[linux.git] / fs / binfmt_misc.c

/*
 *  binfmt_misc.c
 *
 *  Copyright (C) 1997 Richard Günther
 *
 *  binfmt_misc detects binaries via a magic or filename extension and invokes
 *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
 *  binfmt_mz.
 *
 *  1997-04-25 first version
 *  [...]
 *  1997-05-19 cleanup
 *  1997-06-26 hpa: pass the real filename rather than argv[0]
 *  1997-06-30 minor cleanup
 *  1997-08-09 removed extension stripping, locking cleanup
 *  2001-02-28 AV: rewritten into something that resembles C. Original didn't.
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/magic.h>
#include <linux/binfmts.h>
#include <linux/slab.h>
#include <linux/ctype.h>
#include <linux/string_helpers.h>
#include <linux/file.h>
#include <linux/pagemap.h>
#include <linux/namei.h>
#include <linux/mount.h>
#include <linux/syscalls.h>
#include <linux/fs.h>

#include <asm/uaccess.h>

enum {
	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
};

static LIST_HEAD(entries);
static int enabled = 1;

enum {Enabled, Magic};
#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
#define MISC_FMT_OPEN_BINARY (1<<30)
#define MISC_FMT_CREDENTIALS (1<<29)

typedef struct {
	struct list_head list;
	unsigned long flags;		/* type, status, etc. */
	int offset;			/* offset of magic */
	int size;			/* size of magic/mask */
	char *magic;			/* magic or filename extension */
	char *mask;			/* mask, NULL for exact match */
	char *interpreter;		/* filename of interpreter */
	char *name;
	struct dentry *dentry;
} Node;

static DEFINE_RWLOCK(entries_lock);
static struct file_system_type bm_fs_type;
static struct vfsmount *bm_mnt;
static int entry_count;

/* 
 * Check if we support the binfmt
 * if we do, return the node, else NULL
 * locking is done in load_misc_binary
 */
static Node *check_file(struct linux_binprm *bprm)
{
	char *p = strrchr(bprm->interp, '.');
	struct list_head *l;

	list_for_each(l, &entries) {
		Node *e = list_entry(l, Node, list);
		char *s;
		int j;

		if (!test_bit(Enabled, &e->flags))
			continue;

		if (!test_bit(Magic, &e->flags)) {
			if (p && !strcmp(e->magic, p + 1))
				return e;
			continue;
		}

		s = bprm->buf + e->offset;
		if (e->mask) {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]) & e->mask[j])
					break;
		} else {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]))
					break;
		}
		if (j == e->size)
			return e;
	}
	return NULL;
}

/*
 * the loader itself
 */
static int load_misc_binary(struct linux_binprm *bprm)
{
	Node *fmt;
	struct file * interp_file = NULL;
	char iname[BINPRM_BUF_SIZE];
	const char *iname_addr = iname;
	int retval;
	int fd_binary = -1;

	retval = -ENOEXEC;
	if (!enabled)
		goto _ret;

	/* to keep locking time low, we copy the interpreter string */
	read_lock(&entries_lock);
	fmt = check_file(bprm);
	if (fmt)
		strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
	read_unlock(&entries_lock);
	if (!fmt)
		goto _ret;

	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
		retval = remove_arg_zero(bprm);
		if (retval)
			goto _ret;
	}

	if (fmt->flags & MISC_FMT_OPEN_BINARY) {

		/* if the binary should be opened on behalf of the
		 * interpreter than keep it open and assign descriptor
		 * to it */
 		fd_binary = get_unused_fd();
 		if (fd_binary < 0) {
 			retval = fd_binary;
 			goto _ret;
 		}
 		fd_install(fd_binary, bprm->file);

		/* if the binary is not readable than enforce mm->dumpable=0
		   regardless of the interpreter's permissions */
		would_dump(bprm, bprm->file);

		allow_write_access(bprm->file);
		bprm->file = NULL;

		/* mark the bprm that fd should be passed to interp */
		bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
		bprm->interp_data = fd_binary;

 	} else {
 		allow_write_access(bprm->file);
 		fput(bprm->file);
 		bprm->file = NULL;
 	}
	/* make argv[1] be the path to the binary */
	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc++;

	/* add the interp as argv[0] */
	retval = copy_strings_kernel (1, &iname_addr, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc ++;

	/* Update interp in case binfmt_script needs it. */
	retval = bprm_change_interp(iname, bprm);
	if (retval < 0)
		goto _error;

	interp_file = open_exec (iname);
	retval = PTR_ERR (interp_file);
	if (IS_ERR (interp_file))
		goto _error;

	bprm->file = interp_file;
	if (fmt->flags & MISC_FMT_CREDENTIALS) {
		/*
		 * No need to call prepare_binprm(), it's already been
		 * done.  bprm->buf is stale, update from interp_file.
		 */
		memset(bprm->buf, 0, BINPRM_BUF_SIZE);
		retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	} else
		retval = prepare_binprm (bprm);

	if (retval < 0)
		goto _error;

	retval = search_binary_handler(bprm);
	if (retval < 0)
		goto _error;

