1 /* $NetBSD: subr_exec_fd.c,v 1.11 2020/05/23 23:42:43 ad Exp $ */ 2 3 /*- 4 * Copyright (c) 2008 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: subr_exec_fd.c,v 1.11 2020/05/23 23:42:43 ad Exp $"); 31 32 #include <sys/param.h> 33 #include <sys/atomic.h> 34 #include <sys/file.h> 35 #include <sys/filedesc.h> 36 #include <sys/mutex.h> 37 #include <sys/namei.h> 38 #include <sys/syslog.h> 39 #include <sys/vnode.h> 40 #include <sys/ktrace.h> 41 42 void 43 fd_ktrexecfd(void) 44 { 45 proc_t *p; 46 filedesc_t *fdp; 47 fdfile_t *ff; 48 lwp_t *l; 49 fdtab_t *dt; 50 file_t *fp; 51 int fd; 52 53 l = curlwp; 54 p = l->l_proc; 55 fdp = p->p_fd; 56 dt = atomic_load_consume(&fdp->fd_dt); 57 58 for (fd = 0; fd <= fdp->fd_lastfile; fd++) { 59 if ((ff = dt->dt_ff[fd]) == NULL) { 60 KASSERT(fd >= NDFDFILE); 61 continue; 62 } 63 KASSERT(fd >= NDFDFILE || 64 ff == (fdfile_t *)fdp->fd_dfdfile[fd]); 65 if ((fp = atomic_load_consume(&ff->ff_file)) == NULL) 66 continue; 67 ktr_execfd(fd, fp->f_type); 68 } 69 } 70 71 /* 72 * It is unsafe for set[ug]id processes to be started with file 73 * descriptors 0..2 closed, as these descriptors are given implicit 74 * significance in the Standard C library. fd_checkstd() will create a 75 * descriptor referencing /dev/null for each of stdin, stdout, and 76 * stderr that is not already open. 77 */ 78 #define CHECK_UPTO 3 79 int 80 fd_checkstd(void) 81 { 82 struct proc *p; 83 struct pathbuf *pb; 84 struct nameidata nd; 85 filedesc_t *fdp; 86 file_t *fp; 87 fdtab_t *dt; 88 struct proc *pp; 89 int fd, i, error, flags = FREAD|FWRITE; 90 char closed[CHECK_UPTO * 3 + 1], which[3 + 1]; 91 92 p = curproc; 93 closed[0] = '\0'; 94 if ((fdp = p->p_fd) == NULL) 95 return (0); 96 dt = atomic_load_consume(&fdp->fd_dt); 97 for (i = 0; i < CHECK_UPTO; i++) { 98 KASSERT(i >= NDFDFILE || 99 dt->dt_ff[i] == (fdfile_t *)fdp->fd_dfdfile[i]); 100 if (dt->dt_ff[i]->ff_file != NULL) 101 continue; 102 snprintf(which, sizeof(which), ",%d", i); 103 strlcat(closed, which, sizeof(closed)); 104 if ((error = fd_allocfile(&fp, &fd)) != 0) 105 return (error); 106 KASSERT(fd < CHECK_UPTO); 107 pb = pathbuf_create("/dev/null"); 108 if (pb == NULL) { 109 return ENOMEM; 110 } 111 NDINIT(&nd, LOOKUP, FOLLOW, pb); 112 if ((error = vn_open(&nd, flags, 0)) != 0) { 113 pathbuf_destroy(pb); 114 fd_abort(p, fp, fd); 115 return (error); 116 } 117 fp->f_type = DTYPE_VNODE; 118 fp->f_vnode = nd.ni_vp; 119 fp->f_flag = flags; 120 fp->f_ops = &vnops; 121 VOP_UNLOCK(nd.ni_vp); 122 fd_affix(p, fp, fd); 123 pathbuf_destroy(pb); 124 } 125 if (closed[0] != '\0') { 126 mutex_enter(&proc_lock); 127 pp = p->p_pptr; 128 mutex_enter(pp->p_lock); 129 log(LOG_WARNING, "set{u,g}id pid %d (%s) " 130 "was invoked by uid %d ppid %d (%s) " 131 "with fd %s closed\n", 132 p->p_pid, p->p_comm, kauth_cred_geteuid(pp->p_cred), 133 pp->p_pid, pp->p_comm, &closed[1]); 134 mutex_exit(pp->p_lock); 135 mutex_exit(&proc_lock); 136 } 137 return (0); 138 } 139 #undef CHECK_UPTO 140