[linux.git] / fs / binfmt_misc.c

/*
 *  binfmt_misc.c
 *
 *  Copyright (C) 1997 Richard Günther
 *
 *  binfmt_misc detects binaries via a magic or filename extension and invokes
 *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
 *  binfmt_mz.
 *
 *  1997-04-25 first version
 *  [...]
 *  1997-05-19 cleanup
 *  1997-06-26 hpa: pass the real filename rather than argv[0]
 *  1997-06-30 minor cleanup
 *  1997-08-09 removed extension stripping, locking cleanup
 *  2001-02-28 AV: rewritten into something that resembles C. Original didn't.
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/binfmts.h>
#include <linux/slab.h>
#include <linux/ctype.h>
#include <linux/file.h>
#include <linux/pagemap.h>
#include <linux/namei.h>
#include <linux/mount.h>
#include <linux/syscalls.h>
#include <linux/fs.h>

#include <asm/uaccess.h>

enum {
	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
};

static LIST_HEAD(entries);
static int enabled = 1;

enum {Enabled, Magic};
#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
#define MISC_FMT_OPEN_BINARY (1<<30)
#define MISC_FMT_CREDENTIALS (1<<29)

typedef struct {
	struct list_head list;
	unsigned long flags;		/* type, status, etc. */
	int offset;			/* offset of magic */
	int size;			/* size of magic/mask */
	char *magic;			/* magic or filename extension */
	char *mask;			/* mask, NULL for exact match */
	char *interpreter;		/* filename of interpreter */
	char *name;
	struct dentry *dentry;
} Node;

static DEFINE_RWLOCK(entries_lock);
static struct file_system_type bm_fs_type;
static struct vfsmount *bm_mnt;
static int entry_count;

/* 
 * Check if we support the binfmt
 * if we do, return the node, else NULL
 * locking is done in load_misc_binary
 */
static Node *check_file(struct linux_binprm *bprm)
{
	char *p = strrchr(bprm->interp, '.');
	struct list_head *l;

	list_for_each(l, &entries) {
		Node *e = list_entry(l, Node, list);
		char *s;
		int j;

		if (!test_bit(Enabled, &e->flags))
			continue;

		if (!test_bit(Magic, &e->flags)) {
			if (p && !strcmp(e->magic, p + 1))
				return e;
			continue;
		}

		s = bprm->buf + e->offset;
		if (e->mask) {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]) & e->mask[j])
					break;
		} else {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]))
					break;
		}
		if (j == e->size)
			return e;
	}
	return NULL;
}

/*
 * the loader itself
 */
static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
{
	Node *fmt;
	struct file * interp_file = NULL;
	char iname[BINPRM_BUF_SIZE];
	char *iname_addr = iname;
	int retval;
	int fd_binary = -1;

	retval = -ENOEXEC;
	if (!enabled)
		goto _ret;

	retval = -ENOEXEC;
	if (bprm->misc_bang)
		goto _ret;

	/* to keep locking time low, we copy the interpreter string */
	read_lock(&entries_lock);
	fmt = check_file(bprm);
	if (fmt)
		strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
	read_unlock(&entries_lock);
	if (!fmt)
		goto _ret;

	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
		retval = remove_arg_zero(bprm);
		if (retval)
			goto _ret;
	}

	if (fmt->flags & MISC_FMT_OPEN_BINARY) {

		/* if the binary should be opened on behalf of the
		 * interpreter than keep it open and assign descriptor
		 * to it */
 		fd_binary = get_unused_fd();
 		if (fd_binary < 0) {
 			retval = fd_binary;
 			goto _ret;
 		}
 		fd_install(fd_binary, bprm->file);

		/* if the binary is not readable than enforce mm->dumpable=0
		   regardless of the interpreter's permissions */
		if (file_permission(bprm->file, MAY_READ))
			bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;

		allow_write_access(bprm->file);
		bprm->file = NULL;

		/* mark the bprm that fd should be passed to interp */
		bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
		bprm->interp_data = fd_binary;

 	} else {
 		allow_write_access(bprm->file);
 		fput(bprm->file);
 		bprm->file = NULL;
 	}
	/* make argv[1] be the path to the binary */
	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc++;

	/* add the interp as argv[0] */
	retval = copy_strings_kernel (1, &iname_addr, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc ++;

	bprm->interp = iname;	/* for binfmt_script */

	interp_file = open_exec (iname);
	retval = PTR_ERR (interp_file);
	if (IS_ERR (interp_file))
		goto _error;

	bprm->file = interp_file;
	if (fmt->flags & MISC_FMT_CREDENTIALS) {
		/*
		 * No need to call prepare_binprm(), it's already been
		 * done.  bprm->buf is stale, update from interp_file.
		 */
		memset(bprm->buf, 0, BINPRM_BUF_SIZE);
		retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	} else
		retval = prepare_binprm (bprm);

	if (retval < 0)
		goto _error;

	bprm->misc_bang = 1;

	retval = search_binary_handler (bprm, regs);
	if (retval < 0)
		goto _error;