_ret:
	return retval;
_error:
	if (fd_binary > 0)
		sys_close(fd_binary);
	bprm->interp_flags = 0;
	bprm->interp_data = 0;
	goto _ret;
}

/* Command parsers */

/*
 * parses and copies one argument enclosed in del from *sp to *dp,
 * recognising the \x special.
 * returns pointer to the copied argument or NULL in case of an
 * error (and sets err) or null argument length.
 */
static char *scanarg(char *s, char del)
{
	char c;

	while ((c = *s++) != del) {
		if (c == '\\' && *s == 'x') {
			s++;
			if (!isxdigit(*s++))
				return NULL;
			if (!isxdigit(*s++))
				return NULL;
		}
	}
	return s;
}

static char * check_special_flags (char * sfs, Node * e)
{
	char * p = sfs;
	int cont = 1;

	/* special flags */
	while (cont) {
		switch (*p) {
			case 'P':
				p++;
				e->flags |= MISC_FMT_PRESERVE_ARGV0;
				break;
			case 'O':
				p++;
				e->flags |= MISC_FMT_OPEN_BINARY;
				break;
			case 'C':
				p++;
				/* this flags also implies the
				   open-binary flag */
				e->flags |= (MISC_FMT_CREDENTIALS |
						MISC_FMT_OPEN_BINARY);
				break;
			default:
				cont = 0;
		}
	}

	return p;
}
/*
 * This registers a new binary format, it recognises the syntax
 * ':name:type:offset:magic:mask:interpreter:flags'
 * where the ':' is the IFS, that can be chosen with the first char
 */
static Node *create_entry(const char __user *buffer, size_t count)
{
	Node *e;
	int memsize, err;
	char *buf, *p;
	char del;

	/* some sanity checks */
	err = -EINVAL;
	if ((count < 11) || (count > 256))
		goto out;

	err = -ENOMEM;
	memsize = sizeof(Node) + count + 8;
	e = kmalloc(memsize, GFP_USER);
	if (!e)
		goto out;

	p = buf = (char *)e + sizeof(Node);

	memset(e, 0, sizeof(Node));
	if (copy_from_user(buf, buffer, count))
		goto Efault;

	del = *p++;	/* delimeter */

	memset(buf+count, del, 8);

	e->name = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->name[0] ||
	    !strcmp(e->name, ".") ||
	    !strcmp(e->name, "..") ||
	    strchr(e->name, '/'))
		goto Einval;
	switch (*p++) {
		case 'E': e->flags = 1<<Enabled; break;
		case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
		default: goto Einval;
	}
	if (*p++ != del)
		goto Einval;
	if (test_bit(Magic, &e->flags)) {
		char *s = strchr(p, del);
		if (!s)
			goto Einval;
		*s++ = '\0';
		e->offset = simple_strtoul(p, &p, 10);
		if (*p++)
			goto Einval;
		e->magic = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->magic[0])
			goto Einval;
		e->mask = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->mask[0])
			e->mask = NULL;
		e->size = string_unescape_inplace(e->magic, UNESCAPE_HEX);
		if (e->mask &&
		    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
			goto Einval;
		if (e->size + e->offset > BINPRM_BUF_SIZE)
			goto Einval;
	} else {
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		e->magic = p;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		if (!e->magic[0] || strchr(e->magic, '/'))
			goto Einval;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
	}
	e->interpreter = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->interpreter[0])
		goto Einval;


	p = check_special_flags (p, e);

	if (*p == '\n')
		p++;
	if (p != buf + count)
		goto Einval;
	return e;

out:
	return ERR_PTR(err);

Efault:
	kfree(e);
	return ERR_PTR(-EFAULT);
Einval:
	kfree(e);
	return ERR_PTR(-EINVAL);
}

/*
 * Set status of entry/binfmt_misc:
 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc
 */
static int parse_command(const char __user *buffer, size_t count)
{
	char s[4];

	if (!count)
		return 0;
	if (count > 3)
		return -EINVAL;
	if (copy_from_user(s, buffer, count))
		return -EFAULT;
	if (s[count-1] == '\n')
		count--;
	if (count == 1 && s[0] == '0')
		return 1;
	if (count == 1 && s[0] == '1')
		return 2;
	if (count == 2 && s[0] == '-' && s[1] == '1')
		return 3;
	return -EINVAL;
}

/* generic stuff */

static void entry_status(Node *e, char *page)
{
	char *dp;
	char *status = "disabled";
	const char * flags = "flags: ";

	if (test_bit(Enabled, &e->flags))
		status = "enabled";

	if (!VERBOSE_STATUS) {
		sprintf(page, "%s\n", status);
		return;
	}

	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
	dp = page + strlen(page);

