1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#include <linux/module.h>
20#include <linux/init.h>
21
22#include <linux/binfmts.h>
23#include <linux/slab.h>
24#include <linux/ctype.h>
25#include <linux/file.h>
26#include <linux/pagemap.h>
27#include <linux/namei.h>
28#include <linux/mount.h>
29#include <linux/syscalls.h>
30
31#include <asm/uaccess.h>
32
33enum {
34 VERBOSE_STATUS = 1
35};
36
37static LIST_HEAD(entries);
38static int enabled = 1;
39
40enum {Enabled, Magic};
41#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
42#define MISC_FMT_OPEN_BINARY (1<<30)
43#define MISC_FMT_CREDENTIALS (1<<29)
44
45typedef struct {
46 struct list_head list;
47 unsigned long flags;
48 int offset;
49 int size;
50 char *magic;
51 char *mask;
52 char *interpreter;
53 char *name;
54 struct dentry *dentry;
55} Node;
56
57static rwlock_t entries_lock = RW_LOCK_UNLOCKED;
58static struct vfsmount *bm_mnt;
59static int entry_count;
60
61
62
63
64
65
66static Node *check_file(struct linux_binprm *bprm)
67{
68 char *p = strrchr(bprm->interp, '.');
69 struct list_head *l;
70
71 list_for_each(l, &entries) {
72 Node *e = list_entry(l, Node, list);
73 char *s;
74 int j;
75
76 if (!test_bit(Enabled, &e->flags))
77 continue;
78
79 if (!test_bit(Magic, &e->flags)) {
80 if (p && !strcmp(e->magic, p + 1))
81 return e;
82 continue;
83 }
84
85 s = bprm->buf + e->offset;
86 if (e->mask) {
87 for (j = 0; j < e->size; j++)
88 if ((*s++ ^ e->magic[j]) & e->mask[j])
89 break;
90 } else {
91 for (j = 0; j < e->size; j++)
92 if ((*s++ ^ e->magic[j]))
93 break;
94 }
95 if (j == e->size)
96 return e;
97 }
98 return NULL;
99}
100
101
102
103
104static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
105{
106 Node *fmt;
107 struct file * interp_file = NULL;
108 char iname[BINPRM_BUF_SIZE];
109 char *iname_addr = iname;
110 int retval;
111 int fd_binary = -1;
112 struct files_struct *files = NULL;
113
114 retval = -ENOEXEC;
115 if (!enabled)
116 goto _ret;
117
118
119 read_lock(&entries_lock);
120 fmt = check_file(bprm);
121 if (fmt)
122 strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
123 read_unlock(&entries_lock);
124 if (!fmt)
125 goto _ret;
126
127 if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
128 remove_arg_zero(bprm);
129 }
130
131 if (fmt->flags & MISC_FMT_OPEN_BINARY) {
132
133 files = current->files;
134 retval = unshare_files();
135 if (retval < 0)
136 goto _ret;
137 if (files == current->files) {
138 put_files_struct(files);
139 files = NULL;
140 }
141
142
143
144 fd_binary = get_unused_fd();
145 if (fd_binary < 0) {
146 retval = fd_binary;
147 goto _unshare;
148 }
149 fd_install(fd_binary, bprm->file);
150
151
152
153 if (permission(bprm->file->f_dentry->d_inode, MAY_READ, NULL))
154 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
155
156 allow_write_access(bprm->file);
157 bprm->file = NULL;
158
159
160 bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
161 bprm->interp_data = fd_binary;
162
163 } else {
164 allow_write_access(bprm->file);
165 fput(bprm->file);
166 bprm->file = NULL;
167 }
168
169 retval = copy_strings_kernel (1, &bprm->interp, bprm);
