fs/exec.c

   1 /*
   2  *  linux/fs/exec.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * #!-checking implemented by tytso.
   9  */
  10 /*
  11  * Demand-loading implemented 01.12.91 - no need to read anything but
  12  * the header into memory. The inode of the executable is put into
  13  * "current->executable", and page faults do the actual loading. Clean.
  14  *
  15  * Once more I can proudly say that linux stood up to being changed: it
  16  * was less than 2 hours work to get demand-loading completely implemented.
  17  *
  18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  19  * current->executable is only used by the procfs.  This allows a dispatch
  20  * table to check for several different types  of binary formats.  We keep
  21  * trying until we recognize the file or we run out of supported binary
  22  * formats.
  23  */
  24
  25 #include <linux/config.h>
  26 #include <linux/slab.h>
  27 #include <linux/file.h>
  28 #include <linux/mman.h>
  29 #include <linux/a.out.h>
  30 #include <linux/stat.h>
  31 #include <linux/fcntl.h>
  32 #include <linux/smp_lock.h>
  33 #include <linux/init.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/highmem.h>
  36
  37 #include <asm/uaccess.h>
  38 #include <asm/pgalloc.h>
  39 #include <asm/mmu_context.h>
  40
  41 #ifdef CONFIG_KMOD
  42 #include <linux/kmod.h>
  43 #endif
  44
  45 static struct linux_binfmt *formats = (struct linux_binfmt *) NULL;
  46
  47 int register_binfmt(struct linux_binfmt * fmt)
  48 {
  49         struct linux_binfmt ** tmp = &formats;
  50
  51         if (!fmt)
  52                 return -EINVAL;
  53         if (fmt->next)
  54                 return -EBUSY;
  55         while (*tmp) {
  56                 if (fmt == *tmp)
  57                         return -EBUSY;
  58                 tmp = &(*tmp)->next;
  59         }
  60         fmt->next = formats;
  61         formats = fmt;
  62         return 0;
  63 }
  64
  65 int unregister_binfmt(struct linux_binfmt * fmt)
  66 {
  67         struct linux_binfmt ** tmp = &formats;
  68
  69         while (*tmp) {
  70                 if (fmt == *tmp) {
  71                         *tmp = fmt->next;
  72                         return 0;
  73                 }
  74                 tmp = &(*tmp)->next;
  75         }
  76         return -EINVAL;
  77 }
  78
  79 /* N.B. Error returns must be < 0 */
  80 int open_dentry(struct dentry * dentry, int mode)
  81 {
  82         struct inode * inode = dentry->d_inode;
  83         struct file * f;
  84         struct list_head * l = NULL;
  85         int fd, error;
  86
  87         if (inode->i_sb)
  88                 l = &inode->i_sb->s_files;
  89
  90         error = -EINVAL;
  91         if (!inode->i_fop)
  92                 goto out;
  93         fd = get_unused_fd();
  94         if (fd >= 0) {
  95                 error = -ENFILE;
  96                 f = get_empty_filp();
  97                 if (!f)
  98                         goto out_fd;
  99                 f->f_flags = mode;
 100                 f->f_mode = (mode+1) & O_ACCMODE;
 101                 f->f_dentry = dentry;
 102                 f->f_pos = 0;
 103                 f->f_reada = 0;
 104                 f->f_op = inode->i_fop;
 105                 if (f->f_op->open) {
 106                         error = f->f_op->open(inode,f);
 107                         if (error)
 108                                 goto out_filp;
 109                 }
 110                 file_move(f, l);
 111                 fd_install(fd, f);
 112                 dget(dentry);
 113         }
 114         return fd;
 115
 116 out_filp:
 117         if (error > 0)
 118                 error = -EIO;
 119         put_filp(f);
 120 out_fd:
 121         put_unused_fd(fd);
 122 out:
 123         return error;
 124 }
 125
 126 /*
 127  * Note that a shared library must be both readable and executable due to
 128  * security reasons.