	/* print the special flags */
	sprintf (dp, "%s", flags);
	dp += strlen (flags);
	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
		*dp ++ = 'P';
	}
	if (e->flags & MISC_FMT_OPEN_BINARY) {
		*dp ++ = 'O';
	}
	if (e->flags & MISC_FMT_CREDENTIALS) {
		*dp ++ = 'C';
	}
	*dp ++ = '\n';


	if (!test_bit(Magic, &e->flags)) {
		sprintf(dp, "extension .%s\n", e->magic);
	} else {
		int i;

		sprintf(dp, "offset %i\nmagic ", e->offset);
		dp = page + strlen(page);
		for (i = 0; i < e->size; i++) {
			sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
			dp += 2;
		}
		if (e->mask) {
			sprintf(dp, "\nmask ");
			dp += 6;
			for (i = 0; i < e->size; i++) {
				sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
				dp += 2;
			}
		}
		*dp++ = '\n';
		*dp = '\0';
	}
}

static struct inode *bm_get_inode(struct super_block *sb, int mode)
{
	struct inode * inode = new_inode(sb);

	if (inode) {
		inode->i_ino = get_next_ino();
		inode->i_mode = mode;
		inode->i_atime = inode->i_mtime = inode->i_ctime =
			current_fs_time(inode->i_sb);
	}
	return inode;
}

static void bm_evict_inode(struct inode *inode)
{
	clear_inode(inode);
	kfree(inode->i_private);
}

static void kill_node(Node *e)
{
	struct dentry *dentry;

	write_lock(&entries_lock);
	dentry = e->dentry;
	if (dentry) {
		list_del_init(&e->list);
		e->dentry = NULL;
	}
	write_unlock(&entries_lock);

	if (dentry) {
		drop_nlink(dentry->d_inode);
		d_drop(dentry);
		dput(dentry);
		simple_release_fs(&bm_mnt, &entry_count);
	}
}

/* /<entry> */

static ssize_t
bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
{
	Node *e = file_inode(file)->i_private;
	ssize_t res;
	char *page;

	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
		return -ENOMEM;

	entry_status(e, page);

	res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));

	free_page((unsigned long) page);
	return res;
}

static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct dentry *root;
	Node *e = file_inode(file)->i_private;
	int res = parse_command(buffer, count);

	switch (res) {
		case 1: clear_bit(Enabled, &e->flags);
			break;
		case 2: set_bit(Enabled, &e->flags);
			break;
		case 3: root = dget(file->f_path.dentry->d_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			kill_node(e);

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
			break;
		default: return res;
	}
	return count;
}

static const struct file_operations bm_entry_operations = {
	.read		= bm_entry_read,
	.write		= bm_entry_write,
	.llseek		= default_llseek,
};

/* /register */

static ssize_t bm_register_write(struct file *file, const char __user *buffer,
			       size_t count, loff_t *ppos)
{
	Node *e;
	struct inode *inode;
	struct dentry *root, *dentry;
	struct super_block *sb = file->f_path.dentry->d_sb;
	int err = 0;

	e = create_entry(buffer, count);

	if (IS_ERR(e))
		return PTR_ERR(e);

	root = dget(sb->s_root);
	mutex_lock(&root->d_inode->i_mutex);
	dentry = lookup_one_len(e->name, root, strlen(e->name));
	err = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out;

	err = -EEXIST;
	if (dentry->d_inode)
		goto out2;

	inode = bm_get_inode(sb, S_IFREG | 0644);

	err = -ENOMEM;
	if (!inode)
		goto out2;

	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
	if (err) {
		iput(inode);
		inode = NULL;
		goto out2;
	}

	e->dentry = dget(dentry);
	inode->i_private = e;
	inode->i_fop = &bm_entry_operations;

	d_instantiate(dentry, inode);
	write_lock(&entries_lock);
	list_add(&e->list, &entries);
	write_unlock(&entries_lock);

	err = 0;
out2:
	dput(dentry);
out:
	mutex_unlock(&root->d_inode->i_mutex);
	dput(root);

	if (err) {
		kfree(e);
		return -EINVAL;
	}
	return count;
}

static const struct file_operations bm_register_operations = {
	.write		= bm_register_write,
	.llseek		= noop_llseek,
};

/* /status */

static ssize_t
bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
{
	char *s = enabled ? "enabled\n" : "disabled\n";

	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
}

static ssize_t bm_status_write(struct file * file, const char __user * buffer,
		size_t count, loff_t *ppos)
{
	int res = parse_command(buffer, count);
	struct dentry *root;

	switch (res) {
		case 1: enabled = 0; break;
		case 2: enabled = 1; break;
		case 3: root = dget(file->f_path.dentry->d_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			while (!list_empty(&entries))
				kill_node(list_entry(entries.next, Node, list));

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
			break;
		default: return res;
	}
	return count;
}

static const struct file_operations bm_status_operations = {
	.read		= bm_status_read,
	.write		= bm_status_write,
	.llseek		= default_llseek,
};

