/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*	Copyright (c) 1988 AT&T	*/

/*	  All Rights Reserved  	*/

#include <sys/types.h>

#include <sys/param.h>

#include <sys/sysmacros.h>

#include <sys/systm.h>

#include <sys/signal.h>

#include <sys/cred_impl.h>

#include <sys/policy.h>

#include <sys/user.h>

#include <sys/errno.h>

#include <sys/file.h>

#include <sys/vfs.h>

#include <sys/vnode.h>

#include <sys/mman.h>

#include <sys/acct.h>

#include <sys/cpuvar.h>

#include <sys/proc.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/pathname.h>

#include <sys/vm.h>

#include <sys/vtrace.h>

#include <sys/exec.h>

#include <sys/exechdr.h>

#include <sys/kmem.h>

#include <sys/prsystm.h>

#include <sys/modctl.h>

#include <sys/vmparam.h>

#include <sys/schedctl.h>

#include <sys/utrap.h>

#include <sys/systeminfo.h>

#include <sys/stack.h>

#include <sys/rctl.h>

#include <sys/dtrace.h>

#include <sys/lwpchan_impl.h>

#include <sys/pool.h>

#include <sys/sdt.h>

#include <c2/audit.h>

#include <vm/hat.h>

#include <vm/anon.h>

#include <vm/as.h>

#include <vm/seg.h>

#include <vm/seg_vn.h>

#define	PRIV_RESET		0x01	/* needs to reset privs */

#define	PRIV_SETID		0x02	/* needs to change uids */

#define	PRIV_SETUGID		0x04	/* is setuid/setgid/forced privs */

#define	PRIV_INCREASE		0x08	/* child runs with more privs */

static int execsetid(struct vnode *, struct vattr *, uid_t *, uid_t *);

static int hold_execsw(struct execsw *);

uint_t auxv_hwcap = 0;	/* auxv AT_SUN_HWCAP value; determined on the fly */

#if defined(_SYSCALL32_IMPL)

uint_t auxv_hwcap32 = 0;	/* 32-bit version of auxv_hwcap */

#endif

#if defined(__i386) || defined(__amd64)

extern void ldt_free(proc_t *p);

extern void ldt_load(void);

#endif

int exec_lpg_disable = 0;

#define	PSUIDFLAGS		(SNOCD|SUGID)

/*

 * exec() - wrapper around exece providing NULL environment pointer

 */

int

exec(const char *fname, const char **argp)

{

	return (exece(fname, argp, NULL));

}

/*

 * exece() - system call wrapper around exec_common()

 */

int

exece(const char *fname, const char **argp, const char **envp)

{

	int error;

	error = exec_common(fname, argp, envp);

	return (error ? (set_errno(error)) : 0);

}

int

exec_common(const char *fname, const char **argp, const char **envp)

{

	vnode_t *vp = NULL, *dir = NULL, *tmpvp = NULL;

	proc_t *p = ttoproc(curthread);

	klwp_t *lwp = ttolwp(curthread);

	struct user *up = PTOU(p);

	long execsz;		/* temporary count of exec size */

	int i;

	int error;

	char exec_file[MAXCOMLEN+1];

	struct pathname pn;

	struct pathname resolvepn;

	struct uarg args;

	struct execa ua;

	k_sigset_t savedmask;

	lwpdir_t *lwpdir = NULL;

	lwpdir_t **tidhash;

	lwpdir_t *old_lwpdir = NULL;

	uint_t old_lwpdir_sz;

	lwpdir_t **old_tidhash;

	uint_t old_tidhash_sz;

	lwpent_t *lep;

	/*

	 * exec() is not supported for the /proc agent lwp.

	 */

	if (curthread == p->p_agenttp)

		return (ENOTSUP);

	if ((error = secpolicy_basic_exec(CRED())) != 0)

		return (error);

	/*

	 * Inform /proc that an exec() has started.

	 * Hold signals that are ignored by default so that we will

	 * not be interrupted by a signal that will be ignored after

	 * successful completion of gexec().