170 if (retval < 0)
171 goto _error;
172 bprm->argc++;
173
174
175 retval = copy_strings_kernel (1, &iname_addr, bprm);
176 if (retval < 0)
177 goto _error;
178 bprm->argc ++;
179
180 bprm->interp = iname;
181
182 interp_file = open_exec (iname);
183 retval = PTR_ERR (interp_file);
184 if (IS_ERR (interp_file))
185 goto _error;
186
187 bprm->file = interp_file;
188 if (fmt->flags & MISC_FMT_CREDENTIALS) {
189
190
191
192
193 memset(bprm->buf, 0, BINPRM_BUF_SIZE);
194 retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
195 } else
196 retval = prepare_binprm (bprm);
197
198 if (retval < 0)
199 goto _error;
200
201 retval = search_binary_handler (bprm, regs);
202 if (retval < 0)
203 goto _error;
204
205 if (files) {
206 steal_locks(files);
207 put_files_struct(files);
208 files = NULL;
209 }
210_ret:
211 return retval;
212_error:
213 if (fd_binary > 0)
214 sys_close(fd_binary);
215 bprm->interp_flags = 0;
216 bprm->interp_data = 0;
217_unshare:
218 if (files)
219 reset_files_struct(current, files);
220 goto _ret;
221}
222
223
224
225
226
227
228
229
230
231static char *scanarg(char *s, char del)
232{
233 char c;
234
235 while ((c = *s++) != del) {
236 if (c == '\\' && *s == 'x') {
237 s++;
238 if (!isxdigit(*s++))
239 return NULL;
240 if (!isxdigit(*s++))
241 return NULL;
242 }
243 }
244 return s;
245}
246
247static int unquote(char *from)
248{
249 char c = 0, *s = from, *p = from;
250
251 while ((c = *s++) != '\0') {
252 if (c == '\\' && *s == 'x') {
253 s++;
254 c = toupper(*s++);
255 *p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
256 c = toupper(*s++);
257 *p++ |= c - (isdigit(c) ? '0' : 'A' - 10);
258 continue;
259 }
260 *p++ = c;
261 }
262 return p - from;
263}
264
265static inline char * check_special_flags (char * sfs, Node * e)
266{
267 char * p = sfs;
268 int cont = 1;
269
270
271 while (cont) {
272 switch (*p) {
273 case 'P':
274 p++;
275 e->flags |= MISC_FMT_PRESERVE_ARGV0;
276 break;
277 case 'O':
278 p++;
279 e->flags |= MISC_FMT_OPEN_BINARY;
280 break;
281 case 'C':
282 p++;
283
284
285 e->flags |= (MISC_FMT_CREDENTIALS |
286 MISC_FMT_OPEN_BINARY);
287 break;
288 default:
289 cont = 0;
290 }
291 }
292
293 return p;
294}
295
296
297
298
299
300static Node *create_entry(const char __user *buffer, size_t count)
301{
302 Node *e;
303 int memsize, err;
304 char *buf, *p;
305 char del;
306
307
308 err = -EINVAL;
309 if ((count < 11) || (count > 256))
310 goto out;
311
312 err = -ENOMEM;
313 memsize = sizeof(Node) + count + 8;
314 e = (Node *) kmalloc(memsize, GFP_USER);
315 if (!e)
316 goto out;
317
318 p = buf = (char *)e + sizeof(Node);
319
320 memset(e, 0, sizeof(Node));
321 if (copy_from_user(buf, buffer, count))
322 goto Efault;
323
324 del = *p++;
325
326 memset(buf+count, del, 8);
327
328 e->name = p;
329 p = strchr(p, del);
330 if (!p)
331 goto Einval;
332 *p++ = '\0';
333 if (!e->name[0] ||
334 !strcmp(e->name, ".") ||
335 !strcmp(e->name, "..") ||
336 strchr(e->name, '/'))
337 goto Einval;
338 switch (*p++) {
339 case 'E': e->flags = 1<<Enabled; break;
340 case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
341 default: goto Einval;