/* Superblock handling */

static const struct super_operations s_ops = {
	.statfs		= simple_statfs,
	.evict_inode	= bm_evict_inode,
};

static int bm_fill_super(struct super_block * sb, void * data, int silent)
{
	static struct tree_descr bm_files[] = {
		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
		[3] = {"register", &bm_register_operations, S_IWUSR},
		/* last one */ {""}
	};
	int err = simple_fill_super(sb, BINFMTFS_MAGIC, bm_files);
	if (!err)
		sb->s_op = &s_ops;
	return err;
}

static struct dentry *bm_mount(struct file_system_type *fs_type,
	int flags, const char *dev_name, void *data)
{
	return mount_single(fs_type, flags, data, bm_fill_super);
}

static struct linux_binfmt misc_format = {
	.module = THIS_MODULE,
	.load_binary = load_misc_binary,
};

static struct file_system_type bm_fs_type = {
	.owner		= THIS_MODULE,
	.name		= "binfmt_misc",
	.mount		= bm_mount,
	.kill_sb	= kill_litter_super,
};
MODULE_ALIAS_FS("binfmt_misc");

static int __init init_misc_binfmt(void)
{
	int err = register_filesystem(&bm_fs_type);
	if (!err)
		insert_binfmt(&misc_format);
	return err;
}

static void __exit exit_misc_binfmt(void)
{
	unregister_binfmt(&misc_format);
	unregister_filesystem(&bm_fs_type);
}

core_initcall(init_misc_binfmt);
module_exit(exit_misc_binfmt);
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* binfmt_misc.c
	3	*
96de0e25	4	* Copyright (C) 1997 Richard Günther
1da177e4 LT	5	*
	6	* binfmt_misc detects binaries via a magic or filename extension and invokes
	7	* a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
	8	* binfmt_mz.
	9	*
	10	* 1997-04-25 first version
	11	* [...]
	12	* 1997-05-19 cleanup
	13	* 1997-06-26 hpa: pass the real filename rather than argv[0]
	14	* 1997-06-30 minor cleanup
	15	* 1997-08-09 removed extension stripping, locking cleanup
	16	* 2001-02-28 AV: rewritten into something that resembles C. Original didn't.
	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/init.h>
e8edc6e0	21	#include <linux/sched.h>
b502bd11	22	#include <linux/magic.h>
1da177e4 LT	23	#include <linux/binfmts.h>
	24	#include <linux/slab.h>
	25	#include <linux/ctype.h>
8d82e180	26	#include <linux/string_helpers.h>
1da177e4 LT	27	#include <linux/file.h>
	28	#include <linux/pagemap.h>
	29	#include <linux/namei.h>
	30	#include <linux/mount.h>
	31	#include <linux/syscalls.h>
6e2c10a1	32	#include <linux/fs.h>
1da177e4 LT	33
	34	#include <asm/uaccess.h>
	35
	36	enum {
	37	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
	38	};
	39
	40	static LIST_HEAD(entries);
	41	static int enabled = 1;
	42
	43	enum {Enabled, Magic};
	44	#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
	45	#define MISC_FMT_OPEN_BINARY (1<<30)
	46	#define MISC_FMT_CREDENTIALS (1<<29)
	47
	48	typedef struct {
	49	struct list_head list;
	50	unsigned long flags; /* type, status, etc. */
	51	int offset; /* offset of magic */
	52	int size; /* size of magic/mask */
	53	char magic; / magic or filename extension */
	54	char mask; / mask, NULL for exact match */
	55	char interpreter; / filename of interpreter */
	56	char *name;
	57	struct dentry *dentry;
	58	} Node;
	59
	60	static DEFINE_RWLOCK(entries_lock);
1f5ce9e9	61	static struct file_system_type bm_fs_type;
1da177e4 LT	62	static struct vfsmount *bm_mnt;
	63	static int entry_count;
	64
	65	/*
	66	* Check if we support the binfmt
	67	* if we do, return the node, else NULL
	68	* locking is done in load_misc_binary
	69	*/
	70	static Node check_file(struct linux_binprm bprm)
	71	{
	72	char *p = strrchr(bprm->interp, '.');
	73	struct list_head *l;
	74
	75	list_for_each(l, &entries) {
	76	Node *e = list_entry(l, Node, list);
	77	char *s;
	78	int j;
	79
	80	if (!test_bit(Enabled, &e->flags))
	81	continue;
	82
	83	if (!test_bit(Magic, &e->flags)) {
	84	if (p && !strcmp(e->magic, p + 1))
	85	return e;
	86	continue;
	87	}
	88
	89	s = bprm->buf + e->offset;
	90	if (e->mask) {
	91	for (j = 0; j < e->size; j++)
	92	if ((*s++ ^ e->magic[j]) & e->mask[j])
	93	break;
	94	} else {
	95	for (j = 0; j < e->size; j++)
	96	if ((*s++ ^ e->magic[j]))
	97	break;
	98	}
	99	if (j == e->size)
	100	return e;
	101	}
	102	return NULL;
	103	}
	104
	105	/*
	106	* the loader itself
	107	*/
71613c3b	108	static int load_misc_binary(struct linux_binprm *bprm)
1da177e4 LT	109	{
	110	Node *fmt;
	111	struct file * interp_file = NULL;
	112	char iname[BINPRM_BUF_SIZE];
d7627467	113	const char *iname_addr = iname;
1da177e4 LT	114	int retval;
1da177e4 LT	115	int fd_binary = -1;
1da177e4 LT	116
	117	retval = -ENOEXEC;
	118	if (!enabled)
	119	goto _ret;
	120
	121	/* to keep locking time low, we copy the interpreter string */
	122	read_lock(&entries_lock);
	123	fmt = check_file(bprm);
	124	if (fmt)
	125	strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
	126	read_unlock(&entries_lock);
	127	if (!fmt)
	128	goto _ret;
	129
	130	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
b6a2fea3 OW	131	retval = remove_arg_zero(bprm);
	132	if (retval)
	133	goto _ret;
1da177e4 LT	134	}
	135
	136	if (fmt->flags & MISC_FMT_OPEN_BINARY) {
	137
1da177e4 LT	138	/* if the binary should be opened on behalf of the
	139	* interpreter than keep it open and assign descriptor
	140	* to it */
	141	fd_binary = get_unused_fd();
	142	if (fd_binary < 0) {
	143	retval = fd_binary;
fd8328be	144	goto _ret;
1da177e4 LT	145	}
	146	fd_install(fd_binary, bprm->file);
	147
	148	/* if the binary is not readable than enforce mm->dumpable=0
	149	regardless of the interpreter's permissions */
1b5d783c	150	would_dump(bprm, bprm->file);
1da177e4 LT	151
	152	allow_write_access(bprm->file);
	153	bprm->file = NULL;
	154
	155	/* mark the bprm that fd should be passed to interp */
	156	bprm->interp_flags \|= BINPRM_FLAGS_EXECFD;
	157	bprm->interp_data = fd_binary;
	158
	159	} else {
	160	allow_write_access(bprm->file);
	161	fput(bprm->file);
	162	bprm->file = NULL;
	163	}
	164	/* make argv[1] be the path to the binary */
	165	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	166	if (retval < 0)
	167	goto _error;
	168	bprm->argc++;
	169
	170	/* add the interp as argv[0] */
	171	retval = copy_strings_kernel (1, &iname_addr, bprm);
	172	if (retval < 0)
	173	goto _error;
	174	bprm->argc ++;
	175
b66c5984 KC	176	/* Update interp in case binfmt_script needs it. */
	177	retval = bprm_change_interp(iname, bprm);
	178	if (retval < 0)
	179	goto _error;
1da177e4 LT	180
	181	interp_file = open_exec (iname);
	182	retval = PTR_ERR (interp_file);
	183	if (IS_ERR (interp_file))
	184	goto _error;
	185
	186	bprm->file = interp_file;
	187	if (fmt->flags & MISC_FMT_CREDENTIALS) {
	188	/*
	189	* No need to call prepare_binprm(), it's already been
	190	* done. bprm->buf is stale, update from interp_file.
	191	*/
	192	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
	193	retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	194	} else
	195	retval = prepare_binprm (bprm);
	196
	197	if (retval < 0)
	198	goto _error;
	199
3c456bfc	200	retval = search_binary_handler(bprm);
1da177e4 LT	201	if (retval < 0)
	202	goto _error;
	203
1da177e4 LT	204	_ret:
	205	return retval;
	206	_error:
	207	if (fd_binary > 0)
	208	sys_close(fd_binary);
	209	bprm->interp_flags = 0;
	210	bprm->interp_data = 0;
1da177e4 LT	211	goto _ret;
	212	}
	213
	214	/* Command parsers */
	215
	216	/*
	217	* parses and copies one argument enclosed in del from sp to dp,
	218	* recognising the \x special.
	219	* returns pointer to the copied argument or NULL in case of an
	220	* error (and sets err) or null argument length.
	221	*/
	222	static char scanarg(char s, char del)
	223	{
	224	char c;
	225
	226	while ((c = *s++) != del) {
	227	if (c == '\\' && *s == 'x') {
	228	s++;
	229	if (!isxdigit(*s++))
	230	return NULL;
	231	if (!isxdigit(*s++))
	232	return NULL;
	233	}
	234	}
	235	return s;
	236	}
	237
858119e1	238	static char * check_special_flags (char * sfs, Node * e)
1da177e4 LT	239	{
	240	char * p = sfs;
	241	int cont = 1;
	242
	243	/* special flags */
	244	while (cont) {
	245	switch (*p) {
	246	case 'P':
	247	p++;
	248	e->flags \|= MISC_FMT_PRESERVE_ARGV0;
	249	break;
	250	case 'O':
	251	p++;
	252	e->flags \|= MISC_FMT_OPEN_BINARY;
	253	break;
	254	case 'C':
	255	p++;
	256	/* this flags also implies the
	257	open-binary flag */
	258	e->flags \|= (MISC_FMT_CREDENTIALS \|
	259	MISC_FMT_OPEN_BINARY);
	260	break;
	261	default:
	262	cont = 0;
	263	}
	264	}
	265
	266	return p;
	267	}
	268	/*
	269	* This registers a new binary format, it recognises the syntax
	270	* ':name:type:offset:magic:mask:interpreter:flags'
	271	* where the ':' is the IFS, that can be chosen with the first char
	272	*/
	273	static Node create_entry(const char __user buffer, size_t count)
	274	{
	275	Node *e;
	276	int memsize, err;
	277	char buf, p;
	278	char del;
	279
	280	/* some sanity checks */
	281	err = -EINVAL;
	282	if ((count < 11) \|\| (count > 256))
	283	goto out;
	284
	285	err = -ENOMEM;
	286	memsize = sizeof(Node) + count + 8;
5cbded58	287	e = kmalloc(memsize, GFP_USER);
1da177e4 LT	288	if (!e)
	289	goto out;
	290
	291	p = buf = (char *)e + sizeof(Node);
	292
	293	memset(e, 0, sizeof(Node));
	294	if (copy_from_user(buf, buffer, count))
	295	goto Efault;
	296
	297	del = p++; / delimeter */
	298
	299	memset(buf+count, del, 8);
	300
	301	e->name = p;
	302	p = strchr(p, del);
	303	if (!p)
	304	goto Einval;
	305	*p++ = '\0';
	306	if (!e->name[0] \|\|
	307	!strcmp(e->name, ".") \|\|
	308	!strcmp(e->name, "..") \|\|
	309	strchr(e->name, '/'))
	310	goto Einval;
	311	switch (*p++) {
	312	case 'E': e->flags = 1<<Enabled; break;
	313	case 'M': e->flags = (1<<Enabled) \| (1<<Magic); break;
	314	default: goto Einval;
	315	}
	316	if (*p++ != del)
	317	goto Einval;
	318	if (test_bit(Magic, &e->flags)) {
	319	char *s = strchr(p, del);
	320	if (!s)
	321	goto Einval;
	322	*s++ = '\0';
	323	e->offset = simple_strtoul(p, &p, 10);
	324	if (*p++)
	325	goto Einval;
	326	e->magic = p;
	327	p = scanarg(p, del);
	328	if (!p)
	329	goto Einval;
	330	p[-1] = '\0';
	331	if (!e->magic[0])
	332	goto Einval;
	333	e->mask = p;
	334	p = scanarg(p, del);
	335	if (!p)
	336	goto Einval;
	337	p[-1] = '\0';
	338	if (!e->mask[0])
	339	e->mask = NULL;
8d82e180 AS	340	e->size = string_unescape_inplace(e->magic, UNESCAPE_HEX);
	341	if (e->mask &&
	342	string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
1da177e4 LT	343	goto Einval;
	344	if (e->size + e->offset > BINPRM_BUF_SIZE)
	345	goto Einval;
	346	} else {
	347	p = strchr(p, del);
	348	if (!p)
	349	goto Einval;
	350	*p++ = '\0';
	351	e->magic = p;
	352	p = strchr(p, del);
	353	if (!p)
	354	goto Einval;
	355	*p++ = '\0';
	356	if (!e->magic[0] \|\| strchr(e->magic, '/'))
	357	goto Einval;
	358	p = strchr(p, del);
	359	if (!p)
	360	goto Einval;
	361	*p++ = '\0';
	362	}
	363	e->interpreter = p;
	364	p = strchr(p, del);
	365	if (!p)
	366	goto Einval;
	367	*p++ = '\0';
	368	if (!e->interpreter[0])
	369	goto Einval;
	370
	371
	372	p = check_special_flags (p, e);
	373
	374	if (*p == '\n')
	375	p++;
	376	if (p != buf + count)
	377	goto Einval;
	378	return e;
	379
	380	out:
	381	return ERR_PTR(err);
	382
	383	Efault:
	384	kfree(e);
	385	return ERR_PTR(-EFAULT);
	386	Einval:
	387	kfree(e);
	388	return ERR_PTR(-EINVAL);
	389	}
	390
	391	/*
	392	* Set status of entry/binfmt_misc:
	393	* '1' enables, '0' disables and '-1' clears entry/binfmt_misc
	394	*/
	395	static int parse_command(const char __user *buffer, size_t count)
	396	{
	397	char s[4];
	398
	399	if (!count)
	400	return 0;
	401	if (count > 3)
	402	return -EINVAL;
	403	if (copy_from_user(s, buffer, count))
	404	return -EFAULT;
	405	if (s[count-1] == '\n')
	406	count--;
407	if (count == 1 && s[0] == '0')
408	return 1;
409	if (count == 1 && s[0] == '1')
410	return 2;
411	if (count == 2 && s[0] == '-' && s[1] == '1')
412	return 3;
413	return -EINVAL;
414	}
415
416	/* generic stuff */
417
418	static void entry_status(Node e, char page)
419	{
420	char *dp;
421	char *status = "disabled";
422	const char * flags = "flags: ";
423
424	if (test_bit(Enabled, &e->flags))
425	status = "enabled";
426
427	if (!VERBOSE_STATUS) {
428	sprintf(page, "%s\n", status);
429	return;
430	}
431
432	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
433	dp = page + strlen(page);
434
435	/* print the special flags */
436	sprintf (dp, "%s", flags);
437	dp += strlen (flags);
438	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
439	*dp ++ = 'P';
440	}
441	if (e->flags & MISC_FMT_OPEN_BINARY) {
442	*dp ++ = 'O';
443	}
444	if (e->flags & MISC_FMT_CREDENTIALS) {
445	*dp ++ = 'C';
446	}
447	*dp ++ = '\n';
448
449
450	if (!test_bit(Magic, &e->flags)) {
451	sprintf(dp, "extension .%s\n", e->magic);
452	} else {
453	int i;
454
455	sprintf(dp, "offset %i\nmagic ", e->offset);
456	dp = page + strlen(page);
457	for (i = 0; i < e->size; i++) {
458	sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
459	dp += 2;
460	}
461	if (e->mask) {
462	sprintf(dp, "\nmask ");
463	dp += 6;
464	for (i = 0; i < e->size; i++) {
465	sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
466	dp += 2;
467	}
468	}
469	*dp++ = '\n';
470	*dp = '\0';
471	}
472	}
473
474	static struct inode bm_get_inode(struct super_block sb, int mode)
475	{
476	struct inode * inode = new_inode(sb);
477
478	if (inode) {
85fe4025	479	inode->i_ino = get_next_ino();
1da177e4	480	inode->i_mode = mode;
1da177e4 LT	481	inode->i_atime = inode->i_mtime = inode->i_ctime =
	482	current_fs_time(inode->i_sb);
	483	}
	484	return inode;
	485	}
	486
b57922d9	487	static void bm_evict_inode(struct inode *inode)
1da177e4	488	{
dbd5768f	489	clear_inode(inode);
8e18e294	490	kfree(inode->i_private);
1da177e4 LT	491	}
	492
	493	static void kill_node(Node *e)
	494	{
	495	struct dentry *dentry;
	496
	497	write_lock(&entries_lock);
	498	dentry = e->dentry;
	499	if (dentry) {
	500	list_del_init(&e->list);
	501	e->dentry = NULL;
	502	}
	503	write_unlock(&entries_lock);
	504
	505	if (dentry) {
6d6b77f1	506	drop_nlink(dentry->d_inode);
1da177e4 LT	507	d_drop(dentry);
	508	dput(dentry);
	509	simple_release_fs(&bm_mnt, &entry_count);
	510	}
	511	}
	512
	513	/* /<entry> */
	514
	515	static ssize_t
	516	bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
	517	{
496ad9aa	518	Node *e = file_inode(file)->i_private;
1da177e4 LT	519	ssize_t res;
1da177e4 LT	520	char *page;
1da177e4 LT	521
	522	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
	523	return -ENOMEM;
	524
	525	entry_status(e, page);
1da177e4	526
6e2c10a1 AM	527	res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));
6e2c10a1 AM	528
1da177e4 LT	529	free_page((unsigned long) page);
	530	return res;
	531	}
	532
	533	static ssize_t bm_entry_write(struct file file, const char __user buffer,
	534	size_t count, loff_t *ppos)
	535	{
	536	struct dentry *root;
496ad9aa	537	Node *e = file_inode(file)->i_private;
1da177e4 LT	538	int res = parse_command(buffer, count);
	539
	540	switch (res) {
	541	case 1: clear_bit(Enabled, &e->flags);
	542	break;
	543	case 2: set_bit(Enabled, &e->flags);
	544	break;
d8c9584e	545	case 3: root = dget(file->f_path.dentry->d_sb->s_root);
1b1dcc1b	546	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	547
	548	kill_node(e);
	549
1b1dcc1b	550	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	551	dput(root);
	552	break;
	553	default: return res;
	554	}
	555	return count;
	556	}
	557
4b6f5d20	558	static const struct file_operations bm_entry_operations = {
1da177e4 LT	559	.read = bm_entry_read,
1da177e4 LT	560	.write = bm_entry_write,
6038f373	561	.llseek = default_llseek,
1da177e4 LT	562	};
	563
	564	/* /register */
	565
	566	static ssize_t bm_register_write(struct file file, const char __user buffer,
	567	size_t count, loff_t *ppos)
	568	{
	569	Node *e;
	570	struct inode *inode;
	571	struct dentry root, dentry;
d8c9584e	572	struct super_block *sb = file->f_path.dentry->d_sb;
1da177e4 LT	573	int err = 0;
	574
	575	e = create_entry(buffer, count);
	576
	577	if (IS_ERR(e))
	578	return PTR_ERR(e);
	579
	580	root = dget(sb->s_root);
1b1dcc1b	581	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	582	dentry = lookup_one_len(e->name, root, strlen(e->name));
	583	err = PTR_ERR(dentry);
	584	if (IS_ERR(dentry))
	585	goto out;
	586
	587	err = -EEXIST;
	588	if (dentry->d_inode)
	589	goto out2;
	590
	591	inode = bm_get_inode(sb, S_IFREG \| 0644);
	592
	593	err = -ENOMEM;
	594	if (!inode)
	595	goto out2;
	596
1f5ce9e9	597	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
1da177e4 LT	598	if (err) {
	599	iput(inode);
	600	inode = NULL;
	601	goto out2;
	602	}
	603
	604	e->dentry = dget(dentry);
8e18e294	605	inode->i_private = e;
1da177e4 LT	606	inode->i_fop = &bm_entry_operations;
	607
	608	d_instantiate(dentry, inode);
	609	write_lock(&entries_lock);
	610	list_add(&e->list, &entries);
	611	write_unlock(&entries_lock);
	612
	613	err = 0;
	614	out2:
	615	dput(dentry);
	616	out:
1b1dcc1b	617	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	618	dput(root);
	619
	620	if (err) {
	621	kfree(e);
	622	return -EINVAL;
	623	}
	624	return count;
	625	}
	626
4b6f5d20	627	static const struct file_operations bm_register_operations = {
1da177e4	628	.write = bm_register_write,
6038f373	629	.llseek = noop_llseek,
1da177e4 LT	630	};
	631
	632	/* /status */
	633
	634	static ssize_t
	635	bm_status_read(struct file file, char __user buf, size_t nbytes, loff_t *ppos)
	636	{
87113e80	637	char *s = enabled ? "enabled\n" : "disabled\n";
1da177e4	638
92f4c701	639	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
1da177e4 LT	640	}
	641
	642	static ssize_t bm_status_write(struct file * file, const char __user * buffer,
	643	size_t count, loff_t *ppos)
	644	{
	645	int res = parse_command(buffer, count);
	646	struct dentry *root;
	647
	648	switch (res) {
	649	case 1: enabled = 0; break;
	650	case 2: enabled = 1; break;
d8c9584e	651	case 3: root = dget(file->f_path.dentry->d_sb->s_root);
1b1dcc1b	652	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	653
	654	while (!list_empty(&entries))
	655	kill_node(list_entry(entries.next, Node, list));
	656
1b1dcc1b	657	mutex_unlock(&root->d_inode->i_mutex);
1da177e4	658	dput(root);
b003f965	659	break;
1da177e4 LT	660	default: return res;
	661	}
	662	return count;
	663	}
	664
4b6f5d20	665	static const struct file_operations bm_status_operations = {
1da177e4 LT	666	.read = bm_status_read,
1da177e4 LT	667	.write = bm_status_write,
6038f373	668	.llseek = default_llseek,
1da177e4 LT	669	};
	670
	671	/* Superblock handling */
	672
ee9b6d61	673	static const struct super_operations s_ops = {
1da177e4	674	.statfs = simple_statfs,
b57922d9	675	.evict_inode = bm_evict_inode,
1da177e4 LT	676	};
	677
	678	static int bm_fill_super(struct super_block * sb, void * data, int silent)
	679	{
	680	static struct tree_descr bm_files[] = {
1a1c9bb4 JL	681	[2] = {"status", &bm_status_operations, S_IWUSR\|S_IRUGO},
1a1c9bb4 JL	682	[3] = {"register", &bm_register_operations, S_IWUSR},
1da177e4 LT	683	/* last one */ {""}
1da177e4 LT	684	};
b502bd11	685	int err = simple_fill_super(sb, BINFMTFS_MAGIC, bm_files);
1da177e4 LT	686	if (!err)
	687	sb->s_op = &s_ops;
	688	return err;
	689	}
	690
fc14f2fe AV	691	static struct dentry bm_mount(struct file_system_type fs_type,
fc14f2fe AV	692	int flags, const char dev_name, void data)
1da177e4	693	{
fc14f2fe	694	return mount_single(fs_type, flags, data, bm_fill_super);
1da177e4 LT	695	}
	696
	697	static struct linux_binfmt misc_format = {
	698	.module = THIS_MODULE,
	699	.load_binary = load_misc_binary,
	700	};
	701
	702	static struct file_system_type bm_fs_type = {
	703	.owner = THIS_MODULE,
	704	.name = "binfmt_misc",
fc14f2fe	705	.mount = bm_mount,
1da177e4 LT	706	.kill_sb = kill_litter_super,
1da177e4 LT	707	};
7f78e035	708	MODULE_ALIAS_FS("binfmt_misc");
1da177e4 LT	709
	710	static int __init init_misc_binfmt(void)
	711	{
	712	int err = register_filesystem(&bm_fs_type);
8fc3dc5a AV	713	if (!err)
8fc3dc5a AV	714	insert_binfmt(&misc_format);
1da177e4 LT	715	return err;
	716	}
	717
	718	static void __exit exit_misc_binfmt(void)
	719	{
	720	unregister_binfmt(&misc_format);
	721	unregister_filesystem(&bm_fs_type);
	722	}
	723
	724	core_initcall(init_misc_binfmt);
	725	module_exit(exit_misc_binfmt);
	726	MODULE_LICENSE("GPL");