fs/exec.c

   1 /*
   2  *  linux/fs/exec.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * #!-checking implemented by tytso.
   9  */
  10 /*
  11  * Demand-loading implemented 01.12.91 - no need to read anything but
  12  * the header into memory. The inode of the executable is put into
  13  * "current->executable", and page faults do the actual loading. Clean.
  14  *
  15  * Once more I can proudly say that linux stood up to being changed: it
  16  * was less than 2 hours work to get demand-loading completely implemented.
  17  *
  18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  19  * current->executable is only used by the procfs.  This allows a dispatch
  20  * table to check for several different types  of binary formats.  We keep
  21  * trying until we recognize the file or we run out of supported binary
  22  * formats.
  23  */
  24
  25 #include <linux/config.h>
  26 #include <linux/slab.h>
  27 #include <linux/file.h>
  28 #include <linux/mman.h>
  29 #include <linux/a.out.h>
  30 #include <linux/stat.h>
  31 #include <linux/fcntl.h>
  32 #include <linux/smp_lock.h>
  33 #include <linux/init.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/highmem.h>
  36 #include <linux/spinlock.h>
  37 #define __NO_VERSION__
  38 #include <linux/module.h>
  39
  40 #include <asm/uaccess.h>
  41 #include <asm/pgalloc.h>
  42 #include <asm/mmu_context.h>
  43
  44 #ifdef CONFIG_KMOD
  45 #include <linux/kmod.h>
  46 #endif
  47
  48 static struct linux_binfmt *formats;
  49 static rwlock_t binfmt_lock = RW_LOCK_UNLOCKED;
  50
  51 int register_binfmt(struct linux_binfmt * fmt)
  52 {
  53         struct linux_binfmt ** tmp = &formats;
  54
  55         if (!fmt)
  56                 return -EINVAL;
  57         if (fmt->next)
  58                 return -EBUSY;
  59         write_lock(&binfmt_lock);
  60         while (*tmp) {
  61                 if (fmt == *tmp) {
  62                         write_unlock(&binfmt_lock);
  63                         return -EBUSY;
  64                 }
  65                 tmp = &(*tmp)->next;
  66         }
  67         fmt->next = formats;
  68         formats = fmt;
  69         write_unlock(&binfmt_lock);
  70         return 0;
  71 }
  72
  73 int unregister_binfmt(struct linux_binfmt * fmt)
  74 {
  75         struct linux_binfmt ** tmp = &formats;
  76
  77         write_lock(&binfmt_lock);
  78         while (*tmp) {
  79                 if (fmt == *tmp) {
  80                         *tmp = fmt->next;
  81                         write_unlock(&binfmt_lock);
  82                         return 0;
  83                 }
  84                 tmp = &(*tmp)->next;
  85         }
  86         write_unlock(&binfmt_lock);
  87         return -EINVAL;
  88 }
  89
  90 static inline void put_binfmt(struct linux_binfmt * fmt)
  91 {
  92         if (fmt->module)
  93                 __MOD_DEC_USE_COUNT(fmt->module);
  94 }
  95
  96 /*
  97  * Note that a shared library must be both readable and executable due to
  98  * security reasons.
  99  *
 100  * Also note that we take the address to load from from the file itself.