_ret:
	return retval;
_error:
	if (fd_binary > 0)
		sys_close(fd_binary);
	bprm->interp_flags = 0;
	bprm->interp_data = 0;
	goto _ret;
}

/* Command parsers */

/*
 * parses and copies one argument enclosed in del from *sp to *dp,
 * recognising the \x special.
 * returns pointer to the copied argument or NULL in case of an
 * error (and sets err) or null argument length.
 */
static char *scanarg(char *s, char del)
{
	char c;

	while ((c = *s++) != del) {
		if (c == '\\' && *s == 'x') {
			s++;
			if (!isxdigit(*s++))
				return NULL;
			if (!isxdigit(*s++))
				return NULL;
		}
	}
	return s;
}

static int unquote(char *from)
{
	char c = 0, *s = from, *p = from;

	while ((c = *s++) != '\0') {
		if (c == '\\' && *s == 'x') {
			s++;
			c = toupper(*s++);
			*p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
			c = toupper(*s++);
			*p++ |= c - (isdigit(c) ? '0' : 'A' - 10);
			continue;
		}
		*p++ = c;
	}
	return p - from;
}

static char * check_special_flags (char * sfs, Node * e)
{
	char * p = sfs;
	int cont = 1;

	/* special flags */
	while (cont) {
		switch (*p) {
			case 'P':
				p++;
				e->flags |= MISC_FMT_PRESERVE_ARGV0;
				break;
			case 'O':
				p++;
				e->flags |= MISC_FMT_OPEN_BINARY;
				break;
			case 'C':
				p++;
				/* this flags also implies the
				   open-binary flag */
				e->flags |= (MISC_FMT_CREDENTIALS |
						MISC_FMT_OPEN_BINARY);
				break;
			default:
				cont = 0;
		}
	}

	return p;
}
/*
 * This registers a new binary format, it recognises the syntax
 * ':name:type:offset:magic:mask:interpreter:flags'
 * where the ':' is the IFS, that can be chosen with the first char
 */
static Node *create_entry(const char __user *buffer, size_t count)
{
	Node *e;
	int memsize, err;
	char *buf, *p;
	char del;

	/* some sanity checks */
	err = -EINVAL;
	if ((count < 11) || (count > 256))
		goto out;

	err = -ENOMEM;
	memsize = sizeof(Node) + count + 8;
	e = kmalloc(memsize, GFP_USER);
	if (!e)
		goto out;

	p = buf = (char *)e + sizeof(Node);

	memset(e, 0, sizeof(Node));
	if (copy_from_user(buf, buffer, count))
		goto Efault;

	del = *p++;	/* delimeter */

	memset(buf+count, del, 8);

	e->name = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->name[0] ||
	    !strcmp(e->name, ".") ||
	    !strcmp(e->name, "..") ||
	    strchr(e->name, '/'))
		goto Einval;
	switch (*p++) {
		case 'E': e->flags = 1<<Enabled; break;
		case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
		default: goto Einval;
	}
	if (*p++ != del)
		goto Einval;
	if (test_bit(Magic, &e->flags)) {
		char *s = strchr(p, del);
		if (!s)
			goto Einval;
		*s++ = '\0';
		e->offset = simple_strtoul(p, &p, 10);
		if (*p++)
			goto Einval;
		e->magic = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->magic[0])
			goto Einval;
		e->mask = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->mask[0])
			e->mask = NULL;
		e->size = unquote(e->magic);
		if (e->mask && unquote(e->mask) != e->size)
			goto Einval;
		if (e->size + e->offset > BINPRM_BUF_SIZE)
			goto Einval;
	} else {
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		e->magic = p;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		if (!e->magic[0] || strchr(e->magic, '/'))
			goto Einval;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
	}
	e->interpreter = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->interpreter[0])
		goto Einval;


	p = check_special_flags (p, e);

	if (*p == '\n')
		p++;
	if (p != buf + count)
		goto Einval;
	return e;

out:
	return ERR_PTR(err);

Efault:
	kfree(e);
	return ERR_PTR(-EFAULT);
Einval:
	kfree(e);
	return ERR_PTR(-EINVAL);
}

/*
 * Set status of entry/binfmt_misc:
 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc
 */
static int parse_command(const char __user *buffer, size_t count)
{
	char s[4];

	if (!count)
		return 0;
	if (count > 3)
		return -EINVAL;
	if (copy_from_user(s, buffer, count))
		return -EFAULT;
	if (s[count-1] == '\n')
		count--;
	if (count == 1 && s[0] == '0')
		return 1;
	if (count == 1 && s[0] == '1')
		return 2;
	if (count == 2 && s[0] == '-' && s[1] == '1')
		return 3;
	return -EINVAL;
}

/* generic stuff */

static void entry_status(Node *e, char *page)
{
	char *dp;
	char *status = "disabled";
	const char * flags = "flags: ";

	if (test_bit(Enabled, &e->flags))
		status = "enabled";

	if (!VERBOSE_STATUS) {
		sprintf(page, "%s\n", status);
		return;
	}

	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
	dp = page + strlen(page);