342 }
343 if (*p++ != del)
344 goto Einval;
345 if (test_bit(Magic, &e->flags)) {
346 char *s = strchr(p, del);
347 if (!s)
348 goto Einval;
349 *s++ = '\0';
350 e->offset = simple_strtoul(p, &p, 10);
351 if (*p++)
352 goto Einval;
353 e->magic = p;
354 p = scanarg(p, del);
355 if (!p)
356 goto Einval;
357 p[-1] = '\0';
358 if (!e->magic[0])
359 goto Einval;
360 e->mask = p;
361 p = scanarg(p, del);
362 if (!p)
363 goto Einval;
364 p[-1] = '\0';
365 if (!e->mask[0])
366 e->mask = NULL;
367 e->size = unquote(e->magic);
368 if (e->mask && unquote(e->mask) != e->size)
369 goto Einval;
370 if (e->size + e->offset > BINPRM_BUF_SIZE)
371 goto Einval;
372 } else {
373 p = strchr(p, del);
374 if (!p)
375 goto Einval;
376 *p++ = '\0';
377 e->magic = p;
378 p = strchr(p, del);
379 if (!p)
380 goto Einval;
381 *p++ = '\0';
382 if (!e->magic[0] || strchr(e->magic, '/'))
383 goto Einval;
384 p = strchr(p, del);
385 if (!p)
386 goto Einval;
387 *p++ = '\0';
388 }
389 e->interpreter = p;
390 p = strchr(p, del);
391 if (!p)
392 goto Einval;
393 *p++ = '\0';
394 if (!e->interpreter[0])
395 goto Einval;
396
397
398 p = check_special_flags (p, e);
399
400 if (*p == '\n')
401 p++;
402 if (p != buf + count)
403 goto Einval;
404 return e;
405
406out:
407 return ERR_PTR(err);
408
409Efault:
410 kfree(e);
411 return ERR_PTR(-EFAULT);
412Einval:
413 kfree(e);
414 return ERR_PTR(-EINVAL);
415}
416
417
418
419
420
421static int parse_command(const char __user *buffer, size_t count)
422{
423 char s[4];
424
425 if (!count)
426 return 0;
427 if (count > 3)
428 return -EINVAL;
429 if (copy_from_user(s, buffer, count))
430 return -EFAULT;
431 if (s[count-1] == '\n')
432 count--;
433 if (count == 1 && s[0] == '0')
434 return 1;
435 if (count == 1 && s[0] == '1')
436 return 2;
437 if (count == 2 && s[0] == '-' && s[1] == '1')
438 return 3;
439 return -EINVAL;
440}
441
442
443
444static void entry_status(Node *e, char *page)
445{
446 char *dp;
447 char *status = "disabled";
448 const char * flags = "flags: ";
449
450 if (test_bit(Enabled, &e->flags))
451 status = "enabled";
452
453 if (!VERBOSE_STATUS) {
454 sprintf(page, "%s\n", status);
455 return;
456 }
457
458 sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
459 dp = page + strlen(page);
460
461
462 sprintf (dp, "%s", flags);
463 dp += strlen (flags);
464 if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
465 *dp ++ = 'P';
466 }
467 if (e->flags & MISC_FMT_OPEN_BINARY) {
468 *dp ++ = 'O';
469 }
470 if (e->flags & MISC_FMT_CREDENTIALS) {
471 *dp ++ = 'C';
472 }
473 *dp ++ = '\n';
474
475
476 if (!test_bit(Magic, &e->flags)) {
477 sprintf(dp, "extension .%s\n", e->magic);
478 } else {
479 int i;
480
481 sprintf(dp, "offset %i\nmagic ", e->offset);
482 dp = page + strlen(page);
483 for (i = 0; i < e->size; i++) {
484 sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
485 dp += 2;
486 }
487 if (e->mask) {
488 sprintf(dp, "\nmask ");
489 dp += 6;
490 for (i = 0; i < e->size; i++) {
491 sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
492 dp += 2;
493 }
494 }
495 *dp++ = '\n';
496 *dp = '\0';
497 }
498}
499