 101  */
 102 asmlinkage long sys_uselib(const char * library)
 103 {
 104         struct file * file;
 105         struct nameidata nd;
 106         int error;
 107
 108         error = user_path_walk(library, &nd);
 109         if (error)
 110                 goto out;
 111
 112         error = -EINVAL;
 113         if (!S_ISREG(nd.dentry->d_inode->i_mode))
 114                 goto exit;
 115
 116         error = permission(nd.dentry->d_inode, MAY_READ | MAY_EXEC);
 117         if (error)
 118                 goto exit;
 119
 120         file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
 121         error = PTR_ERR(file);
 122         if (IS_ERR(file))
 123                 goto out;
 124
 125         error = -ENOEXEC;
 126         if(file->f_op && file->f_op->read) {
 127                 struct linux_binfmt * fmt;
 128
 129                 read_lock(&binfmt_lock);
 130                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 131                         if (!fmt->load_shlib)
 132                                 continue;
 133                         if (!try_inc_mod_count(fmt->module))
 134                                 continue;
 135                         read_unlock(&binfmt_lock);
 136                         error = fmt->load_shlib(file);
 137                         read_lock(&binfmt_lock);
 138                         put_binfmt(fmt);
 139                         if (error != -ENOEXEC)
 140                                 break;
 141                 }
 142                 read_unlock(&binfmt_lock);
 143         }
 144         fput(file);
 145 out:
 146         return error;
 147 exit:
 148         path_release(&nd);
 149         goto out;
 150 }
 151
 152 /*
 153  * count() counts the number of arguments/envelopes
 154  */
 155 static int count(char ** argv, int max)
 156 {
 157         int i = 0;
 158
 159         if (argv != NULL) {
 160                 for (;;) {
 161                         char * p;
 162                         int error;
 163
 164                         error = get_user(p,argv);
 165                         if (error)
 166                                 return error;
 167                         if (!p)
 168                                 break;
 169                         argv++;
 170                         if(++i > max)
 171                                 return -E2BIG;
 172                 }
 173         }
 174         return i;
 175 }
 176
 177 /*
 178  * 'copy_strings()' copies argument/envelope strings from user
 179  * memory to free pages in kernel mem. These are in a format ready
 180  * to be put directly into the top of new user memory.
 181  */
 182 int copy_strings(int argc,char ** argv, struct linux_binprm *bprm)
 183 {
 184         while (argc-- > 0) {
 185                 char *str;
 186                 int len;
 187                 unsigned long pos;
 188
 189                 if (get_user(str, argv+argc) || !str || !(len = strnlen_user(str, bprm->p)))
 190                         return -EFAULT;
 191                 if (bprm->p < len)
 192                         return -E2BIG;
 193
 194                 bprm->p -= len;
 195                 /* XXX: add architecture specific overflow check here. */
 196
 197                 pos = bprm->p;
 198                 while (len > 0) {
 199                         char *kaddr;
 200                         int i, new, err;
 201                         struct page *page;
 202                         int offset, bytes_to_copy;
 203
 204                         offset = pos % PAGE_SIZE;
 205                         i = pos/PAGE_SIZE;
 206                         page = bprm->page[i];
 207                         new = 0;
 208                         if (!page) {
 209                                 page = alloc_page(GFP_HIGHUSER);
 210                                 bprm->page[i] = page;
 211                                 if (!page)
 212                                         return -ENOMEM;
 213                                 new = 1;
 214                         }
 215                         kaddr = (char *)kmap(page);
 216
 217                         if (new && offset)
 218                                 memset(kaddr, 0, offset);
 219                         bytes_to_copy = PAGE_SIZE - offset;
 220                         if (bytes_to_copy > len) {
 221                                 bytes_to_copy = len;
 222                                 if (new)
 223                                         memset(kaddr+offset+len, 0, PAGE_SIZE-offset-len);
 224                         }
 225                         err = copy_from_user(kaddr + offset, str, bytes_to_copy);
 226                         flush_page_to_ram(page);
 227                         kunmap(page);
 228
 229                         if (err)
 230                                 return -EFAULT;
 231
 232                         pos += bytes_to_copy;
 233                         str += bytes_to_copy;
 234                         len -= bytes_to_copy;
 235                 }
 236         }
 237         return 0;
 238 }
 239
 240 /*
 241  * Like copy_strings, but get argv and its values from kernel memory.
 242  */
 243 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
 244 {
 245         int r;
 246         mm_segment_t oldfs = get_fs();
 247         set_fs(KERNEL_DS);
 248         r = copy_strings(argc, argv, bprm);
 249         set_fs(oldfs);
 250         return r;
 251 }
 252
 253 /*
 254  * This routine is used to map in a page into an address space: needed by
 255  * execve() for the initial stack and environment pages.
 256  */
 257 void put_dirty_page(struct task_struct * tsk, struct page *page, unsigned long address)
 258 {
 259         pgd_t * pgd;
 260         pmd_t * pmd;
 261         pte_t * pte;
 262
 263         if (page_count(page) != 1)
 264                 printk("mem_map disagrees with %p at %08lx\n", page, address);
 265         pgd = pgd_offset(tsk->mm, address);
 266         pmd = pmd_alloc(pgd, address);
 267         if (!pmd) {
 268                 __free_page(page);
 269                 force_sig(SIGKILL, tsk);
 270                 return;
 271         }
 272         pte = pte_alloc(pmd, address);
 273         if (!pte) {
 274                 __free_page(page);
 275                 force_sig(SIGKILL, tsk);
 276                 return;
 277         }
 278         if (!pte_none(*pte)) {
 279                 pte_ERROR(*pte);
 280                 __free_page(page);
 281                 return;
 282         }
 283         flush_page_to_ram(page);
 284         set_pte(pte, pte_mkdirty(pte_mkwrite(mk_pte(page, PAGE_COPY))));
 285 /* no need for flush_tlb */
 286 }
 287
 288 int setup_arg_pages(struct linux_binprm *bprm)
 289 {
 290         unsigned long stack_base;
 291         struct vm_area_struct *mpnt;
 292         int i;
 293
 294         stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
 295
 296         bprm->p += stack_base;
 297         if (bprm->loader)
 298                 bprm->loader += stack_base;
 299         bprm->exec += stack_base;
 300
 301         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 302         if (!mpnt)
 303                 return -ENOMEM;
 304
 305         down(&current->mm->mmap_sem);
 306         {
 307                 mpnt->vm_mm = current->mm;
 308                 mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
 309                 mpnt->vm_end = STACK_TOP;
 310                 mpnt->vm_page_prot = PAGE_COPY;
 311                 mpnt->vm_flags = VM_STACK_FLAGS;
 312                 mpnt->vm_ops = NULL;
 313                 mpnt->vm_pgoff = 0;
 314                 mpnt->vm_file = NULL;
 315                 mpnt->vm_private_data = (void *) 0;
 316                 vmlist_modify_lock(current->mm);
 317                 insert_vm_struct(current->mm, mpnt);
 318                 vmlist_modify_unlock(current->mm);
 319                 current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 320         }
 321
 322         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 323                 struct page *page = bprm->page[i];
 324                 if (page) {
 325                         bprm->page[i] = NULL;
 326                         current->mm->rss++;
 327                         put_dirty_page(current,page,stack_base);
 328                 }
 329                 stack_base += PAGE_SIZE;
 330         }
 331         up(&current->mm->mmap_sem);
 332
 333         return 0;
 334 }
 335
 336 struct file *open_exec(const char *name)
 337 {
 338         struct nameidata nd;
 339         struct inode *inode;
 340         struct file *file;
 341         int err = 0;
 342
 343         if (path_init(name, LOOKUP_FOLLOW|LOOKUP_POSITIVE, &nd))
 344                 err = path_walk(name, &nd);
 345         file = ERR_PTR(err);
 346         if (!err) {
 347                 inode = nd.dentry->d_inode;
 348                 file = ERR_PTR(-EACCES);
 349                 if (!IS_NOEXEC(inode) && S_ISREG(inode->i_mode)) {
 350                         int err = permission(inode, MAY_EXEC);
 351                         file = ERR_PTR(err);
 352                         if (!err) {
 353                                 file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
 354                                 if (!IS_ERR(file)) {
 355                                         err = deny_write_access(file);
 356                                         if (err) {
 357                                                 fput(file);
 358                                                 file = ERR_PTR(err);
 359                                         }
 360                                 }
 361 out:
 362                                 return file;
 363                         }
 364                 }
 365                 path_release(&nd);
 366         }
 367         goto out;
 368 }
 369
 370 int kernel_read(struct file *file, unsigned long offset,
 371         char * addr, unsigned long count)
 372 {
 373         mm_segment_t old_fs;
 374         loff_t pos = offset;
 375         int result = -ENOSYS;
 376
 377         if (!file->f_op->read)
 378                 goto fail;
 379         old_fs = get_fs();
 380         set_fs(get_ds());
 381         result = file->f_op->read(file, addr, count, &pos);
 382         set_fs(old_fs);
 383 fail:
 384         return result;
 385 }
 386
 387 static int exec_mmap(void)
 388 {
 389         struct mm_struct * mm, * old_mm;
 390
 391         old_mm = current->mm;
 392         if (old_mm && atomic_read(&old_mm->mm_users) == 1) {
 393                 flush_cache_mm(old_mm);
 394                 mm_release();
 395                 exit_mmap(old_mm);
 396                 flush_tlb_mm(old_mm);
 397                 return 0;
 398         }
 399
 400         mm = mm_alloc();
 401         if (mm) {
 402                 struct mm_struct *active_mm = current->active_mm;
 403
 404                 init_new_context(current, mm);
 405                 task_lock(current);
 406                 current->mm = mm;
 407                 current->active_mm = mm;
 408                 task_unlock(current);
 409                 activate_mm(active_mm, mm);
 410                 mm_release();
 411                 if (old_mm) {
 412                         if (active_mm != old_mm) BUG();
 413                         mmput(old_mm);
 414                         return 0;
 415                 }
 416                 mmdrop(active_mm);
 417                 return 0;
 418         }
 419         return -ENOMEM;
 420 }
 421
 422 /*
 423  * This function makes sure the current process has its own signal table,
 424  * so that flush_signal_handlers can later reset the handlers without
 425  * disturbing other processes.  (Other processes might share the signal
 426  * table via the CLONE_SIGHAND option to clone().)
 427  */
 428
 429 static inline int make_private_signals(void)
 430 {
 431         struct signal_struct * newsig;
 432
 433         if (atomic_read(&current->sig->count) <= 1)
 434                 return 0;
 435         newsig = kmalloc(sizeof(*newsig), GFP_KERNEL);
 436         if (newsig == NULL)
 437                 return -ENOMEM;
 438         spin_lock_init(&newsig->siglock);
 439         atomic_set(&newsig->count, 1);
 440         memcpy(newsig->action, current->sig->action, sizeof(newsig->action));
 441         spin_lock_irq(&current->sigmask_lock);
 442         current->sig = newsig;
 443         spin_unlock_irq(&current->sigmask_lock);
 444         return 0;
 445 }
 446
 447 /*
 448  * If make_private_signals() made a copy of the signal table, decrement the
 449  * refcount of the original table, and free it if necessary.
 450  * We don't do that in make_private_signals() so that we can back off
 451  * in flush_old_exec() if an error occurs after calling make_private_signals().