	/* print the special flags */
	sprintf (dp, "%s", flags);
	dp += strlen (flags);
	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
		*dp ++ = 'P';
	}
	if (e->flags & MISC_FMT_OPEN_BINARY) {
		*dp ++ = 'O';
	}
	if (e->flags & MISC_FMT_CREDENTIALS) {
		*dp ++ = 'C';
	}
	*dp ++ = '\n';


	if (!test_bit(Magic, &e->flags)) {
		sprintf(dp, "extension .%s\n", e->magic);
	} else {
		int i;

		sprintf(dp, "offset %i\nmagic ", e->offset);
		dp = page + strlen(page);
		for (i = 0; i < e->size; i++) {
			sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
			dp += 2;
		}
		if (e->mask) {
			sprintf(dp, "\nmask ");
			dp += 6;
			for (i = 0; i < e->size; i++) {
				sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
				dp += 2;
			}
		}
		*dp++ = '\n';
		*dp = '\0';
	}
}

static struct inode *bm_get_inode(struct super_block *sb, int mode)
{
	struct inode * inode = new_inode(sb);

	if (inode) {
		inode->i_mode = mode;
		inode->i_uid = 0;
		inode->i_gid = 0;
		inode->i_blocks = 0;
		inode->i_atime = inode->i_mtime = inode->i_ctime =
			current_fs_time(inode->i_sb);
	}
	return inode;
}

static void bm_clear_inode(struct inode *inode)
{
	kfree(inode->i_private);
}

static void kill_node(Node *e)
{
	struct dentry *dentry;

	write_lock(&entries_lock);
	dentry = e->dentry;
	if (dentry) {
		list_del_init(&e->list);
		e->dentry = NULL;
	}
	write_unlock(&entries_lock);

	if (dentry) {
		dentry->d_inode->i_nlink--;
		d_drop(dentry);
		dput(dentry);
		simple_release_fs(&bm_mnt, &entry_count);
	}
}

/* /<entry> */

static ssize_t
bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
{
	Node *e = file->f_path.dentry->d_inode->i_private;
	ssize_t res;
	char *page;

	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
		return -ENOMEM;

	entry_status(e, page);

	res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));

	free_page((unsigned long) page);
	return res;
}

static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct dentry *root;
	Node *e = file->f_path.dentry->d_inode->i_private;
	int res = parse_command(buffer, count);

	switch (res) {
		case 1: clear_bit(Enabled, &e->flags);
			break;
		case 2: set_bit(Enabled, &e->flags);
			break;
		case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			kill_node(e);

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
			break;
		default: return res;
	}
	return count;
}

static const struct file_operations bm_entry_operations = {
	.read		= bm_entry_read,
	.write		= bm_entry_write,
};

/* /register */

static ssize_t bm_register_write(struct file *file, const char __user *buffer,
			       size_t count, loff_t *ppos)
{
	Node *e;
	struct inode *inode;
	struct dentry *root, *dentry;
	struct super_block *sb = file->f_path.mnt->mnt_sb;
	int err = 0;

	e = create_entry(buffer, count);

	if (IS_ERR(e))
		return PTR_ERR(e);

	root = dget(sb->s_root);
	mutex_lock(&root->d_inode->i_mutex);
	dentry = lookup_one_len(e->name, root, strlen(e->name));
	err = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out;

	err = -EEXIST;
	if (dentry->d_inode)
		goto out2;

	inode = bm_get_inode(sb, S_IFREG | 0644);

	err = -ENOMEM;
	if (!inode)
		goto out2;

	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
	if (err) {
		iput(inode);
		inode = NULL;
		goto out2;
	}

	e->dentry = dget(dentry);
	inode->i_private = e;
	inode->i_fop = &bm_entry_operations;

	d_instantiate(dentry, inode);
	write_lock(&entries_lock);
	list_add(&e->list, &entries);
	write_unlock(&entries_lock);

	err = 0;
out2:
	dput(dentry);
out:
	mutex_unlock(&root->d_inode->i_mutex);
	dput(root);

	if (err) {
		kfree(e);
		return -EINVAL;
	}
	return count;
}

static const struct file_operations bm_register_operations = {
	.write		= bm_register_write,
};

/* /status */

static ssize_t
bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
{
	char *s = enabled ? "enabled" : "disabled";

	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
}

static ssize_t bm_status_write(struct file * file, const char __user * buffer,
		size_t count, loff_t *ppos)
{
	int res = parse_command(buffer, count);
	struct dentry *root;

	switch (res) {
		case 1: enabled = 0; break;
		case 2: enabled = 1; break;
		case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			while (!list_empty(&entries))
				kill_node(list_entry(entries.next, Node, list));

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
		default: return res;
	}
	return count;
}

static const struct file_operations bm_status_operations = {
	.read		= bm_status_read,
	.write		= bm_status_write,
};