500static struct inode *bm_get_inode(struct super_block *sb, int mode)
501{
502 struct inode * inode = new_inode(sb);
503
504 if (inode) {
505 inode->i_mode = mode;
506 inode->i_uid = 0;
507 inode->i_gid = 0;
508 inode->i_blksize = PAGE_CACHE_SIZE;
509 inode->i_blocks = 0;
510 inode->i_atime = inode->i_mtime = inode->i_ctime =
511 current_fs_time(inode->i_sb);
512 }
513 return inode;
514}
515
516static void bm_clear_inode(struct inode *inode)
517{
518 kfree(inode->u.generic_ip);
519}
520
521static void kill_node(Node *e)
522{
523 struct dentry *dentry;
524
525 write_lock(&entries_lock);
526 dentry = e->dentry;
527 if (dentry) {
528 list_del_init(&e->list);
529 e->dentry = NULL;
530 }
531 write_unlock(&entries_lock);
532
533 if (dentry) {
534 dentry->d_inode->i_nlink--;
535 d_drop(dentry);
536 dput(dentry);
537 simple_release_fs(&bm_mnt, &entry_count);
538 }
539}
540
541
542
543static ssize_t
544bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
545{
546 Node *e = file->f_dentry->d_inode->u.generic_ip;
547 loff_t pos = *ppos;
548 ssize_t res;
549 char *page;
550 int len;
551
552 if (!(page = (char*) __get_free_page(GFP_KERNEL)))
553 return -ENOMEM;
554
555 entry_status(e, page);
556 len = strlen(page);
557
558 res = -EINVAL;
559 if (pos < 0)
560 goto out;
561 res = 0;
562 if (pos >= len)
563 goto out;
564 if (len < pos + nbytes)
565 nbytes = len - pos;
566 res = -EFAULT;
567 if (copy_to_user(buf, page + pos, nbytes))
568 goto out;
569 *ppos = pos + nbytes;
570 res = nbytes;
571out:
572 free_page((unsigned long) page);
573 return res;
574}
575
576static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
577 size_t count, loff_t *ppos)
578{
579 struct dentry *root;
580 Node *e = file->f_dentry->d_inode->u.generic_ip;
581 int res = parse_command(buffer, count);
582
583 switch (res) {
584 case 1: clear_bit(Enabled, &e->flags);
585 break;
586 case 2: set_bit(Enabled, &e->flags);
587 break;
588 case 3: root = dget(file->f_vfsmnt->mnt_sb->s_root);
589 down(&root->d_inode->i_sem);
590
591 kill_node(e);
592
593 up(&root->d_inode->i_sem);
594 dput(root);
595 break;
596 default: return res;
597 }
598 return count;
599}
600
601static struct file_operations bm_entry_operations = {
602 .read = bm_entry_read,
603 .write = bm_entry_write,
604};
605
606
607
608static ssize_t bm_register_write(struct file *file, const char __user *buffer,
609 size_t count, loff_t *ppos)
610{
611 Node *e;
612 struct inode *inode;
613 struct dentry *root, *dentry;
614 struct super_block *sb = file->f_vfsmnt->mnt_sb;
615 int err = 0;
616
617 e = create_entry(buffer, count);
618
619 if (IS_ERR(e))
620 return PTR_ERR(e);
621
622 root = dget(sb->s_root);
623 down(&root->d_inode->i_sem);
624 dentry = lookup_one_len(e->name, root, strlen(e->name));
625 err = PTR_ERR(dentry);
626 if (IS_ERR(dentry))
627 goto out;
628
629 err = -EEXIST;
630 if (dentry->d_inode)
631 goto out2;
632
633 inode = bm_get_inode(sb, S_IFREG | 0644);
634
635 err = -ENOMEM;
636 if (!inode)
637 goto out2;
638
639 err = simple_pin_fs("binfmt_misc", &bm_mnt, &entry_count);
640 if (err) {
641 iput(inode);
642 inode = NULL;
643 goto out2;
644 }
645
