval; 	fmt = get_binfmt_handler(misc, bprm);	if (!fmt)		return retval; 	/* Need to be able to load the file after exec */	retval = -ENOENT;	if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)		goto ret; 	if (fmt->flags & MISC_FMT_PRESERVE_ARGV0) {		bprm->interp_flags |= BINPRM_FLAGS_PRESERVE_ARGV0;	} else {		retval = remove_arg_zero(bprm);		if (retval)			goto ret;	} 	/* make argv[1] be the path to the binary */	retval = copy_string_kernel(bprm->interp, bprm);	if (retval < 0)		goto ret;	bprm->argc++; 	/* add the interp as argv[0] */	retval = copy_string_kernel(fmt->interpreter, bprm);	if (retval < 0)		goto ret;	bprm->argc++; 	/* Update interp in case binfmt_script needs it. */	retval = bprm_change_interp(fmt->interpreter, bprm);	if (retval < 0)		goto ret; 	if (fmt->flags & MISC_FMT_OPEN_FILE) {		interp_file = file_clone_open(fmt->interp_file);		if (!IS_ERR(interp_file))			deny_write_access(interp_file);	} else {		interp_file = open_exec(fmt->interpreter);	}	retval = PTR_ERR(interp_file);	if (IS_ERR(interp_file))		goto ret; 	bprm->interpreter = interp_file;	if (fmt->flags & MISC_FMT_OPEN_BINARY)		bprm->have_execfd = 1;	if (fmt->flags & MISC_FMT_CREDENTIALS)		bprm->execfd_creds = 1; 	retval = 0;ret: 	/*	 * If we actually put the node here all concurrent calls to	 * load_misc_binary() will have finished. We also know	 * that for the refcount to be zero someone must have concurently	 * removed the binary type handler from the list and it's our job to	 * free it.	 */	put_binfmt_handler(fmt); 	return retval;} /* Command parsers */ /* * parses and copies one argument enclosed in del from *sp to *dp, * recognising the \x special. * returns pointer to the copied argument or NULL in case of an * error (and sets err) or null argument length. */static char *scanarg(char *s, char del){	char c; 	while ((c = *s++) != del) {		if (c == '\\' && *s == 'x') {			s++;			if (!isxdigit(*s++))				return NULL;			if (!isxdigit(*s++))				return NULL;		}	}	s[-1] ='\0';	return s;} static char *check_special_flags(char *sfs, Node *e){	char *p = sfs;	int cont = 1; 	/* special flags */	while (cont) {		switch (*p) {		case 'P':			pr_debug("register: flag: P (preserve argv0)\n");			p++;			e->flags |= MISC_FMT_PRESERVE_ARGV0;			break;		case 'O':			pr_debug("register: flag: O (open binary)\n");			p++;			e->flags |= MISC_FMT_OPEN_BINARY;			break;		case 'C':			pr_debug("register: flag: C (preserve creds)\n");			p++;			/* this flags also implies the			   open-binary flag */			e->flags |= (MISC_FMT_CREDENTIALS |					MISC_FMT_OPEN_BINARY);			break;		case 'F':			pr_debug("register: flag: F: open interpreter file now\n");			p++;			e->flags |= MISC_FMT_OPEN_FILE;			break;		default:			cont = 0;		}	} 	return p;} /* * This registers a new binary format, it recognises the syntax * ':name:type:offset:magic:mask:interpreter:flags' * where the ':' is the IFS, that can be chosen with the first char */static Node *create_entry(const char __user *buffer, size_t count){	Node *e;	int memsize, err;	char *buf, *p;	char del; 	pr_debug("register: received %zu bytes\n", count); 	/* some sanity checks */	err = -EINVAL;	if ((count < 11) || (count > MAX_REGISTER_LENGTH))		goto out; 	err = -ENOMEM;	memsize = sizeof(Node) + count + 8;	e = kmalloc(memsize, GFP_KERNEL_ACCOUNT);	if (!e)		goto out; 	p = buf = (char *)e + sizeof(Node); 	memset(e, 0, sizeof(Node));	if (copy_from_user(buf, buffer, count))		goto efault; 	del = *p++;	/* delimeter */ 	pr_debug("register: delim: %#x {%c}\n", del, del); 	/* Pad the buffer with the delim to simplify parsing below. */	memset(buf + count, del, 8); 	/* Parse the 'name' field. */	e->name = p;	p = strchr(p, del);	if (!p)		goto einval;	*p++ = '\0';	if (!e->name[0] ||	    !strcmp(e->name, ".") ||	    !strcmp(e->name, "..") ||	    strchr(e->name, '/'))		goto einval; 	pr_debug("register: name: {%s}\n", e->name); 	/* Parse the 'type' field. */	switch (*p++) {	case 'E':		pr_debug("register: type: E (extension)\n");		e->flags = 1 << Enabled;		break;	case 'M':		pr_debug("register: type: M (magic)\n");		e->flags = (1 << Enabled) | (1 << Magic);		break;	default:		goto einval;	}	if (*p++ != del)		goto einval; 	if (test_bit(Magic, &e->flags)) {		/* Handle the 'M' (magic) format. */		char *s; 		/* Parse the 'offset' field. */		s = strchr(p, del);		if (!s)			goto einval;		*s = '\0';		if (p != s) {			int r = kstrtoint(p, 10, &e->offset);			if (r != 0 || e->offset < 0)				goto einval;		}		p = s;		if (*p++)			goto einval;		pr_debug("register: offset: %#x\n", e->offset); 		/* Parse the 'magic' field. */		e->magic = p;		p = scanarg(p, del);		if (!p)			goto einval;		if (!e->magic[0])			goto einval;		if (USE_DEBUG)			print_hex_dump_bytes(				KBUILD_MODNAME ": register: magic[raw]: ",				DUMP_PREFIX_NONE, e->magic, p - e->magic); 		/* Parse the 'mask' field. */		e->mask = p;		p = scanarg(p, del);		if (!p)			goto einval;		if (!e->mask[0]) {			e->mask = NULL;			pr_debug("register:  mask[raw]: none\n");		} else if (USE_DEBUG)			print_hex_dump_bytes(				KBUILD_MODNAME ": register:  mask[raw]: ",				DUMP_PREFIX_NONE, e->mask, p - e->mask); 		/*		 * Decode the magic & mask fields.		 * Note: while we might have accepted embedded NUL bytes from		 * above, the unescape helpers here will stop at the first one		 * it encounters.		 */		e->size = string_unescape_inplace(e->magic, UNESCAPE_HEX);		if (e->mask &&		    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)			goto einval;		if (e->size > BINPRM_BUF_SIZE ||		    BINPRM_BUF_SIZE - e->size < e->offset)			goto einval;		pr_debug("register: magic/mask length: %i\n", e->size);		if (USE_DEBUG) {			print_hex_dump_bytes(				KBUILD_MODNAME ": register: magic[decoded]: ",				DUMP_PREFIX_NONE, e->magic, e->size); 			if (e->mask) {				int i;				char *masked = kmalloc(e->size, GFP_KERNEL_ACCOUNT); 				print_hex_dump_bytes(					KBUILD_MODNAME ": register:  mask[decoded]: ",					DUMP_PREFIX_NONE, e->mask, e->size); 				if (masked) {					for (i = 0; i < e->size; ++i)						masked[i] = e->magic[i] & e->mask[i];					print_hex_dump_bytes(						KBUILD_MODNAME ": register:  magic[masked]: ",						DUMP_PREFIX_NONE, masked, e->size); 					kfree(masked);				}			}		}	} else {		/* Handle the 'E' (extension) format. */ 		/* Skip the 'offset' field. */		p = strchr(p, del);		if (!p)			goto einval;

Lines 1–500 of 1046.