 452  */
 453
 454 static inline void release_old_signals(struct signal_struct * oldsig)
 455 {
 456         if (current->sig == oldsig)
 457                 return;
 458         if (atomic_dec_and_test(&oldsig->count))
 459                 kfree(oldsig);
 460 }
 461
 462 /*
 463  * These functions flushes out all traces of the currently running executable
 464  * so that a new one can be started
 465  */
 466
 467 static inline void flush_old_files(struct files_struct * files)
 468 {
 469         unsigned long j;
 470
 471         j = 0;
 472         for (;;) {
 473                 unsigned long set, i;
 474
 475                 i = j * __NFDBITS;
 476                 if (i >= files->max_fds || i >= files->max_fdset)
 477                         break;
 478                 set = xchg(&files->close_on_exec->fds_bits[j], 0);
 479                 j++;
 480                 for ( ; set ; i++,set >>= 1) {
 481                         if (set & 1)
 482                                 sys_close(i);
 483                 }
 484         }
 485 }
 486
 487 int flush_old_exec(struct linux_binprm * bprm)
 488 {
 489         char * name;
 490         int i, ch, retval;
 491         struct signal_struct * oldsig;
 492
 493         /*
 494          * Make sure we have a private signal table
 495          */
 496         oldsig = current->sig;
 497         retval = make_private_signals();
 498         if (retval) goto flush_failed;
 499
 500         /*
 501          * Release all of the old mmap stuff
 502          */
 503         retval = exec_mmap();
 504         if (retval) goto mmap_failed;
 505
 506         /* This is the point of no return */
 507         release_old_signals(oldsig);
 508
 509         current->sas_ss_sp = current->sas_ss_size = 0;
 510
 511         if (current->euid == current->uid && current->egid == current->gid)
 512                 current->dumpable = 1;
 513         name = bprm->filename;
 514         for (i=0; (ch = *(name++)) != '\0';) {
 515                 if (ch == '/')
 516                         i = 0;
 517                 else
 518                         if (i < 15)
 519                                 current->comm[i++] = ch;
 520         }
 521         current->comm[i] = '\0';
 522
 523         flush_thread();
 524
 525         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
 526             permission(bprm->file->f_dentry->d_inode,MAY_READ))
 527                 current->dumpable = 0;
 528
 529         /* An exec changes our domain. We are no longer part of the thread
 530            group */
 531
 532         current->self_exec_id++;
 533
 534         flush_signal_handlers(current);
 535         flush_old_files(current->files);
 536
 537         return 0;
 538
 539 mmap_failed:
 540 flush_failed:
 541         spin_lock_irq(&current->sigmask_lock);
 542         if (current->sig != oldsig)
 543                 kfree(current->sig);
 544         current->sig = oldsig;
 545         spin_unlock_irq(&current->sigmask_lock);
 546         return retval;
 547 }
 548
 549 /*
 550  * We mustn't allow tracing of suid binaries, unless
 551  * the tracer has the capability to trace anything..
 552  */
 553 static inline int must_not_trace_exec(struct task_struct * p)
 554 {
 555         return (p->ptrace & PT_PTRACED) && !cap_raised(p->p_pptr->cap_effective, CAP_SYS_PTRACE);
 556 }
 557
 558 /*
 559  * Fill the binprm structure from the inode.
 560  * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
 561  */
 562 int prepare_binprm(struct linux_binprm *bprm)
 563 {
 564         int mode;
 565         int id_change,cap_raised;
 566         struct inode * inode = bprm->file->f_dentry->d_inode;
 567
 568         mode = inode->i_mode;
 569         /* Huh? We had already checked for MAY_EXEC, WTF do we check this? */
 570         if (!(mode & 0111))     /* with at least _one_ execute bit set */
 571                 return -EACCES;
 572
 573         bprm->e_uid = current->euid;
 574         bprm->e_gid = current->egid;
 575         id_change = cap_raised = 0;
 576
 577         /* Set-uid? */
 578         if (mode & S_ISUID) {
 579                 bprm->e_uid = inode->i_uid;
 580                 if (bprm->e_uid != current->euid)
 581                         id_change = 1;
 582         }
 583
 584         /* Set-gid? */
 585         /*
 586          * If setgid is set but no group execute bit then this
 587          * is a candidate for mandatory locking, not a setgid
 588          * executable.
 589          */
 590         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 591                 bprm->e_gid = inode->i_gid;
 592                 if (!in_group_p(bprm->e_gid))
 593                         id_change = 1;
 594         }
 595
 596         /* We don't have VFS support for capabilities yet */
 597         cap_clear(bprm->cap_inheritable);
 598         cap_clear(bprm->cap_permitted);
 599         cap_clear(bprm->cap_effective);
 600
 601         /*  To support inheritance of root-permissions and suid-root
 602          *  executables under compatibility mode, we raise all three
 603          *  capability sets for the file.
 604          *
 605          *  If only the real uid is 0, we only raise the inheritable
 606          *  and permitted sets of the executable file.
 607          */
 608
 609         if (!issecure(SECURE_NOROOT)) {
 610                 if (bprm->e_uid == 0 || current->uid == 0) {
 611                         cap_set_full(bprm->cap_inheritable);
 612                         cap_set_full(bprm->cap_permitted);
 613                 }
 614                 if (bprm->e_uid == 0)
 615                         cap_set_full(bprm->cap_effective);
 616         }
 617
 618         /* Only if pP' is _not_ a subset of pP, do we consider there
 619          * has been a capability related "change of capability".  In
 620          * such cases, we need to check that the elevation of
 621          * privilege does not go against other system constraints.
 622          * The new Permitted set is defined below -- see (***). */
 623         {
 624                 kernel_cap_t permitted, working;
 625
 626                 permitted = cap_intersect(bprm->cap_permitted, cap_bset);
 627                 working = cap_intersect(bprm->cap_inheritable,
 628                                         current->cap_inheritable);
 629                 working = cap_combine(permitted, working);
 630                 if (!cap_issubset(working, current->cap_permitted)) {
 631                         cap_raised = 1;
 632                 }
 633         }
 634
 635         if (id_change || cap_raised) {
 636                 /* We can't suid-execute if we're sharing parts of the executable */
 637                 /* or if we're being traced (or if suid execs are not allowed)    */
 638                 /* (current->mm->mm_users > 1 is ok, as we'll get a new mm anyway)   */
 639                 if (IS_NOSUID(inode)
 640                     || must_not_trace_exec(current)
 641                     || (atomic_read(&current->fs->count) > 1)
 642                     || (atomic_read(&current->sig->count) > 1)
 643                     || (atomic_read(&current->files->count) > 1)) {
 644                         if (id_change && !capable(CAP_SETUID))
 645                                 return -EPERM;
 646                         if (cap_raised && !capable(CAP_SETPCAP))
 647                                 return -EPERM;
 648                 }
 649         }
 650
 651         memset(bprm->buf,0,BINPRM_BUF_SIZE);
 652         return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
 653 }
 654
 655 /*
 656  * This function is used to produce the new IDs and capabilities
 657  * from the old ones and the file's capabilities.
 658  *
 659  * The formula used for evolving capabilities is:
 660  *
 661  *       pI' = pI
 662  * (***) pP' = (fP & X) | (fI & pI)
 663  *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 664  *
 665  * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 666  * ' indicates post-exec(), and X is the global 'cap_bset'.
 667  */
 668
 669 void compute_creds(struct linux_binprm *bprm)
 670 {
 671         kernel_cap_t new_permitted, working;
 672
 673         new_permitted = cap_intersect(bprm->cap_permitted, cap_bset);
 674         working = cap_intersect(bprm->cap_inheritable,
 675                                 current->cap_inheritable);
 676         new_permitted = cap_combine(new_permitted, working);
 677
 678         /* For init, we want to retain the capabilities set
 679          * in the init_task struct. Thus we skip the usual
 680          * capability rules */
 681         if (current->pid != 1) {
 682                 current->cap_permitted = new_permitted;
 683                 current->cap_effective =
 684                         cap_intersect(new_permitted, bprm->cap_effective);
 685         }
 686
 687         /* AUD: Audit candidate if current->cap_effective is set */
 688
 689         current->suid = current->euid = current->fsuid = bprm->e_uid;
 690         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 691         if (current->euid != current->uid || current->egid != current->gid ||
 692             !cap_issubset(new_permitted, current->cap_permitted))
 693                 current->dumpable = 0;
 694
 695         current->keep_capabilities = 0;
 696 }
 697
 698
 699 void remove_arg_zero(struct linux_binprm *bprm)
 700 {
 701         if (bprm->argc) {
 702                 unsigned long offset;
 703                 char * kaddr;
 704                 struct page *page;
 705
 706                 offset = bprm->p % PAGE_SIZE;
 707                 goto inside;
 708
 709                 while (bprm->p++, *(kaddr+offset++)) {
 710                         if (offset != PAGE_SIZE)
 711                                 continue;
 712                         offset = 0;
 713                         kunmap(page);
 714 inside:
 715                         page = bprm->page[bprm->p/PAGE_SIZE];
 716                         kaddr = (char *)kmap(page);
 717                 }
 718                 kunmap(page);
 719                 bprm->argc--;
 720         }
 721 }
 722
 723 /*
 724  * cycle the list of binary formats handler, until one recognizes the image
 725  */
 726 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 727 {
 728         int try,retval=0;
 729         struct linux_binfmt *fmt;
 730 #ifdef __alpha__
 731         /* handle /sbin/loader.. */
 732         {
 733             struct exec * eh = (struct exec *) bprm->buf;
 734             struct linux_binprm bprm_loader;
 735
 736             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
 737                 (eh->fh.f_flags & 0x3000) == 0x3000)
 738             {
 739                 int i;
 740                 char * dynloader[] = { "/sbin/loader" };
 741                 struct file * file;
 742
 743                 allow_write_access(bprm->file);
 744                 fput(bprm->file);
 745                 bprm->file = NULL;
 746
 747                 bprm_loader.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 748                 for (i = 0 ; i < MAX_ARG_PAGES ; i++)   /* clear page-table */
 749                     bprm_loader.page[i] = NULL;
 750
 751                 file = open_exec(dynloader[0]);
 752                 retval = PTR_ERR(file);
 753                 if (IS_ERR(file))
 754                         return retval;
 755                 bprm->file = file;
 756                 bprm->loader = bprm_loader.p;
 757                 retval = prepare_binprm(bprm);
 758                 if (retval<0)
 759                         return retval;
 760                 /* should call search_binary_handler recursively here,
 761                    but it does not matter */
 762             }
 763         }
 764 #endif
 765         for (try=0; try<2; try++) {
 766                 read_lock(&binfmt_lock);
 767                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 768                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
 769                         if (!fn)
 770                                 continue;
 771                         if (!try_inc_mod_count(fmt->module))
 772                                 continue;
 773                         read_unlock(&binfmt_lock);
 774                         retval = fn(bprm, regs);
 775                         if (retval >= 0) {
 776                                 put_binfmt(fmt);
 777                                 allow_write_access(bprm->file);
 778                                 if (bprm->file)
 779                                         fput(bprm->file);
 780                                 bprm->file = NULL;
 781                                 current->did_exec = 1;
 782                                 return retval;
 783                         }
 784                         read_lock(&binfmt_lock);
 785                         put_binfmt(fmt);
 786                         if (retval != -ENOEXEC)
 787                                 break;
 788                         if (!bprm->file) {
 789                                 read_unlock(&binfmt_lock);
 790                                 return retval;
 791                         }
 792                 }
 793                 read_unlock(&binfmt_lock);
 794                 if (retval != -ENOEXEC) {
 795                         break;
 796 #ifdef CONFIG_KMOD
 797                 }else{
 798 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
 799                         char modname[20];
 800                         if (printable(bprm->buf[0]) &&
 801                             printable(bprm->buf[1]) &&
 802                             printable(bprm->buf[2]) &&
 803                             printable(bprm->buf[3]))
 804                                 break; /* -ENOEXEC */
 805                         sprintf(modname, "binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 806                         request_module(modname);
 807 #endif
 808                 }
 809         }
 810         return retval;
 811 }
 812
 813
 814 /*
 815  * sys_execve() executes a new program.
 816  */
 817 int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
 818 {
 819         struct linux_binprm bprm;
 820         struct file *file;
 821         int retval;
 822         int i;
 823
 824         file = open_exec(filename);
 825
 826         retval = PTR_ERR(file);
 827         if (IS_ERR(file))
 828                 return retval;
 829
 830         bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 831         memset(bprm.page, 0, MAX_ARG_PAGES*sizeof(bprm.page[0]));
 832
 833         bprm.file = file;
 834         bprm.filename = filename;
 835         bprm.sh_bang = 0;
 836         bprm.loader = 0;
 837         bprm.exec = 0;
 838         if ((bprm.argc = count(argv, bprm.p / sizeof(void *))) < 0) {
 839                 allow_write_access(file);
 840                 fput(file);
 841                 return bprm.argc;
 842         }
 843
 844         if ((bprm.envc = count(envp, bprm.p / sizeof(void *))) < 0) {
 845                 allow_write_access(file);
 846                 fput(file);
 847                 return bprm.envc;
 848         }
 849
 850         retval = prepare_binprm(&bprm);
 851         if (retval < 0)
 852                 goto out;
 853
 854         retval = copy_strings_kernel(1, &bprm.filename, &bprm);
 855         if (retval < 0)
 856                 goto out;
 857
 858         bprm.exec = bprm.p;
 859         retval = copy_strings(bprm.envc, envp, &bprm);
 860         if (retval < 0)
 861                 goto out;
 862
 863         retval = copy_strings(bprm.argc, argv, &bprm);
 864         if (retval < 0)
 865                 goto out;
 866
 867         retval = search_binary_handler(&bprm,regs);
 868         if (retval >= 0)
 869                 /* execve success */
 870                 return retval;
 871
 872 out:
 873         /* Something went wrong, return the inode and free the argument pages*/
 874         allow_write_access(bprm.file);
 875         if (bprm.file)
 876                 fput(bprm.file);
 877
 878         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 879                 struct page * page = bprm.page[i];
 880                 if (page)
 881                         __free_page(page);
 882         }
 883
 884         return retval;
 885 }
 886
 887 void set_binfmt(struct linux_binfmt *new)
 888 {
 889         struct linux_binfmt *old = current->binfmt;
 890         if (new && new->module)
 891                 __MOD_INC_USE_COUNT(new->module);
 892         current->binfmt = new;
 893         if (old && old->module)
 894                 __MOD_DEC_USE_COUNT(old->module);
 895 }
 896
 897 int do_coredump(long signr, struct pt_regs * regs)
 898 {
 899         struct linux_binfmt * binfmt;
 900         char corename[6+sizeof(current->comm)];
 901         struct file * file;
 902         struct inode * inode;
 903
 904         lock_kernel();
 905         binfmt = current->binfmt;
 906         if (!binfmt || !binfmt->core_dump)
 907                 goto fail;
 908         if (!current->dumpable || atomic_read(&current->mm->mm_users) != 1)
 909                 goto fail;
 910         current->dumpable = 0;
 911         if (current->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
 912                 goto fail;
 913
 914         memcpy(corename,"core.", 5);
 915 #if 0
 916         memcpy(corename+5,current->comm,sizeof(current->comm));
 917 #else
 918         corename[4] = '\0';
 919 #endif
 920         file = filp_open(corename, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
 921         if (IS_ERR(file))
 922                 goto fail;
 923         inode = file->f_dentry->d_inode;
 924         if (inode->i_nlink > 1)
 925                 goto close_fail;        /* multiple links - don't dump */
 926
 927         if (!S_ISREG(inode->i_mode))
 928                 goto close_fail;
 929         if (!file->f_op)
 930                 goto close_fail;
 931         if (!file->f_op->write)
 932                 goto close_fail;
 933         if (!binfmt->core_dump(signr, regs, file))
 934                 goto close_fail;
 935         unlock_kernel();
 936         filp_close(file, NULL);
 937         return 1;
 938
 939 close_fail:
 940         filp_close(file, NULL);
 941 fail:
 942         unlock_kernel();
 943         return 0;
 944 }