646 e->dentry = dget(dentry);
647 inode->u.generic_ip = e;
648 inode->i_fop = &bm_entry_operations;
649
650 d_instantiate(dentry, inode);
651 write_lock(&entries_lock);
652 list_add(&e->list, &entries);
653 write_unlock(&entries_lock);
654
655 err = 0;
656out2:
657 dput(dentry);
658out:
659 up(&root->d_inode->i_sem);
660 dput(root);
661
662 if (err) {
663 kfree(e);
664 return -EINVAL;
665 }
666 return count;
667}
668
669static struct file_operations bm_register_operations = {
670 .write = bm_register_write,
671};
672
673
674
675static ssize_t
676bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
677{
678 char *s = enabled ? "enabled" : "disabled";
679 int len = strlen(s);
680 loff_t pos = *ppos;
681
682 if (pos < 0)
683 return -EINVAL;
684 if (pos >= len)
685 return 0;
686 if (len < pos + nbytes)
687 nbytes = len - pos;
688 if (copy_to_user(buf, s + pos, nbytes))
689 return -EFAULT;
690 *ppos = pos + nbytes;
691 return nbytes;
692}
693
694static ssize_t bm_status_write(struct file * file, const char __user * buffer,
695 size_t count, loff_t *ppos)
696{
697 int res = parse_command(buffer, count);
698 struct dentry *root;
699
700 switch (res) {
701 case 1: enabled = 0; break;
702 case 2: enabled = 1; break;
703 case 3: root = dget(file->f_vfsmnt->mnt_sb->s_root);
704 down(&root->d_inode->i_sem);
705
706 while (!list_empty(&entries))
707 kill_node(list_entry(entries.next, Node, list));
708
709 up(&root->d_inode->i_sem);
710 dput(root);
711 default: return res;
712 }
713 return count;
714}
715
716static struct file_operations bm_status_operations = {
717 .read = bm_status_read,
718 .write = bm_status_write,
719};
720
721
722
723static struct super_operations s_ops = {
724 .statfs = simple_statfs,
725 .clear_inode = bm_clear_inode,
726};
727
728static int bm_fill_super(struct super_block * sb, void * data, int silent)
729{
730 static struct tree_descr bm_files[] = {
731 [1] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
732 [2] = {"register", &bm_register_operations, S_IWUSR},
733 {""}
734 };
735 int err = simple_fill_super(sb, 0x42494e4d, bm_files);
736 if (!err)
737 sb->s_op = &s_ops;
738 return err;
739}
740
741static struct super_block *bm_get_sb(struct file_system_type *fs_type,
742 int flags, const char *dev_name, void *data)
743{
744 return get_sb_single(fs_type, flags, data, bm_fill_super);
745}
746
747static struct linux_binfmt misc_format = {
748 .module = THIS_MODULE,
749 .load_binary = load_misc_binary,
750};
751
752static struct file_system_type bm_fs_type = {
753 .owner = THIS_MODULE,
754 .name = "binfmt_misc",
755 .get_sb = bm_get_sb,
756 .kill_sb = kill_litter_super,
757};
758
759static int __init init_misc_binfmt(void)
760{
761 int err = register_filesystem(&bm_fs_type);
762 if (!err) {
763 err = register_binfmt(&misc_format);
764 if (err)
765 unregister_filesystem(&bm_fs_type);
766 }
767 return err;
768}
769
770static void __exit exit_misc_binfmt(void)
771{
772 unregister_binfmt(&misc_format);
773 unregister_filesystem(&bm_fs_type);
774}
775
776core_initcall(init_misc_binfmt);
777module_exit(exit_misc_binfmt);
778MODULE_LICENSE("GPL");
779