 129  *
 130  * Also note that we take the address to load from from the file itself.
 131  */
 132 asmlinkage long sys_uselib(const char * library)
 133 {
 134         int fd, retval;
 135         struct file * file;
 136         struct linux_binfmt * fmt;
 137
 138         lock_kernel();
 139         fd = sys_open(library, 0, 0);
 140         retval = fd;
 141         if (fd < 0)
 142                 goto out;
 143         file = fget(fd);
 144         retval = -ENOEXEC;
 145         if (file && file->f_dentry && file->f_op && file->f_op->read) {
 146                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 147                         int (*fn)(int) = fmt->load_shlib;
 148                         if (!fn)
 149                                 continue;
 150                         /* N.B. Should use file instead of fd */
 151                         retval = fn(fd);
 152                         if (retval != -ENOEXEC)
 153                                 break;
 154                 }
 155         }
 156         fput(file);
 157         sys_close(fd);
 158 out:
 159         unlock_kernel();
 160         return retval;
 161 }
 162
 163 /*
 164  * count() counts the number of arguments/envelopes
 165  */
 166 static int count(char ** argv, int max)
 167 {
 168         int i = 0;
 169
 170         if (argv != NULL) {
 171                 for (;;) {
 172                         char * p;
 173                         int error;
 174
 175                         error = get_user(p,argv);
 176                         if (error)
 177                                 return error;
 178                         if (!p)
 179                                 break;
 180                         argv++;
 181                         if(++i > max)
 182                                 return -E2BIG;
 183                 }
 184         }
 185         return i;
 186 }
 187
 188 /*
 189  * 'copy_strings()' copies argument/envelope strings from user
 190  * memory to free pages in kernel mem. These are in a format ready
 191  * to be put directly into the top of new user memory.
 192  */
 193 int copy_strings(int argc,char ** argv, struct linux_binprm *bprm)
 194 {
 195         while (argc-- > 0) {
 196                 char *str;
 197                 int len;
 198                 unsigned long pos;
 199
 200                 if (get_user(str, argv+argc) || !str || !(len = strnlen_user(str, bprm->p)))
 201                         return -EFAULT;
 202                 if (bprm->p < len)
 203                         return -E2BIG;
 204
 205                 bprm->p -= len;
 206                 /* XXX: add architecture specific overflow check here. */
 207
 208                 pos = bprm->p;
 209                 while (len > 0) {
 210                         char *kaddr;
 211                         int i, new, err;
 212                         struct page *page;
 213                         int offset, bytes_to_copy;
 214
 215                         offset = pos % PAGE_SIZE;
 216                         i = pos/PAGE_SIZE;
 217                         page = bprm->page[i];
 218                         new = 0;
 219                         if (!page) {
 220                                 page = alloc_page(GFP_HIGHUSER);
 221                                 bprm->page[i] = page;
 222                                 if (!page)
 223                                         return -ENOMEM;
 224                                 new = 1;
 225                         }
 226                         kaddr = (char *)kmap(page);
 227
 228                         if (new && offset)
 229                                 memset(kaddr, 0, offset);
 230                         bytes_to_copy = PAGE_SIZE - offset;
 231                         if (bytes_to_copy > len) {
 232                                 bytes_to_copy = len;
 233                                 if (new)
 234                                         memset(kaddr+offset+len, 0, PAGE_SIZE-offset-len);
 235                         }
 236                         err = copy_from_user(kaddr + offset, str, bytes_to_copy);
 237                         flush_page_to_ram(page);
 238                         kunmap(page);
 239
 240                         if (err)
 241                                 return -EFAULT;
 242
 243                         pos += bytes_to_copy;
 244                         str += bytes_to_copy;
 245                         len -= bytes_to_copy;
 246                 }
 247         }
 248         return 0;
 249 }
 250
 251 /*
 252  * Like copy_strings, but get argv and its values from kernel memory.
 253  */
 254 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
 255 {
 256         int r;
 257         mm_segment_t oldfs = get_fs();
 258         set_fs(KERNEL_DS);
 259         r = copy_strings(argc, argv, bprm);
 260         set_fs(oldfs);
 261         return r;
 262 }
 263
 264 /*
 265  * This routine is used to map in a page into an address space: needed by
 266  * execve() for the initial stack and environment pages.
 267  */
 268 void put_dirty_page(struct task_struct * tsk, struct page *page, unsigned long address)
 269 {
 270         pgd_t * pgd;
 271         pmd_t * pmd;
 272         pte_t * pte;
 273
 274         if (page_count(page) != 1)
 275                 printk("mem_map disagrees with %p at %08lx\n", page, address);
 276         pgd = pgd_offset(tsk->mm, address);
 277         pmd = pmd_alloc(pgd, address);
 278         if (!pmd) {
 279                 __free_page(page);
 280                 force_sig(SIGKILL, tsk);
 281                 return;
 282         }
 283         pte = pte_alloc(pmd, address);
 284         if (!pte) {
 285                 __free_page(page);
 286                 force_sig(SIGKILL, tsk);
 287                 return;
 288         }
 289         if (!pte_none(*pte)) {
 290                 pte_ERROR(*pte);
 291                 __free_page(page);
 292                 return;
 293         }
 294         flush_page_to_ram(page);
 295         set_pte(pte, pte_mkdirty(pte_mkwrite(mk_pte(page, PAGE_COPY))));
 296 /* no need for flush_tlb */
 297 }
 298
 299 int setup_arg_pages(struct linux_binprm *bprm)
 300 {
 301         unsigned long stack_base;
 302         struct vm_area_struct *mpnt;
 303         int i;
 304
 305         stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
 306
 307         bprm->p += stack_base;
 308         if (bprm->loader)
 309                 bprm->loader += stack_base;
 310         bprm->exec += stack_base;
 311
 312         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 313         if (!mpnt)
 314                 return -ENOMEM;
 315
 316         {
 317                 mpnt->vm_mm = current->mm;
 318                 mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
 319                 mpnt->vm_end = STACK_TOP;
 320                 mpnt->vm_page_prot = PAGE_COPY;
 321                 mpnt->vm_flags = VM_STACK_FLAGS;
 322                 mpnt->vm_ops = NULL;
 323                 mpnt->vm_pgoff = 0;
 324                 mpnt->vm_file = NULL;
 325                 mpnt->vm_private_data = (void *) 0;
 326                 vmlist_modify_lock(current->mm);
 327                 insert_vm_struct(current->mm, mpnt);
 328                 vmlist_modify_unlock(current->mm);
 329                 current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 330         }
 331
 332         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 333                 if (bprm->page[i]) {
 334                         current->mm->rss++;
 335                         put_dirty_page(current,bprm->page[i],stack_base);
 336                 }
 337                 stack_base += PAGE_SIZE;
 338         }
 339
 340         return 0;
 341 }
 342
 343 /*
 344  * Read in the complete executable. This is used for "-N" files
 345  * that aren't on a block boundary, and for files on filesystems
 346  * without get_block support.
 347  */
 348 int read_exec(struct dentry *dentry, unsigned long offset,
 349         char * addr, unsigned long count, int to_kmem)
 350 {
 351         struct file file;
 352         struct inode * inode = dentry->d_inode;
 353         int result = -ENOEXEC;
 354
 355         if (!inode->i_fop)
 356                 goto end_readexec;
 357         if (init_private_file(&file, dentry, 1))
 358                 goto end_readexec;
 359         if (!file.f_op->read)
 360                 goto close_readexec;
 361         if (file.f_op->llseek) {
 362                 if (file.f_op->llseek(&file,offset,0) != offset)
 363                         goto close_readexec;
 364         } else
 365                 file.f_pos = offset;
 366         if (to_kmem) {
 367                 mm_segment_t old_fs = get_fs();
 368                 set_fs(get_ds());
 369                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 370                 set_fs(old_fs);
 371         } else {
 372                 result = verify_area(VERIFY_WRITE, addr, count);
 373                 if (result)
 374                         goto close_readexec;
 375                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 376         }
 377 close_readexec:
 378         if (file.f_op->release)
 379                 file.f_op->release(inode,&file);
 380 end_readexec:
 381         return result;
 382 }
 383
 384 static int exec_mmap(void)
 385 {
 386         struct mm_struct * mm, * old_mm;
 387
 388         old_mm = current->mm;
 389         if (old_mm && atomic_read(&old_mm->mm_users) == 1) {
 390                 flush_cache_mm(old_mm);
 391                 mm_release();
 392                 exit_mmap(old_mm);
 393                 flush_tlb_mm(old_mm);
 394                 return 0;
 395         }
 396
 397         mm = mm_alloc();
 398         if (mm) {
 399                 struct mm_struct *active_mm = current->active_mm;
 400
 401                 init_new_context(current, mm);
 402                 current->mm = mm;
 403                 current->active_mm = mm;
 404                 activate_mm(active_mm, mm);
 405                 mm_release();
 406                 if (old_mm) {
 407                         if (active_mm != old_mm) BUG();
 408                         mmput(old_mm);
 409                         return 0;
 410                 }
 411                 mmdrop(active_mm);
 412                 return 0;
 413         }
 414         return -ENOMEM;
 415 }
 416
 417 /*
 418  * This function makes sure the current process has its own signal table,
 419  * so that flush_signal_handlers can later reset the handlers without
 420  * disturbing other processes.  (Other processes might share the signal
 421  * table via the CLONE_SIGHAND option to clone().)
 422  */
 423
 424 static inline int make_private_signals(void)
 425 {
 426         struct signal_struct * newsig;
 427
 428         if (atomic_read(&current->sig->count) <= 1)
 429                 return 0;
 430         newsig = kmalloc(sizeof(*newsig), GFP_KERNEL);
 431         if (newsig == NULL)
 432                 return -ENOMEM;
 433         spin_lock_init(&newsig->siglock);
 434         atomic_set(&newsig->count, 1);
 435         memcpy(newsig->action, current->sig->action, sizeof(newsig->action));
 436         current->sig = newsig;
 437         return 0;
 438 }
 439
 440 /*
 441  * If make_private_signals() made a copy of the signal table, decrement the
 442  * refcount of the original table, and free it if necessary.
 443  * We don't do that in make_private_signals() so that we can back off
 444  * in flush_old_exec() if an error occurs after calling make_private_signals().
 445  */
 446
 447 static inline void release_old_signals(struct signal_struct * oldsig)
 448 {
 449         if (current->sig == oldsig)
 450                 return;
 451         if (atomic_dec_and_test(&oldsig->count))
 452                 kfree(oldsig);
 453 }
 454
 455 /*
 456  * These functions flushes out all traces of the currently running executable
 457  * so that a new one can be started
 458  */
 459
 460 static inline void flush_old_files(struct files_struct * files)
 461 {
 462         unsigned long j;
 463
 464         j = 0;
 465         for (;;) {
 466                 unsigned long set, i;
 467
 468                 i = j * __NFDBITS;
 469                 if (i >= files->max_fds || i >= files->max_fdset)
 470                         break;
 471                 set = xchg(&files->close_on_exec->fds_bits[j], 0);
 472                 j++;
 473                 for ( ; set ; i++,set >>= 1) {
 474                         if (set & 1)
 475                                 sys_close(i);
 476                 }
 477         }
 478 }
 479
 480 int flush_old_exec(struct linux_binprm * bprm)
 481 {
 482         char * name;
 483         int i, ch, retval;
 484         struct signal_struct * oldsig;
 485
 486         /*
 487          * Make sure we have a private signal table
 488          */
 489         task_lock(current);
 490         oldsig = current->sig;
 491         retval = make_private_signals();
 492         if (retval) goto flush_failed;
 493
 494         /*
 495          * Release all of the old mmap stuff
 496          */
 497         retval = exec_mmap();
 498         if (retval) goto mmap_failed;
 499
 500         /* This is the point of no return */
 501         release_old_signals(oldsig);
 502
 503         if (current->euid == current->uid && current->egid == current->gid)
 504                 current->dumpable = 1;
 505         name = bprm->filename;
 506         for (i=0; (ch = *(name++)) != '\0';) {
 507                 if (ch == '/')
 508                         i = 0;
 509                 else
 510                         if (i < 15)
 511                                 current->comm[i++] = ch;
 512         }
 513         current->comm[i] = '\0';
 514
 515         flush_thread();
 516
 517         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
 518             permission(bprm->dentry->d_inode,MAY_READ))
 519                 current->dumpable = 0;
 520
 521         /* An exec changes our domain. We are no longer part of the thread
 522            group */
 523
 524         current->self_exec_id++;
 525
 526         flush_signal_handlers(current);
 527         flush_old_files(current->files);
 528         task_unlock(current);
 529
 530         return 0;
 531
 532 mmap_failed:
 533         if (current->sig != oldsig)
 534                 kfree(current->sig);
 535 flush_failed:
 536         current->sig = oldsig;
 537         task_unlock(current);
 538         return retval;
 539 }
 540
 541 /*
 542  * We mustn't allow tracing of suid binaries, unless
 543  * the tracer has the capability to trace anything..
 544  */
 545 static inline int must_not_trace_exec(struct task_struct * p)
 546 {
 547         return (p->flags & PF_PTRACED) && !cap_raised(p->p_pptr->cap_effective, CAP_SYS_PTRACE);
 548 }
 549
 550 /*
 551  * Fill the binprm structure from the inode.
 552  * Check permissions, then read the first 512 bytes
 553  */
 554 int prepare_binprm(struct linux_binprm *bprm)
 555 {
 556         int mode;
 557         int retval,id_change,cap_raised;
 558         struct inode * inode = bprm->dentry->d_inode;
 559
 560         mode = inode->i_mode;
 561         if (!S_ISREG(mode))                     /* must be regular file */
 562                 return -EACCES;
 563         if (!(mode & 0111))                     /* with at least _one_ execute bit set */
 564                 return -EACCES;
 565         if (IS_NOEXEC(inode))                   /* FS mustn't be mounted noexec */
 566                 return -EACCES;
 567         if (!inode->i_sb)
 568                 return -EACCES;
 569         if ((retval = permission(inode, MAY_EXEC)) != 0)
 570                 return retval;
 571         /* better not execute files which are being written to */
 572         if (atomic_read(&inode->i_writecount) > 0)
 573                 return -ETXTBSY;
 574
 575         bprm->e_uid = current->euid;
 576         bprm->e_gid = current->egid;
 577         id_change = cap_raised = 0;
 578
 579         /* Set-uid? */
 580         if (mode & S_ISUID) {
 581                 bprm->e_uid = inode->i_uid;
 582                 if (bprm->e_uid != current->euid)
 583                         id_change = 1;
 584         }
 585
 586         /* Set-gid? */
 587         /*
 588          * If setgid is set but no group execute bit then this
 589          * is a candidate for mandatory locking, not a setgid
 590          * executable.
 591          */
 592         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 593                 bprm->e_gid = inode->i_gid;
 594                 if (!in_group_p(bprm->e_gid))
 595                         id_change = 1;
 596         }
 597
 598         /* We don't have VFS support for capabilities yet */
 599         cap_clear(bprm->cap_inheritable);
 600         cap_clear(bprm->cap_permitted);
 601         cap_clear(bprm->cap_effective);
 602
 603         /*  To support inheritance of root-permissions and suid-root
 604          *  executables under compatibility mode, we raise the
 605          *  effective and inherited bitmasks of the executable file
 606          *  (translation: we set the executable "capability dumb" and
 607          *  set the allowed set to maximum). We don't set any forced
 608          *  bits.
 609          *
 610          *  If only the real uid is 0, we only raise the inheritable
 611          *  bitmask of the executable file (translation: we set the
 612          *  allowed set to maximum and the application to "capability
 613          *  smart").
 614          */
 615
 616         if (!issecure(SECURE_NOROOT)) {
 617                 if (bprm->e_uid == 0 || current->uid == 0)
 618                         cap_set_full(bprm->cap_inheritable);
 619                 if (bprm->e_uid == 0)
 620                         cap_set_full(bprm->cap_effective);
 621         }
 622
 623         /* Only if pP' is _not_ a subset of pP, do we consider there
 624          * has been a capability related "change of capability".  In
 625          * such cases, we need to check that the elevation of
 626          * privilege does not go against other system constraints.
 627          * The new Permitted set is defined below -- see (***). */
 628         {
 629                 kernel_cap_t working =
 630                         cap_combine(bprm->cap_permitted,
 631                                     cap_intersect(bprm->cap_inheritable,
 632                                                   current->cap_inheritable));
 633                 if (!cap_issubset(working, current->cap_permitted)) {
 634                         cap_raised = 1;
 635                 }
 636         }
 637
 638         if (id_change || cap_raised) {
 639                 /* We can't suid-execute if we're sharing parts of the executable */
 640                 /* or if we're being traced (or if suid execs are not allowed)    */
 641                 /* (current->mm->mm_users > 1 is ok, as we'll get a new mm anyway)   */
 642                 if (IS_NOSUID(inode)
 643                     || must_not_trace_exec(current)
 644                     || (atomic_read(&current->fs->count) > 1)
 645                     || (atomic_read(&current->sig->count) > 1)
 646                     || (atomic_read(&current->files->count) > 1)) {
 647                         if (id_change && !capable(CAP_SETUID))
 648                                 return -EPERM;
 649                         if (cap_raised && !capable(CAP_SETPCAP))
 650                                 return -EPERM;
 651                 }
 652         }
 653
 654         memset(bprm->buf,0,sizeof(bprm->buf));
 655         return read_exec(bprm->dentry,0,bprm->buf,128,1);
 656 }
 657
 658 /*
 659  * This function is used to produce the new IDs and capabilities
 660  * from the old ones and the file's capabilities.
 661  *
 662  * The formula used for evolving capabilities is:
 663  *
 664  *       pI' = pI
 665  * (***) pP' = fP | (fI & pI)
 666  *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 667  *
 668  * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 669  * ' indicates post-exec().
 670  */
 671
 672 void compute_creds(struct linux_binprm *bprm)
 673 {
 674         int new_permitted = cap_t(bprm->cap_permitted) |
 675                 (cap_t(bprm->cap_inheritable) &
 676                  cap_t(current->cap_inheritable));
 677
 678         /* For init, we want to retain the capabilities set
 679          * in the init_task struct. Thus we skip the usual
 680          * capability rules */
 681         if (current->pid != 1) {
 682                 cap_t(current->cap_permitted) = new_permitted;
 683                 cap_t(current->cap_effective) = new_permitted &
 684                                                 cap_t(bprm->cap_effective);
 685         }
 686
 687         /* AUD: Audit candidate if current->cap_effective is set */
 688
 689         current->suid = current->euid = current->fsuid = bprm->e_uid;
 690         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 691         if (current->euid != current->uid || current->egid != current->gid ||
 692             !cap_issubset(new_permitted, current->cap_permitted))
 693                 current->dumpable = 0;
 694 }
 695
 696
 697 void remove_arg_zero(struct linux_binprm *bprm)
 698 {
 699         if (bprm->argc) {
 700                 unsigned long offset;
 701                 char * kaddr;
 702                 struct page *page;
 703
 704                 offset = bprm->p % PAGE_SIZE;
 705                 goto inside;
 706
 707                 while (bprm->p++, *(kaddr+offset++)) {
 708                         if (offset != PAGE_SIZE)
 709                                 continue;
 710                         offset = 0;
 711                         kunmap(page);
 712 inside:
 713                         page = bprm->page[bprm->p/PAGE_SIZE];
 714                         kaddr = (char *)kmap(page);
 715                 }
 716                 kunmap(page);
 717                 bprm->argc--;
 718         }
 719 }
 720
 721 /*
 722  * cycle the list of binary formats handler, until one recognizes the image
 723  */
 724 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 725 {
 726         int try,retval=0;
 727         struct linux_binfmt *fmt;
 728 #ifdef __alpha__
 729         /* handle /sbin/loader.. */
 730         {
 731             struct exec * eh = (struct exec *) bprm->buf;
 732             struct linux_binprm bprm_loader;
 733
 734             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
 735                 (eh->fh.f_flags & 0x3000) == 0x3000)
 736             {
 737                 int i;
 738                 char * dynloader[] = { "/sbin/loader" };
 739                 struct dentry * dentry;
 740
 741                 lock_kernel();
 742                 dput(bprm->dentry);
 743                 unlock_kernel();
 744                 bprm->dentry = NULL;
 745
 746                 bprm_loader.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 747                 for (i = 0 ; i < MAX_ARG_PAGES ; i++)   /* clear page-table */
 748                     bprm_loader.page[i] = NULL;
 749
 750                 lock_kernel();
 751                 dentry = open_namei(dynloader[0], 0, 0);
 752                 unlock_kernel();
 753                 retval = PTR_ERR(dentry);
 754                 if (IS_ERR(dentry))
 755                         return retval;
 756                 bprm->dentry = dentry;
 757                 bprm->loader = bprm_loader.p;
 758                 retval = prepare_binprm(bprm);
 759                 if (retval<0)
 760                         return retval;
 761                 /* should call search_binary_handler recursively here,
 762                    but it does not matter */
 763             }
 764         }
 765 #endif
 766         for (try=0; try<2; try++) {
 767                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 768                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
 769                         if (!fn)
 770                                 continue;
 771                         retval = fn(bprm, regs);
 772                         if (retval >= 0) {
 773                                 if (bprm->dentry) {
 774                                         lock_kernel();
 775                                         dput(bprm->dentry);
 776                                         unlock_kernel();
 777                                 }
 778                                 bprm->dentry = NULL;
 779                                 current->did_exec = 1;
 780                                 return retval;
 781                         }
 782                         if (retval != -ENOEXEC)
 783                                 break;
 784                         if (!bprm->dentry) /* We don't have the dentry anymore */
 785                                 return retval;
 786                 }
 787                 if (retval != -ENOEXEC) {
 788                         break;
 789 #ifdef CONFIG_KMOD
 790                 }else{
 791 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
 792                         char modname[20];
 793                         if (printable(bprm->buf[0]) &&
 794                             printable(bprm->buf[1]) &&
 795                             printable(bprm->buf[2]) &&
 796                             printable(bprm->buf[3]))
 797                                 break; /* -ENOEXEC */
 798                         sprintf(modname, "binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 799                         request_module(modname);
 800 #endif
 801                 }
 802         }
 803         return retval;
 804 }
 805
 806
 807 /*
 808  * sys_execve() executes a new program.
 809  */
 810 int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
 811 {
 812         struct linux_binprm bprm;
 813         struct dentry * dentry;
 814         int retval;
 815         int i;
 816
 817         bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 818         memset(bprm.page, 0, MAX_ARG_PAGES*sizeof(bprm.page[0]));
 819
 820         lock_kernel();
 821         dentry = open_namei(filename, 0, 0);
 822         unlock_kernel();
 823
 824         retval = PTR_ERR(dentry);
 825         if (IS_ERR(dentry))
 826                 return retval;
 827
 828         bprm.dentry = dentry;
 829         bprm.filename = filename;
 830         bprm.sh_bang = 0;
 831         bprm.loader = 0;
 832         bprm.exec = 0;
 833         if ((bprm.argc = count(argv, bprm.p / sizeof(void *))) < 0) {
 834                 lock_kernel();
 835                 dput(dentry);
 836                 unlock_kernel();
 837                 return bprm.argc;
 838         }
 839
 840         if ((bprm.envc = count(envp, bprm.p / sizeof(void *))) < 0) {
 841                 lock_kernel();
 842                 dput(dentry);
 843                 unlock_kernel();
 844                 return bprm.envc;
 845         }
 846
 847         retval = prepare_binprm(&bprm);
 848         if (retval < 0)
 849                 goto out;
 850
 851         retval = copy_strings_kernel(1, &bprm.filename, &bprm);
 852         if (retval < 0)
 853                 goto out;
 854
 855         bprm.exec = bprm.p;
 856         retval = copy_strings(bprm.envc, envp, &bprm);
 857         if (retval < 0)
 858                 goto out;
 859
 860         retval = copy_strings(bprm.argc, argv, &bprm);
 861         if (retval < 0)
 862                 goto out;
 863
 864         retval = search_binary_handler(&bprm,regs);
 865         if (retval >= 0)
 866                 /* execve success */
 867                 return retval;
 868
 869 out:
 870         /* Something went wrong, return the inode and free the argument pages*/
 871         if (bprm.dentry) {
 872                 lock_kernel();
 873                 dput(bprm.dentry);
 874                 unlock_kernel();
 875         }
 876
 877         /* Assumes that free_page() can take a NULL argument. */
 878         /* I hope this is ok for all architectures */
 879         for (i = 0 ; i < MAX_ARG_PAGES ; i++)
 880                 if (bprm.page[i])
 881                         __free_page(bprm.page[i]);
 882
 883         return retval;
 884 }
 885
 886 int do_coredump(long signr, struct pt_regs * regs)
 887 {
 888         struct linux_binfmt * binfmt;
 889         char corename[6+sizeof(current->comm)];
 890         struct file * file;
 891         struct dentry * dentry;
 892         struct inode * inode;
 893
 894         lock_kernel();
 895         binfmt = current->binfmt;
 896         if (!binfmt || !binfmt->core_dump)
 897                 goto fail;
 898         if (!current->dumpable || atomic_read(&current->mm->mm_users) != 1)
 899                 goto fail;
 900         current->dumpable = 0;
 901         if (current->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
 902                 goto fail;
 903
 904         memcpy(corename,"core.", 5);
 905 #if 0
 906         memcpy(corename+5,current->comm,sizeof(current->comm));
 907 #else
 908         corename[4] = '\0';
 909 #endif
 910         file = filp_open(corename, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
 911         if (IS_ERR(file))
 912                 goto fail;
 913         dentry = file->f_dentry;
 914         inode = dentry->d_inode;
 915         if (inode->i_nlink > 1)
 916                 goto close_fail;        /* multiple links - don't dump */
 917
 918         if (!S_ISREG(inode->i_mode))
 919                 goto close_fail;
 920         if (!inode->i_fop)
 921                 goto close_fail;
 922         if (!file->f_op->write)
 923                 goto close_fail;
 924         if (!binfmt->core_dump(signr, regs, file))
 925                 goto close_fail;
 926         filp_close(file, NULL);
 927         unlock_kernel();
 928         return 1;
 929
 930 close_fail:
 931         filp_close(file, NULL);
 932 fail:
 933         unlock_kernel();
 934         return 0;
 935 }