/* Superblock handling */

static const struct super_operations s_ops = {
	.statfs		= simple_statfs,
	.clear_inode	= bm_clear_inode,
};

static int bm_fill_super(struct super_block * sb, void * data, int silent)
{
	static struct tree_descr bm_files[] = {
		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
		[3] = {"register", &bm_register_operations, S_IWUSR},
		/* last one */ {""}
	};
	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
	if (!err)
		sb->s_op = &s_ops;
	return err;
}

static int bm_get_sb(struct file_system_type *fs_type,
	int flags, const char *dev_name, void *data, struct vfsmount *mnt)
{
	return get_sb_single(fs_type, flags, data, bm_fill_super, mnt);
}

static struct linux_binfmt misc_format = {
	.module = THIS_MODULE,
	.load_binary = load_misc_binary,
};

static struct file_system_type bm_fs_type = {
	.owner		= THIS_MODULE,
	.name		= "binfmt_misc",
	.get_sb		= bm_get_sb,
	.kill_sb	= kill_litter_super,
};

static int __init init_misc_binfmt(void)
{
	int err = register_filesystem(&bm_fs_type);
	if (!err) {
		err = register_binfmt(&misc_format);
		if (err)
			unregister_filesystem(&bm_fs_type);
	}
	return err;
}

static void __exit exit_misc_binfmt(void)
{
	unregister_binfmt(&misc_format);
	unregister_filesystem(&bm_fs_type);
}