	 */

	mutex_enter(&p->p_lock);

	prexecstart();

	schedctl_finish_sigblock(curthread);

	savedmask = curthread->t_hold;

	sigorset(&curthread->t_hold, &ignoredefault);

	mutex_exit(&p->p_lock);

	/*

	 * Look up path name and remember last component for later.

	 * To help coreadm expand its %d token, we attempt to save

	 * the directory containing the executable in p_execdir. The

	 * first call to lookuppn() may fail and return EINVAL because

	 * dirvpp is non-NULL. In that case, we make a second call to

	 * lookuppn() with dirvpp set to NULL; p_execdir will be NULL,

	 * but coreadm is allowed to expand %d to the empty string and

	 * there are other cases in which that failure may occur.

	 */

	if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)

		goto out;

	pn_alloc(&resolvepn);

	if ((error = lookuppn(&pn, &resolvepn, FOLLOW, &dir, &vp)) != 0) {

		pn_free(&resolvepn);

		pn_free(&pn);

		if (error != EINVAL)

			goto out;

		dir = NULL;

		if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)

			goto out;

		pn_alloc(&resolvepn);

		if ((error = lookuppn(&pn, &resolvepn, FOLLOW, NULLVPP,

		    &vp)) != 0) {

			pn_free(&resolvepn);

			pn_free(&pn);

			goto out;

		}

	}

	if (vp == NULL) {

		if (dir != NULL)

			VN_RELE(dir);

		error = ENOENT;

		pn_free(&resolvepn);

		pn_free(&pn);

		goto out;

	}

	bzero(exec_file, MAXCOMLEN+1);

	(void) strncpy(exec_file, pn.pn_path, MAXCOMLEN);

	bzero(&args, sizeof (args));

	args.pathname = resolvepn.pn_path;

	/* don't free resolvepn until we are done with args */

	pn_free(&pn);

	/*

	 * Specific exec handlers, or policies determined via

	 * /etc/system may override the historical default.

	 */

	args.stk_prot = PROT_ZFOD;

	args.dat_prot = PROT_ZFOD;

	CPU_STATS_ADD_K(sys, sysexec, 1);

	DTRACE_PROC1(exec, char *, args.pathname);

	ua.fname = fname;

	ua.argp = argp;

	ua.envp = envp;

	if ((error = gexec(&vp, &ua, &args, NULL, 0, &execsz,

	    exec_file, p->p_cred)) != 0) {

		VN_RELE(vp);

		if (dir != NULL)

			VN_RELE(dir);

		pn_free(&resolvepn);

		goto fail;

	}

	/*

	 * Free floating point registers (sun4u only)

	 */

	ASSERT(lwp != NULL);

	lwp_freeregs(lwp, 1);

	/*

	 * Free device context

	 */

	if (curthread->t_ctx)

		freectx(curthread, 1);

	/*

	 * Remember file name for accounting; clear any cached DTrace predicate.

	 */

	up->u_acflag &= ~AFORK;

	bcopy(exec_file, up->u_comm, MAXCOMLEN+1);

	curthread->t_predcache = NULL;

	/*

	 * Clear contract template state

	 */

	lwp_ctmpl_clear(lwp);

	/*

	 * Save the directory in which we found the executable for expanding

	 * the %d token used in core file patterns.

	 */

	mutex_enter(&p->p_lock);

	tmpvp = p->p_execdir;

	p->p_execdir = dir;

	if (p->p_execdir != NULL)

		VN_HOLD(p->p_execdir);

	mutex_exit(&p->p_lock);

	if (tmpvp != NULL)

		VN_RELE(tmpvp);

	/*

	 * Reset stack state to the user stack, clear set of signals

	 * caught on the signal stack, and reset list of signals that

	 * restart system calls; the new program's environment should

	 * not be affected by detritus from the old program.  Any

	 * pending held signals remain held, so don't clear t_hold.

	 */

	mutex_enter(&p->p_lock);

	lwp->lwp_oldcontext = 0;

	lwp->lwp_ustack = 0;

	lwp->lwp_old_stk_ctl = 0;

	sigemptyset(&up->u_signodefer);

	sigemptyset(&up->u_sigonstack);

	sigemptyset(&up->u_sigresethand);

	lwp->lwp_sigaltstack.ss_sp = 0;

	lwp->lwp_sigaltstack.ss_size = 0;

	lwp->lwp_sigaltstack.ss_flags = SS_DISABLE;

	/*

	 * Make saved resource limit == current resource limit.

	 */

	for (i = 0; i < RLIM_NLIMITS; i++) {

		/*CONSTCOND*/

		if (RLIM_SAVED(i)) {

			(void) rctl_rlimit_get(rctlproc_legacy[i], p,

			    &up->u_saved_rlimit[i]);

		}

	}

	/*

	 * If the action was to catch the signal, then the action

	 * must be reset to SIG_DFL.

	 */

	sigdefault(p);

	p->p_flag &= ~(SNOWAIT|SJCTL);

	p->p_flag |= (SEXECED|SMSACCT|SMSFORK);

	up->u_signal[SIGCLD - 1] = SIG_DFL;

	/*

	 * Delete the dot4 sigqueues/signotifies.

	 */

	sigqfree(p);

	mutex_exit(&p->p_lock);

	mutex_enter(&p->p_pflock);

	p->p_prof.pr_base = NULL;

	p->p_prof.pr_size = 0;

	p->p_prof.pr_off = 0;

	p->p_prof.pr_scale = 0;

	p->p_prof.pr_samples = 0;

	mutex_exit(&p->p_pflock);

	ASSERT(curthread->t_schedctl == NULL);

#if defined(__i386) || defined(__amd64)

	/* If the process uses a private LDT then change it to default */

	if (p->p_ldt)

		ldt_free(p);

#endif	/* __i386 || __amd64 */

#if defined(__amd64)

	/*

	 * Make sure the process has the correct LDT descriptor for its data

	 * model.

	 */

	if (p->p_model == DATAMODEL_LP64)

		p->p_ldt_desc = ldt0_default64_desc;

	else

		p->p_ldt_desc = ldt0_default_desc;

	/*

	 * Ensure the change of LDT is propagated into the LDTR.

	 */

	kpreempt_disable();

	ldt_load();

	kpreempt_enable();

#endif /* __amd64 */

#if defined(__sparc)

	if (p->p_utraps != NULL)

		utrap_free(p);

#endif	/* __sparc */

	/*

	 * Close all close-on-exec files.

	 */

	close_exec(P_FINFO(p));

	TRACE_2(TR_FAC_PROC, TR_PROC_EXEC, "proc_exec:p %p up %p", p, up);

	setregs(&args);

	/* Mark this as an executable vnode */

	mutex_enter(&vp->v_lock);

	vp->v_flag |= VVMEXEC;

	mutex_exit(&vp->v_lock);

	VN_RELE(vp);

	if (dir != NULL)

		VN_RELE(dir);

	pn_free(&resolvepn);

	/*

	 * Allocate a new lwp directory and lwpid hash table if necessary.

	 */

	if (curthread->t_tid != 1 || p->p_lwpdir_sz != 2) {

		lwpdir = kmem_zalloc(2 * sizeof (lwpdir_t), KM_SLEEP);

		lwpdir->ld_next = lwpdir + 1;

		tidhash = kmem_zalloc(2 * sizeof (lwpdir_t *), KM_SLEEP);

		if (p->p_lwpdir != NULL)

			lep = p->p_lwpdir[curthread->t_dslot].ld_entry;

		else

			lep = kmem_zalloc(sizeof (*lep), KM_SLEEP);

	}

	mutex_enter(&p->p_lock);

	prbarrier(p);

	/*

	 * Reset lwp id to the default value of 1.

	 * This is a single-threaded process now

	 * and lwp #1 is lwp_wait()able by default.

	 * The t_unpark flag should not be inherited.

	 */

	ASSERT(p->p_lwpcnt == 1 && p->p_zombcnt == 0);

	curthread->t_tid = 1;

	curthread->t_unpark = 0;

	curthread->t_proc_flag |= TP_TWAIT;

	curthread->t_proc_flag &= ~TP_DAEMON;	/* daemons shouldn't exec */

	p->p_lwpdaemon = 0;			/* but oh well ... */

	p->p_lwpid = 1;

	/*

	 * Install the newly-allocated lwp directory and lwpid hash table

	 * and insert the current thread into the new hash table.