core_initcall(init_misc_binfmt);
module_exit(exit_misc_binfmt);
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* binfmt_misc.c
	3	*
96de0e25	4	* Copyright (C) 1997 Richard Günther
1da177e4 LT	5	*
	6	* binfmt_misc detects binaries via a magic or filename extension and invokes
	7	* a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
	8	* binfmt_mz.
	9	*
	10	* 1997-04-25 first version
	11	* [...]
	12	* 1997-05-19 cleanup
	13	* 1997-06-26 hpa: pass the real filename rather than argv[0]
	14	* 1997-06-30 minor cleanup
	15	* 1997-08-09 removed extension stripping, locking cleanup
	16	* 2001-02-28 AV: rewritten into something that resembles C. Original didn't.
	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/init.h>
e8edc6e0	21	#include <linux/sched.h>
1da177e4 LT	22	#include <linux/binfmts.h>
	23	#include <linux/slab.h>
	24	#include <linux/ctype.h>
	25	#include <linux/file.h>
	26	#include <linux/pagemap.h>
	27	#include <linux/namei.h>
	28	#include <linux/mount.h>
	29	#include <linux/syscalls.h>
6e2c10a1	30	#include <linux/fs.h>
1da177e4 LT	31
	32	#include <asm/uaccess.h>
	33
	34	enum {
	35	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
	36	};
	37
	38	static LIST_HEAD(entries);
	39	static int enabled = 1;
	40
	41	enum {Enabled, Magic};
	42	#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
	43	#define MISC_FMT_OPEN_BINARY (1<<30)
	44	#define MISC_FMT_CREDENTIALS (1<<29)
	45
	46	typedef struct {
	47	struct list_head list;
	48	unsigned long flags; /* type, status, etc. */
	49	int offset; /* offset of magic */
	50	int size; /* size of magic/mask */
	51	char magic; / magic or filename extension */
	52	char mask; / mask, NULL for exact match */
	53	char interpreter; / filename of interpreter */
	54	char *name;
	55	struct dentry *dentry;
	56	} Node;
	57
	58	static DEFINE_RWLOCK(entries_lock);
1f5ce9e9	59	static struct file_system_type bm_fs_type;
1da177e4 LT	60	static struct vfsmount *bm_mnt;
	61	static int entry_count;
	62
	63	/*
	64	* Check if we support the binfmt
	65	* if we do, return the node, else NULL
	66	* locking is done in load_misc_binary
	67	*/
	68	static Node check_file(struct linux_binprm bprm)
	69	{
	70	char *p = strrchr(bprm->interp, '.');
	71	struct list_head *l;
	72
	73	list_for_each(l, &entries) {
	74	Node *e = list_entry(l, Node, list);
	75	char *s;
	76	int j;
	77
	78	if (!test_bit(Enabled, &e->flags))
	79	continue;
	80
	81	if (!test_bit(Magic, &e->flags)) {
	82	if (p && !strcmp(e->magic, p + 1))
	83	return e;
	84	continue;
	85	}
	86
	87	s = bprm->buf + e->offset;
	88	if (e->mask) {
	89	for (j = 0; j < e->size; j++)
	90	if ((*s++ ^ e->magic[j]) & e->mask[j])
	91	break;
	92	} else {
	93	for (j = 0; j < e->size; j++)
	94	if ((*s++ ^ e->magic[j]))
	95	break;
	96	}
	97	if (j == e->size)
	98	return e;
	99	}
	100	return NULL;
	101	}
	102
	103	/*
	104	* the loader itself
	105	*/
	106	static int load_misc_binary(struct linux_binprm bprm, struct pt_regs regs)
	107	{
	108	Node *fmt;
	109	struct file * interp_file = NULL;
	110	char iname[BINPRM_BUF_SIZE];
	111	char *iname_addr = iname;
	112	int retval;
	113	int fd_binary = -1;
1da177e4 LT	114
	115	retval = -ENOEXEC;
	116	if (!enabled)
	117	goto _ret;
	118
3a2e7f47 PE	119	retval = -ENOEXEC;
	120	if (bprm->misc_bang)
	121	goto _ret;
	122
1da177e4 LT	123	/* to keep locking time low, we copy the interpreter string */
	124	read_lock(&entries_lock);
	125	fmt = check_file(bprm);
	126	if (fmt)
	127	strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
	128	read_unlock(&entries_lock);
	129	if (!fmt)
	130	goto _ret;
	131
	132	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
b6a2fea3 OW	133	retval = remove_arg_zero(bprm);
	134	if (retval)
	135	goto _ret;
1da177e4 LT	136	}
	137
	138	if (fmt->flags & MISC_FMT_OPEN_BINARY) {
	139
1da177e4 LT	140	/* if the binary should be opened on behalf of the
	141	* interpreter than keep it open and assign descriptor
	142	* to it */
	143	fd_binary = get_unused_fd();
	144	if (fd_binary < 0) {
	145	retval = fd_binary;
fd8328be	146	goto _ret;
1da177e4 LT	147	}
	148	fd_install(fd_binary, bprm->file);
	149
	150	/* if the binary is not readable than enforce mm->dumpable=0
	151	regardless of the interpreter's permissions */
8c744fb8	152	if (file_permission(bprm->file, MAY_READ))
1da177e4 LT	153	bprm->interp_flags \|= BINPRM_FLAGS_ENFORCE_NONDUMP;
	154
	155	allow_write_access(bprm->file);
	156	bprm->file = NULL;
	157
	158	/* mark the bprm that fd should be passed to interp */
	159	bprm->interp_flags \|= BINPRM_FLAGS_EXECFD;
	160	bprm->interp_data = fd_binary;
	161
	162	} else {
	163	allow_write_access(bprm->file);
	164	fput(bprm->file);
	165	bprm->file = NULL;
	166	}
	167	/* make argv[1] be the path to the binary */
	168	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	169	if (retval < 0)
	170	goto _error;
	171	bprm->argc++;
	172
	173	/* add the interp as argv[0] */
	174	retval = copy_strings_kernel (1, &iname_addr, bprm);
	175	if (retval < 0)
	176	goto _error;
	177	bprm->argc ++;
	178
	179	bprm->interp = iname; /* for binfmt_script */
	180
	181	interp_file = open_exec (iname);
	182	retval = PTR_ERR (interp_file);
	183	if (IS_ERR (interp_file))
	184	goto _error;
	185
	186	bprm->file = interp_file;
	187	if (fmt->flags & MISC_FMT_CREDENTIALS) {
	188	/*
	189	* No need to call prepare_binprm(), it's already been
	190	* done. bprm->buf is stale, update from interp_file.
	191	*/
	192	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
	193	retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	194	} else
	195	retval = prepare_binprm (bprm);
	196
	197	if (retval < 0)
	198	goto _error;
	199
ff9bc512 PE	200	bprm->misc_bang = 1;
ff9bc512 PE	201
1da177e4 LT	202	retval = search_binary_handler (bprm, regs);
	203	if (retval < 0)
	204	goto _error;
	205
1da177e4 LT	206	_ret:
	207	return retval;
	208	_error:
	209	if (fd_binary > 0)
	210	sys_close(fd_binary);
	211	bprm->interp_flags = 0;
	212	bprm->interp_data = 0;
1da177e4 LT	213	goto _ret;
	214	}
	215
	216	/* Command parsers */
	217
	218	/*
	219	* parses and copies one argument enclosed in del from sp to dp,
	220	* recognising the \x special.
	221	* returns pointer to the copied argument or NULL in case of an
	222	* error (and sets err) or null argument length.
	223	*/
	224	static char scanarg(char s, char del)
	225	{
	226	char c;
	227
	228	while ((c = *s++) != del) {
	229	if (c == '\\' && *s == 'x') {
	230	s++;
	231	if (!isxdigit(*s++))
	232	return NULL;
	233	if (!isxdigit(*s++))
	234	return NULL;
	235	}
	236	}
	237	return s;
	238	}
	239
	240	static int unquote(char *from)
	241	{
	242	char c = 0, s = from, p = from;
	243
	244	while ((c = *s++) != '\0') {
	245	if (c == '\\' && *s == 'x') {
	246	s++;
	247	c = toupper(*s++);
	248	*p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
	249	c = toupper(*s++);
	250	*p++ \|= c - (isdigit(c) ? '0' : 'A' - 10);
	251	continue;
	252	}
	253	*p++ = c;
	254	}
	255	return p - from;
	256	}
	257
858119e1	258	static char * check_special_flags (char * sfs, Node * e)
1da177e4 LT	259	{
	260	char * p = sfs;
	261	int cont = 1;
	262
	263	/* special flags */
	264	while (cont) {
	265	switch (*p) {
	266	case 'P':
	267	p++;
	268	e->flags \|= MISC_FMT_PRESERVE_ARGV0;
	269	break;
	270	case 'O':
	271	p++;
	272	e->flags \|= MISC_FMT_OPEN_BINARY;
	273	break;
	274	case 'C':
	275	p++;
	276	/* this flags also implies the
	277	open-binary flag */
	278	e->flags \|= (MISC_FMT_CREDENTIALS \|
	279	MISC_FMT_OPEN_BINARY);
	280	break;
	281	default:
	282	cont = 0;
	283	}
	284	}
	285
	286	return p;
	287	}
	288	/*
	289	* This registers a new binary format, it recognises the syntax
	290	* ':name:type:offset:magic:mask:interpreter:flags'
	291	* where the ':' is the IFS, that can be chosen with the first char
	292	*/
	293	static Node create_entry(const char __user buffer, size_t count)
	294	{
	295	Node *e;
	296	int memsize, err;
	297	char buf, p;
	298	char del;
	299
	300	/* some sanity checks */
	301	err = -EINVAL;
	302	if ((count < 11) \|\| (count > 256))
	303	goto out;
	304
	305	err = -ENOMEM;
	306	memsize = sizeof(Node) + count + 8;
5cbded58	307	e = kmalloc(memsize, GFP_USER);
1da177e4 LT	308	if (!e)
	309	goto out;
	310
	311	p = buf = (char *)e + sizeof(Node);
	312
	313	memset(e, 0, sizeof(Node));
	314	if (copy_from_user(buf, buffer, count))
	315	goto Efault;
	316
	317	del = p++; / delimeter */
	318
	319	memset(buf+count, del, 8);
	320
	321	e->name = p;
	322	p = strchr(p, del);
	323	if (!p)
	324	goto Einval;
	325	*p++ = '\0';
	326	if (!e->name[0] \|\|
	327	!strcmp(e->name, ".") \|\|
	328	!strcmp(e->name, "..") \|\|
	329	strchr(e->name, '/'))
	330	goto Einval;
	331	switch (*p++) {
	332	case 'E': e->flags = 1<<Enabled; break;
	333	case 'M': e->flags = (1<<Enabled) \| (1<<Magic); break;
	334	default: goto Einval;
	335	}
	336	if (*p++ != del)
	337	goto Einval;
	338	if (test_bit(Magic, &e->flags)) {
	339	char *s = strchr(p, del);
	340	if (!s)
	341	goto Einval;
	342	*s++ = '\0';
	343	e->offset = simple_strtoul(p, &p, 10);
	344	if (*p++)
	345	goto Einval;
	346	e->magic = p;
	347	p = scanarg(p, del);
	348	if (!p)
	349	goto Einval;
	350	p[-1] = '\0';
	351	if (!e->magic[0])
	352	goto Einval;
	353	e->mask = p;
	354	p = scanarg(p, del);
	355	if (!p)
	356	goto Einval;
	357	p[-1] = '\0';
	358	if (!e->mask[0])
	359	e->mask = NULL;
	360	e->size = unquote(e->magic);
	361	if (e->mask && unquote(e->mask) != e->size)
	362	goto Einval;
	363	if (e->size + e->offset > BINPRM_BUF_SIZE)
	364	goto Einval;
	365	} else {
	366	p = strchr(p, del);
	367	if (!p)
	368	goto Einval;
	369	*p++ = '\0';
	370	e->magic = p;
	371	p = strchr(p, del);
372	if (!p)
373	goto Einval;
374	*p++ = '\0';
375	if (!e->magic[0] \|\| strchr(e->magic, '/'))
376	goto Einval;
377	p = strchr(p, del);
378	if (!p)
379	goto Einval;
380	*p++ = '\0';
381	}
382	e->interpreter = p;
383	p = strchr(p, del);
384	if (!p)
385	goto Einval;
386	*p++ = '\0';
387	if (!e->interpreter[0])
388	goto Einval;
389
390
391	p = check_special_flags (p, e);
392
393	if (*p == '\n')
394	p++;
395	if (p != buf + count)
396	goto Einval;
397	return e;
398
399	out:
400	return ERR_PTR(err);
401
402	Efault:
403	kfree(e);
404	return ERR_PTR(-EFAULT);
405	Einval:
406	kfree(e);
407	return ERR_PTR(-EINVAL);
408	}
409
410	/*
411	* Set status of entry/binfmt_misc:
412	* '1' enables, '0' disables and '-1' clears entry/binfmt_misc
413	*/
414	static int parse_command(const char __user *buffer, size_t count)
415	{
416	char s[4];
417
418	if (!count)
419	return 0;
420	if (count > 3)
421	return -EINVAL;
422	if (copy_from_user(s, buffer, count))
423	return -EFAULT;
424	if (s[count-1] == '\n')
425	count--;
426	if (count == 1 && s[0] == '0')
427	return 1;
428	if (count == 1 && s[0] == '1')
429	return 2;
430	if (count == 2 && s[0] == '-' && s[1] == '1')
431	return 3;
432	return -EINVAL;
433	}
434
435	/* generic stuff */
436
437	static void entry_status(Node e, char page)
438	{
439	char *dp;
440	char *status = "disabled";
441	const char * flags = "flags: ";
442
443	if (test_bit(Enabled, &e->flags))
444	status = "enabled";
445
446	if (!VERBOSE_STATUS) {
447	sprintf(page, "%s\n", status);
448	return;
449	}
450
451	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
452	dp = page + strlen(page);
453
454	/* print the special flags */
455	sprintf (dp, "%s", flags);
456	dp += strlen (flags);
457	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
458	*dp ++ = 'P';
459	}
460	if (e->flags & MISC_FMT_OPEN_BINARY) {
461	*dp ++ = 'O';
462	}
463	if (e->flags & MISC_FMT_CREDENTIALS) {
464	*dp ++ = 'C';
465	}
466	*dp ++ = '\n';
467
468
469	if (!test_bit(Magic, &e->flags)) {
470	sprintf(dp, "extension .%s\n", e->magic);
471	} else {
472	int i;
473
474	sprintf(dp, "offset %i\nmagic ", e->offset);
475	dp = page + strlen(page);
476	for (i = 0; i < e->size; i++) {
477	sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
478	dp += 2;
479	}
480	if (e->mask) {
481	sprintf(dp, "\nmask ");
482	dp += 6;
483	for (i = 0; i < e->size; i++) {
484	sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
485	dp += 2;
486	}
487	}
488	*dp++ = '\n';
489	*dp = '\0';
490	}
491	}
492
493	static struct inode bm_get_inode(struct super_block sb, int mode)
494	{
495	struct inode * inode = new_inode(sb);
496
497	if (inode) {
498	inode->i_mode = mode;
499	inode->i_uid = 0;
500	inode->i_gid = 0;
1da177e4 LT	501	inode->i_blocks = 0;
	502	inode->i_atime = inode->i_mtime = inode->i_ctime =
	503	current_fs_time(inode->i_sb);
	504	}
	505	return inode;
	506	}
	507
	508	static void bm_clear_inode(struct inode *inode)
	509	{
8e18e294	510	kfree(inode->i_private);
1da177e4 LT	511	}
	512
	513	static void kill_node(Node *e)
	514	{
	515	struct dentry *dentry;
	516
	517	write_lock(&entries_lock);
	518	dentry = e->dentry;
	519	if (dentry) {
	520	list_del_init(&e->list);
	521	e->dentry = NULL;
	522	}
	523	write_unlock(&entries_lock);
	524
	525	if (dentry) {
	526	dentry->d_inode->i_nlink--;
	527	d_drop(dentry);
	528	dput(dentry);
	529	simple_release_fs(&bm_mnt, &entry_count);
	530	}
	531	}
	532
	533	/* /<entry> */
	534
	535	static ssize_t
	536	bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
	537	{
0f7fc9e4	538	Node *e = file->f_path.dentry->d_inode->i_private;
1da177e4 LT	539	ssize_t res;
1da177e4 LT	540	char *page;
1da177e4 LT	541
	542	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
	543	return -ENOMEM;
	544
	545	entry_status(e, page);
1da177e4	546
6e2c10a1 AM	547	res = simple_read_from_buffer(buf, nbytes, ppos, page, strlen(page));
6e2c10a1 AM	548
1da177e4 LT	549	free_page((unsigned long) page);
	550	return res;
	551	}
	552
	553	static ssize_t bm_entry_write(struct file file, const char __user buffer,
	554	size_t count, loff_t *ppos)
	555	{
	556	struct dentry *root;
0f7fc9e4	557	Node *e = file->f_path.dentry->d_inode->i_private;
1da177e4 LT	558	int res = parse_command(buffer, count);
	559
	560	switch (res) {
	561	case 1: clear_bit(Enabled, &e->flags);
	562	break;
	563	case 2: set_bit(Enabled, &e->flags);
	564	break;
0f7fc9e4	565	case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
1b1dcc1b	566	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	567
	568	kill_node(e);
	569
1b1dcc1b	570	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	571	dput(root);
	572	break;
	573	default: return res;
	574	}
	575	return count;
	576	}
	577
4b6f5d20	578	static const struct file_operations bm_entry_operations = {
1da177e4 LT	579	.read = bm_entry_read,
	580	.write = bm_entry_write,
	581	};
	582
	583	/* /register */
	584
	585	static ssize_t bm_register_write(struct file file, const char __user buffer,
	586	size_t count, loff_t *ppos)
	587	{
	588	Node *e;
	589	struct inode *inode;
	590	struct dentry root, dentry;
0f7fc9e4	591	struct super_block *sb = file->f_path.mnt->mnt_sb;
1da177e4 LT	592	int err = 0;
	593
	594	e = create_entry(buffer, count);
	595
	596	if (IS_ERR(e))
	597	return PTR_ERR(e);
	598
	599	root = dget(sb->s_root);
1b1dcc1b	600	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	601	dentry = lookup_one_len(e->name, root, strlen(e->name));
	602	err = PTR_ERR(dentry);
	603	if (IS_ERR(dentry))
	604	goto out;
	605
	606	err = -EEXIST;
	607	if (dentry->d_inode)
	608	goto out2;
	609
	610	inode = bm_get_inode(sb, S_IFREG \| 0644);
	611
	612	err = -ENOMEM;
	613	if (!inode)
	614	goto out2;
	615
1f5ce9e9	616	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
1da177e4 LT	617	if (err) {
	618	iput(inode);
	619	inode = NULL;
	620	goto out2;
	621	}
	622
	623	e->dentry = dget(dentry);
8e18e294	624	inode->i_private = e;
1da177e4 LT	625	inode->i_fop = &bm_entry_operations;
	626
	627	d_instantiate(dentry, inode);
	628	write_lock(&entries_lock);
	629	list_add(&e->list, &entries);
	630	write_unlock(&entries_lock);
	631
	632	err = 0;
	633	out2:
	634	dput(dentry);
	635	out:
1b1dcc1b	636	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	637	dput(root);
	638
	639	if (err) {
	640	kfree(e);
	641	return -EINVAL;
	642	}
	643	return count;
	644	}
	645
4b6f5d20	646	static const struct file_operations bm_register_operations = {
1da177e4 LT	647	.write = bm_register_write,
	648	};
	649
	650	/* /status */
	651
	652	static ssize_t
	653	bm_status_read(struct file file, char __user buf, size_t nbytes, loff_t *ppos)
	654	{
	655	char *s = enabled ? "enabled" : "disabled";
1da177e4	656
92f4c701	657	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
1da177e4 LT	658	}
	659
	660	static ssize_t bm_status_write(struct file * file, const char __user * buffer,
	661	size_t count, loff_t *ppos)
	662	{
	663	int res = parse_command(buffer, count);
	664	struct dentry *root;
	665
	666	switch (res) {
	667	case 1: enabled = 0; break;
	668	case 2: enabled = 1; break;
0f7fc9e4	669	case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
1b1dcc1b	670	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	671
	672	while (!list_empty(&entries))
	673	kill_node(list_entry(entries.next, Node, list));
	674
1b1dcc1b	675	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	676	dput(root);
	677	default: return res;
	678	}
	679	return count;
	680	}
	681
4b6f5d20	682	static const struct file_operations bm_status_operations = {
1da177e4 LT	683	.read = bm_status_read,
	684	.write = bm_status_write,
	685	};
	686
	687	/* Superblock handling */
	688
ee9b6d61	689	static const struct super_operations s_ops = {
1da177e4 LT	690	.statfs = simple_statfs,
	691	.clear_inode = bm_clear_inode,
	692	};
	693
	694	static int bm_fill_super(struct super_block * sb, void * data, int silent)
	695	{
	696	static struct tree_descr bm_files[] = {
1a1c9bb4 JL	697	[2] = {"status", &bm_status_operations, S_IWUSR\|S_IRUGO},
1a1c9bb4 JL	698	[3] = {"register", &bm_register_operations, S_IWUSR},
1da177e4 LT	699	/* last one */ {""}
	700	};
	701	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
	702	if (!err)
	703	sb->s_op = &s_ops;
	704	return err;
	705	}
	706
454e2398 DH	707	static int bm_get_sb(struct file_system_type *fs_type,
454e2398 DH	708	int flags, const char dev_name, void data, struct vfsmount *mnt)
1da177e4	709	{
454e2398	710	return get_sb_single(fs_type, flags, data, bm_fill_super, mnt);
1da177e4 LT	711	}
	712
	713	static struct linux_binfmt misc_format = {
	714	.module = THIS_MODULE,
	715	.load_binary = load_misc_binary,
	716	};
	717
	718	static struct file_system_type bm_fs_type = {
	719	.owner = THIS_MODULE,
	720	.name = "binfmt_misc",
	721	.get_sb = bm_get_sb,
	722	.kill_sb = kill_litter_super,
	723	};
	724
	725	static int __init init_misc_binfmt(void)
	726	{
	727	int err = register_filesystem(&bm_fs_type);
	728	if (!err) {
	729	err = register_binfmt(&misc_format);
	730	if (err)
	731	unregister_filesystem(&bm_fs_type);
	732	}
	733	return err;
	734	}
	735
	736	static void __exit exit_misc_binfmt(void)
	737	{
	738	unregister_binfmt(&misc_format);
	739	unregister_filesystem(&bm_fs_type);
	740	}
	741
	742	core_initcall(init_misc_binfmt);
	743	module_exit(exit_misc_binfmt);
	744	MODULE_LICENSE("GPL");