	 */

	if (lwpdir != NULL) {

		old_lwpdir = p->p_lwpdir;

		old_lwpdir_sz = p->p_lwpdir_sz;

		old_tidhash = p->p_tidhash;

		old_tidhash_sz = p->p_tidhash_sz;

		p->p_lwpdir = p->p_lwpfree = lwpdir;

		p->p_lwpdir_sz = 2;

		p->p_tidhash = tidhash;

		p->p_tidhash_sz = 2;

		lep->le_thread = curthread;

		lep->le_lwpid = curthread->t_tid;

		lep->le_start = curthread->t_start;

		lwp_hash_in(p, lep);

	}

	/*

	 * Restore the saved signal mask and

	 * inform /proc that the exec() has finished.

	 */

	curthread->t_hold = savedmask;

	prexecend();

	mutex_exit(&p->p_lock);

	if (old_lwpdir) {

		kmem_free(old_lwpdir, old_lwpdir_sz * sizeof (lwpdir_t));

		kmem_free(old_tidhash, old_tidhash_sz * sizeof (lwpdir_t *));

	}

	ASSERT(error == 0);

	DTRACE_PROC(exec__success);

	return (0);

fail:

	DTRACE_PROC1(exec__failure, int, error);

out:		/* error return */

	mutex_enter(&p->p_lock);

	curthread->t_hold = savedmask;

	prexecend();

	mutex_exit(&p->p_lock);

	ASSERT(error != 0);

	return (error);

}

/*

 * Perform generic exec duties and switchout to object-file specific

 * handler.

 */

int

gexec(

	struct vnode **vpp,

	struct execa *uap,

	struct uarg *args,

	struct intpdata *idatap,

	int level,

	long *execsz,

	caddr_t exec_file,

	struct cred *cred)

{

	struct vnode *vp;

	proc_t *pp = ttoproc(curthread);

	struct execsw *eswp;

	int error = 0;

	int suidflags = 0;

	ssize_t resid;

	uid_t uid, gid;

	struct vattr vattr;

	char magbuf[MAGIC_BYTES];

	int setid;

	cred_t *oldcred, *newcred = NULL;

	int privflags = 0;

	/*

	 * If the SNOCD or SUGID flag is set, turn it off and remember the

	 * previous setting so we can restore it if we encounter an error.

	 */

	if (level == 0 && (pp->p_flag & PSUIDFLAGS)) {

		mutex_enter(&pp->p_lock);

		suidflags = pp->p_flag & PSUIDFLAGS;

		pp->p_flag &= ~PSUIDFLAGS;

		mutex_exit(&pp->p_lock);

	}

	if ((error = execpermissions(*vpp, &vattr, args)) != 0)

		goto bad;

	/* need to open vnode for stateful file systems like rfs */

	if ((error = VOP_OPEN(vpp, FREAD, CRED())) != 0)

		goto bad;

	vp = *vpp;

	/*

	 * Note: to support binary compatibility with SunOS a.out

	 * executables, we read in the first four bytes, as the

	 * magic number is in bytes 2-3.

	 */

	if (error = vn_rdwr(UIO_READ, vp, magbuf, sizeof (magbuf),

	    (offset_t)0, UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))

		goto bad;

	if (resid != 0)

		goto bad;

	if ((eswp = findexec_by_hdr(magbuf)) == NULL)

		goto bad;

	if (level == 0 &&

	    (privflags = execsetid(vp, &vattr, &uid, &gid)) != 0) {

		newcred = cred = crdup(cred);

		/* If we can, drop the PA bit */

		if ((privflags & PRIV_RESET) != 0)

			priv_adjust_PA(cred);

		if (privflags & PRIV_SETID) {

			cred->cr_uid = uid;

			cred->cr_gid = gid;

			cred->cr_suid = uid;

			cred->cr_sgid = gid;

		}

		/*

		 * Implement the privilege updates:

		 *

		 * Restrict with L: