xref: /openbsd-src/sys/kern/kern_exec.c (revision c7e8ea31cd41a963f06f0a8ba93948b06aa6b4a4)
1 /*	$OpenBSD: kern_exec.c,v 1.188 2017/04/13 03:52:25 guenther Exp $	*/
2 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
3 
4 /*-
5  * Copyright (C) 1993, 1994 Christopher G. Demetriou
6  * Copyright (C) 1992 Wolfgang Solfrank.
7  * Copyright (C) 1992 TooLs GmbH.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by TooLs GmbH.
21  * 4. The name of TooLs GmbH may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/filedesc.h>
39 #include <sys/kernel.h>
40 #include <sys/proc.h>
41 #include <sys/mount.h>
42 #include <sys/malloc.h>
43 #include <sys/pool.h>
44 #include <sys/namei.h>
45 #include <sys/vnode.h>
46 #include <sys/file.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/ktrace.h>
50 #include <sys/resourcevar.h>
51 #include <sys/wait.h>
52 #include <sys/mman.h>
53 #include <sys/signalvar.h>
54 #include <sys/stat.h>
55 #include <sys/conf.h>
56 #include <sys/pledge.h>
57 #ifdef SYSVSHM
58 #include <sys/shm.h>
59 #endif
60 
61 #include <sys/syscallargs.h>
62 
63 #include <uvm/uvm_extern.h>
64 #include <machine/tcb.h>
65 
66 const struct kmem_va_mode kv_exec = {
67 	.kv_wait = 1,
68 	.kv_map = &exec_map
69 };
70 
71 /*
72  * Map the shared signal code.
73  */
74 int exec_sigcode_map(struct process *, struct emul *);
75 
76 /*
77  * If non-zero, stackgap_random specifies the upper limit of the random gap size
78  * added to the fixed stack position. Must be n^2.
79  */
80 int stackgap_random = STACKGAP_RANDOM;
81 
82 /*
83  * check exec:
84  * given an "executable" described in the exec package's namei info,
85  * see what we can do with it.
86  *
87  * ON ENTRY:
88  *	exec package with appropriate namei info
89  *	proc pointer of exec'ing proc
90  *	NO SELF-LOCKED VNODES
91  *
92  * ON EXIT:
93  *	error:	nothing held, etc.  exec header still allocated.
94  *	ok:	filled exec package, one locked vnode.
95  *
96  * EXEC SWITCH ENTRY:
97  * 	Locked vnode to check, exec package, proc.
98  *
99  * EXEC SWITCH EXIT:
100  *	ok:	return 0, filled exec package, one locked vnode.
101  *	error:	destructive:
102  *			everything deallocated except exec header.
103  *		non-destructive:
104  *			error code, locked vnode, exec header unmodified
105  */
106 int
107 check_exec(struct proc *p, struct exec_package *epp)
108 {
109 	int error, i;
110 	struct vnode *vp;
111 	struct nameidata *ndp;
112 	size_t resid;
113 
114 	ndp = epp->ep_ndp;
115 	ndp->ni_cnd.cn_nameiop = LOOKUP;
116 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
117 	/* first get the vnode */
118 	if ((error = namei(ndp)) != 0)
119 		return (error);
120 	epp->ep_vp = vp = ndp->ni_vp;
121 
122 	/* check for regular file */
123 	if (vp->v_type == VDIR) {
124 		error = EISDIR;
125 		goto bad1;
126 	}
127 	if (vp->v_type != VREG) {
128 		error = EACCES;
129 		goto bad1;
130 	}
131 
132 	/* get attributes */
133 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
134 		goto bad1;
135 
136 	/* Check mount point */
137 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
138 		error = EACCES;
139 		goto bad1;
140 	}
141 
142 	if ((vp->v_mount->mnt_flag & MNT_NOSUID))
143 		epp->ep_vap->va_mode &= ~(VSUID | VSGID);
144 
145 	/* check access.  for root we have to see if any exec bit on */
146 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p)) != 0)
147 		goto bad1;
148 	if ((epp->ep_vap->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
149 		error = EACCES;
150 		goto bad1;
151 	}
152 
153 	/* try to open it */
154 	if ((error = VOP_OPEN(vp, FREAD, p->p_ucred, p)) != 0)
155 		goto bad1;
156 
157 	/* unlock vp, we need it unlocked from here */
158 	VOP_UNLOCK(vp, p);
159 
160 	/* now we have the file, get the exec header */
161 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
162 	    UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
163 	if (error)
164 		goto bad2;
165 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
166 
167 	/*
168 	 * set up the vmcmds for creation of the process
169 	 * address space
170 	 */
171 	error = ENOEXEC;
172 	for (i = 0; i < nexecs && error != 0; i++) {
173 		int newerror;
174 
175 		if (execsw[i].es_check == NULL)
176 			continue;
177 		newerror = (*execsw[i].es_check)(p, epp);
178 		if (!newerror && !(epp->ep_emul->e_flags & EMUL_ENABLED))
179 			newerror = EPERM;
180 		/* make sure the first "interesting" error code is saved. */
181 		if (!newerror || error == ENOEXEC)
182 			error = newerror;
183 		if (epp->ep_flags & EXEC_DESTR && error != 0)
184 			return (error);
185 	}
186 	if (!error) {
187 		/* check that entry point is sane */
188 		if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
189 			error = ENOEXEC;
190 		}
191 
192 		/* check limits */
193 		if ((epp->ep_tsize > MAXTSIZ) ||
194 		    (epp->ep_dsize > p->p_rlimit[RLIMIT_DATA].rlim_cur))
195 			error = ENOMEM;
196 
197 		if (!error)
198 			return (0);
199 	}
200 
201 	/*
202 	 * free any vmspace-creation commands,
203 	 * and release their references
204 	 */
205 	kill_vmcmds(&epp->ep_vmcmds);
206 
207 bad2:
208 	/*
209 	 * close the vnode, free the pathname buf, and punt.
210 	 */
211 	vn_close(vp, FREAD, p->p_ucred, p);
212 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
213 	return (error);
214 
215 bad1:
216 	/*
217 	 * free the namei pathname buffer, and put the vnode
218 	 * (which we don't yet have open).
219 	 */
220 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
221 	vput(vp);
222 	return (error);
223 }
224 
225 /*
226  * exec system call
227  */
228 int
229 sys_execve(struct proc *p, void *v, register_t *retval)
230 {
231 	struct sys_execve_args /* {
232 		syscallarg(const char *) path;
233 		syscallarg(char *const *) argp;
234 		syscallarg(char *const *) envp;
235 	} */ *uap = v;
236 	int error;
237 	struct exec_package pack;
238 	struct nameidata nid;
239 	struct vattr attr;
240 	struct ucred *cred = p->p_ucred;
241 	char *argp;
242 	char * const *cpp, *dp, *sp;
243 #ifdef KTRACE
244 	char *env_start;
245 #endif
246 	struct process *pr = p->p_p;
247 	long argc, envc;
248 	size_t len, sgap;
249 #ifdef MACHINE_STACK_GROWS_UP
250 	size_t slen;
251 #endif
252 	char *stack;
253 	struct ps_strings arginfo;
254 	struct vmspace *vm;
255 	char **tmpfap;
256 	extern struct emul emul_native;
257 	struct vnode *otvp;
258 
259 	/* get other threads to stop */
260 	if ((error = single_thread_set(p, SINGLE_UNWIND, 1)))
261 		return (error);
262 
263 	/*
264 	 * Cheap solution to complicated problems.
265 	 * Mark this process as "leave me alone, I'm execing".
266 	 */
267 	atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
268 
269 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), p);
270 	nid.ni_pledge = PLEDGE_EXEC;
271 
272 	/*
273 	 * initialize the fields of the exec package.
274 	 */
275 	pack.ep_name = (char *)SCARG(uap, path);
276 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
277 	pack.ep_hdrlen = exec_maxhdrsz;
278 	pack.ep_hdrvalid = 0;
279 	pack.ep_ndp = &nid;
280 	pack.ep_interp = NULL;
281 	pack.ep_emul_arg = NULL;
282 	VMCMDSET_INIT(&pack.ep_vmcmds);
283 	pack.ep_vap = &attr;
284 	pack.ep_emul = &emul_native;
285 	pack.ep_flags = 0;
286 
287 	/* see if we can run it. */
288 	if ((error = check_exec(p, &pack)) != 0) {
289 		goto freehdr;
290 	}
291 
292 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
293 
294 	/* allocate an argument buffer */
295 	argp = km_alloc(NCARGS, &kv_exec, &kp_pageable, &kd_waitok);
296 #ifdef DIAGNOSTIC
297 	if (argp == NULL)
298 		panic("execve: argp == NULL");
299 #endif
300 	dp = argp;
301 	argc = 0;
302 
303 	/* copy the fake args list, if there's one, freeing it as we go */
304 	if (pack.ep_flags & EXEC_HASARGL) {
305 		tmpfap = pack.ep_fa;
306 		while (*tmpfap != NULL) {
307 			char *cp;
308 
309 			cp = *tmpfap;
310 			while (*cp)
311 				*dp++ = *cp++;
312 			*dp++ = '\0';
313 
314 			free(*tmpfap, M_EXEC, 0);
315 			tmpfap++; argc++;
316 		}
317 		free(pack.ep_fa, M_EXEC, 0);
318 		pack.ep_flags &= ~EXEC_HASARGL;
319 	}
320 
321 	/* Now get argv & environment */
322 	if (!(cpp = SCARG(uap, argp))) {
323 		error = EFAULT;
324 		goto bad;
325 	}
326 
327 	if (pack.ep_flags & EXEC_SKIPARG)
328 		cpp++;
329 
330 	while (1) {
331 		len = argp + ARG_MAX - dp;
332 		if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
333 			goto bad;
334 		if (!sp)
335 			break;
336 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
337 			if (error == ENAMETOOLONG)
338 				error = E2BIG;
339 			goto bad;
340 		}
341 		dp += len;
342 		cpp++;
343 		argc++;
344 	}
345 
346 	/* must have at least one argument */
347 	if (argc == 0) {
348 		error = EINVAL;
349 		goto bad;
350 	}
351 
352 #ifdef KTRACE
353 	if (KTRPOINT(p, KTR_EXECARGS))
354 		ktrexec(p, KTR_EXECARGS, argp, dp - argp);
355 #endif
356 
357 	envc = 0;
358 	/* environment does not need to be there */
359 	if ((cpp = SCARG(uap, envp)) != NULL ) {
360 #ifdef KTRACE
361 		env_start = dp;
362 #endif
363 		while (1) {
364 			len = argp + ARG_MAX - dp;
365 			if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
366 				goto bad;
367 			if (!sp)
368 				break;
369 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
370 				if (error == ENAMETOOLONG)
371 					error = E2BIG;
372 				goto bad;
373 			}
374 			dp += len;
375 			cpp++;
376 			envc++;
377 		}
378 
379 #ifdef KTRACE
380 		if (KTRPOINT(p, KTR_EXECENV))
381 			ktrexec(p, KTR_EXECENV, env_start, dp - env_start);
382 #endif
383 	}
384 
385 	dp = (char *)(((long)dp + _STACKALIGNBYTES) & ~_STACKALIGNBYTES);
386 
387 	sgap = STACKGAPLEN;
388 
389 	/*
390 	 * If we have enabled random stackgap, the stack itself has already
391 	 * been moved from a random location, but is still aligned to a page
392 	 * boundary.  Provide the lower bits of random placement now.
393 	 */
394 	if (stackgap_random != 0) {
395 		sgap += arc4random() & PAGE_MASK;
396 		sgap = (sgap + _STACKALIGNBYTES) & ~_STACKALIGNBYTES;
397 	}
398 
399 	/* Now check if args & environ fit into new stack */
400 	len = ((argc + envc + 2 + pack.ep_emul->e_arglen) * sizeof(char *) +
401 	    sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
402 
403 	len = (len + _STACKALIGNBYTES) &~ _STACKALIGNBYTES;
404 
405 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
406 		error = ENOMEM;
407 		goto bad;
408 	}
409 
410 	/* adjust "active stack depth" for process VSZ */
411 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
412 
413 	/*
414 	 * we're committed: any further errors will kill the process, so
415 	 * kill the other threads now.
416 	 */
417 	single_thread_set(p, SINGLE_EXIT, 0);
418 
419 	/*
420 	 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
421 	 * ps_vmspace!
422 	 */
423 	uvmspace_exec(p, VM_MIN_ADDRESS, VM_MAXUSER_ADDRESS);
424 
425 	vm = pr->ps_vmspace;
426 	/* Now map address space */
427 	vm->vm_taddr = (char *)trunc_page(pack.ep_taddr);
428 	vm->vm_tsize = atop(round_page(pack.ep_taddr + pack.ep_tsize) -
429 	    trunc_page(pack.ep_taddr));
430 	vm->vm_daddr = (char *)trunc_page(pack.ep_daddr);
431 	vm->vm_dsize = atop(round_page(pack.ep_daddr + pack.ep_dsize) -
432 	    trunc_page(pack.ep_daddr));
433 	vm->vm_dused = 0;
434 	vm->vm_ssize = atop(round_page(pack.ep_ssize));
435 	vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
436 	vm->vm_minsaddr = (char *)pack.ep_minsaddr;
437 
438 	/* create the new process's VM space by running the vmcmds */
439 #ifdef DIAGNOSTIC
440 	if (pack.ep_vmcmds.evs_used == 0)
441 		panic("execve: no vmcmds");
442 #endif
443 	error = exec_process_vmcmds(p, &pack);
444 
445 	/* if an error happened, deallocate and punt */
446 	if (error)
447 		goto exec_abort;
448 
449 	/* old "stackgap" is gone now */
450 	pr->ps_stackgap = 0;
451 
452 #ifdef MACHINE_STACK_GROWS_UP
453 	pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
454         if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
455             trunc_page(pr->ps_strings), PROT_NONE, TRUE))
456                 goto exec_abort;
457 #else
458 	pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
459         if (uvm_map_protect(&vm->vm_map,
460             round_page(pr->ps_strings + sizeof(arginfo)),
461             (vaddr_t)vm->vm_minsaddr, PROT_NONE, TRUE))
462                 goto exec_abort;
463 #endif
464 
465 	/* remember information about the process */
466 	arginfo.ps_nargvstr = argc;
467 	arginfo.ps_nenvstr = envc;
468 
469 #ifdef MACHINE_STACK_GROWS_UP
470 	stack = (char *)vm->vm_maxsaddr + sizeof(arginfo) + sgap;
471 	slen = len - sizeof(arginfo) - sgap;
472 #else
473 	stack = (char *)(vm->vm_minsaddr - len);
474 #endif
475 	/* Now copy argc, args & environ to new stack */
476 	if (!(*pack.ep_emul->e_copyargs)(&pack, &arginfo, stack, argp))
477 		goto exec_abort;
478 
479 	/* copy out the process's ps_strings structure */
480 	if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
481 		goto exec_abort;
482 
483 	stopprofclock(pr);	/* stop profiling */
484 	fdcloseexec(p);		/* handle close on exec */
485 	execsigs(p);		/* reset caught signals */
486 	TCB_SET(p, NULL);	/* reset the TCB address */
487 	pr->ps_kbind_addr = 0;	/* reset the kbind bits */
488 	pr->ps_kbind_cookie = 0;
489 	arc4random_buf(&pr->ps_sigcookie, sizeof pr->ps_sigcookie);
490 
491 	/* set command name & other accounting info */
492 	memset(pr->ps_comm, 0, sizeof(pr->ps_comm));
493 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
494 	memcpy(pr->ps_comm, nid.ni_cnd.cn_nameptr, len);
495 	pr->ps_acflag &= ~AFORK;
496 
497 	/* record proc's vnode, for use by sysctl */
498 	otvp = pr->ps_textvp;
499 	vref(pack.ep_vp);
500 	pr->ps_textvp = pack.ep_vp;
501 	if (otvp)
502 		vrele(otvp);
503 
504 	atomic_setbits_int(&pr->ps_flags, PS_EXEC);
505 	if (pr->ps_flags & PS_PPWAIT) {
506 		atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
507 		atomic_clearbits_int(&pr->ps_pptr->ps_flags, PS_ISPWAIT);
508 		wakeup(pr->ps_pptr);
509 	}
510 
511 	/*
512 	 * If process does execve() while it has a mismatched real,
513 	 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
514 	 */
515 	if (cred->cr_uid != cred->cr_ruid ||
516 	    cred->cr_uid != cred->cr_svuid ||
517 	    cred->cr_gid != cred->cr_rgid ||
518 	    cred->cr_gid != cred->cr_svgid)
519 		atomic_setbits_int(&pr->ps_flags, PS_SUGIDEXEC);
520 	else
521 		atomic_clearbits_int(&pr->ps_flags, PS_SUGIDEXEC);
522 
523 	atomic_clearbits_int(&pr->ps_flags, PS_PLEDGE);
524 	pledge_dropwpaths(pr);
525 
526 	/*
527 	 * deal with set[ug]id.
528 	 * MNT_NOEXEC has already been used to disable s[ug]id.
529 	 */
530 	if ((attr.va_mode & (VSUID | VSGID)) && proc_cansugid(p)) {
531 		int i;
532 
533 		atomic_setbits_int(&pr->ps_flags, PS_SUGID|PS_SUGIDEXEC);
534 
535 #ifdef KTRACE
536 		/*
537 		 * If process is being ktraced, turn off - unless
538 		 * root set it.
539 		 */
540 		if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT))
541 			ktrcleartrace(pr);
542 #endif
543 		p->p_ucred = cred = crcopy(cred);
544 		if (attr.va_mode & VSUID)
545 			cred->cr_uid = attr.va_uid;
546 		if (attr.va_mode & VSGID)
547 			cred->cr_gid = attr.va_gid;
548 
549 		/*
550 		 * For set[ug]id processes, a few caveats apply to
551 		 * stdin, stdout, and stderr.
552 		 */
553 		error = 0;
554 		fdplock(p->p_fd);
555 		for (i = 0; i < 3; i++) {
556 			struct file *fp = NULL;
557 
558 			/*
559 			 * NOTE - This will never return NULL because of
560 			 * immature fds. The file descriptor table is not
561 			 * shared because we're suid.
562 			 */
563 			fp = fd_getfile(p->p_fd, i);
564 
565 			/*
566 			 * Ensure that stdin, stdout, and stderr are already
567 			 * allocated.  We do not want userland to accidentally
568 			 * allocate descriptors in this range which has implied
569 			 * meaning to libc.
570 			 */
571 			if (fp == NULL) {
572 				short flags = FREAD | (i == 0 ? 0 : FWRITE);
573 				struct vnode *vp;
574 				int indx;
575 
576 				if ((error = falloc(p, 0, &fp, &indx)) != 0)
577 					break;
578 #ifdef DIAGNOSTIC
579 				if (indx != i)
580 					panic("sys_execve: falloc indx != i");
581 #endif
582 				if ((error = cdevvp(getnulldev(), &vp)) != 0) {
583 					fdremove(p->p_fd, indx);
584 					closef(fp, p);
585 					break;
586 				}
587 				if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
588 					fdremove(p->p_fd, indx);
589 					closef(fp, p);
590 					vrele(vp);
591 					break;
592 				}
593 				if (flags & FWRITE)
594 					vp->v_writecount++;
595 				fp->f_flag = flags;
596 				fp->f_type = DTYPE_VNODE;
597 				fp->f_ops = &vnops;
598 				fp->f_data = (caddr_t)vp;
599 				FILE_SET_MATURE(fp, p);
600 			}
601 		}
602 		fdpunlock(p->p_fd);
603 		if (error)
604 			goto exec_abort;
605 	} else
606 		atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
607 
608 	/*
609 	 * Reset the saved ugids and update the process's copy of the
610 	 * creds if the creds have been changed
611 	 */
612 	if (cred->cr_uid != cred->cr_svuid ||
613 	    cred->cr_gid != cred->cr_svgid) {
614 		/* make sure we have unshared ucreds */
615 		p->p_ucred = cred = crcopy(cred);
616 		cred->cr_svuid = cred->cr_uid;
617 		cred->cr_svgid = cred->cr_gid;
618 	}
619 
620 	if (pr->ps_ucred != cred) {
621 		struct ucred *ocred;
622 
623 		ocred = pr->ps_ucred;
624 		crhold(cred);
625 		pr->ps_ucred = cred;
626 		crfree(ocred);
627 	}
628 
629 	if (pr->ps_flags & PS_SUGIDEXEC) {
630 		int i, s = splclock();
631 
632 		timeout_del(&pr->ps_realit_to);
633 		for (i = 0; i < nitems(pr->ps_timer); i++) {
634 			timerclear(&pr->ps_timer[i].it_interval);
635 			timerclear(&pr->ps_timer[i].it_value);
636 		}
637 		splx(s);
638 	}
639 
640 	/* reset CPU time usage for the thread, but not the process */
641 	timespecclear(&p->p_tu.tu_runtime);
642 	p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
643 
644 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
645 
646 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
647 	vn_close(pack.ep_vp, FREAD, cred, p);
648 
649 	/*
650 	 * notify others that we exec'd
651 	 */
652 	KNOTE(&pr->ps_klist, NOTE_EXEC);
653 
654 	/* setup new registers and do misc. setup. */
655 	if (pack.ep_emul->e_fixup != NULL) {
656 		if ((*pack.ep_emul->e_fixup)(p, &pack) != 0)
657 			goto free_pack_abort;
658 	}
659 #ifdef MACHINE_STACK_GROWS_UP
660 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack + slen, retval);
661 #else
662 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack, retval);
663 #endif
664 
665 	/* map the process's signal trampoline code */
666 	if (exec_sigcode_map(pr, pack.ep_emul))
667 		goto free_pack_abort;
668 
669 #ifdef __HAVE_EXEC_MD_MAP
670 	/* perform md specific mappings that process might need */
671 	if (exec_md_map(p, &pack))
672 		goto free_pack_abort;
673 #endif
674 
675 	if (pr->ps_flags & PS_TRACED)
676 		psignal(p, SIGTRAP);
677 
678 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
679 
680 	p->p_descfd = 255;
681 	if ((pack.ep_flags & EXEC_HASFD) && pack.ep_fd < 255)
682 		p->p_descfd = pack.ep_fd;
683 
684 	if (pack.ep_flags & EXEC_WXNEEDED)
685 		p->p_p->ps_flags |= PS_WXNEEDED;
686 	else
687 		p->p_p->ps_flags &= ~PS_WXNEEDED;
688 
689 	/* update ps_emul, the old value is no longer needed */
690 	pr->ps_emul = pack.ep_emul;
691 
692 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
693 	single_thread_clear(p, P_SUSPSIG);
694 
695 	return (0);
696 
697 bad:
698 	/* free the vmspace-creation commands, and release their references */
699 	kill_vmcmds(&pack.ep_vmcmds);
700 	/* kill any opened file descriptor, if necessary */
701 	if (pack.ep_flags & EXEC_HASFD) {
702 		pack.ep_flags &= ~EXEC_HASFD;
703 		fdplock(p->p_fd);
704 		(void) fdrelease(p, pack.ep_fd);
705 		fdpunlock(p->p_fd);
706 	}
707 	if (pack.ep_interp != NULL)
708 		pool_put(&namei_pool, pack.ep_interp);
709 	if (pack.ep_emul_arg != NULL)
710 		free(pack.ep_emul_arg, M_TEMP, pack.ep_emul_argsize);
711 	/* close and put the exec'd file */
712 	vn_close(pack.ep_vp, FREAD, cred, p);
713 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
714 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
715 
716 freehdr:
717 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
718 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
719 	single_thread_clear(p, P_SUSPSIG);
720 
721 	return (error);
722 
723 exec_abort:
724 	/*
725 	 * the old process doesn't exist anymore.  exit gracefully.
726 	 * get rid of the (new) address space we have created, if any, get rid
727 	 * of our namei data and vnode, and exit noting failure
728 	 */
729 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
730 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
731 	if (pack.ep_interp != NULL)
732 		pool_put(&namei_pool, pack.ep_interp);
733 	if (pack.ep_emul_arg != NULL)
734 		free(pack.ep_emul_arg, M_TEMP, pack.ep_emul_argsize);
735 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
736 	vn_close(pack.ep_vp, FREAD, cred, p);
737 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
738 
739 free_pack_abort:
740 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
741 	exit1(p, W_EXITCODE(0, SIGABRT), EXIT_NORMAL);
742 
743 	/* NOTREACHED */
744 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
745 
746 	return (0);
747 }
748 
749 
750 void *
751 copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
752     void *argp)
753 {
754 	char **cpp = stack;
755 	char *dp, *sp;
756 	size_t len;
757 	void *nullp = NULL;
758 	long argc = arginfo->ps_nargvstr;
759 	int envc = arginfo->ps_nenvstr;
760 
761 	if (copyout(&argc, cpp++, sizeof(argc)))
762 		return (NULL);
763 
764 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_emul->e_arglen);
765 	sp = argp;
766 
767 	/* XXX don't copy them out, remap them! */
768 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
769 
770 	for (; --argc >= 0; sp += len, dp += len)
771 		if (copyout(&dp, cpp++, sizeof(dp)) ||
772 		    copyoutstr(sp, dp, ARG_MAX, &len))
773 			return (NULL);
774 
775 	if (copyout(&nullp, cpp++, sizeof(nullp)))
776 		return (NULL);
777 
778 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
779 
780 	for (; --envc >= 0; sp += len, dp += len)
781 		if (copyout(&dp, cpp++, sizeof(dp)) ||
782 		    copyoutstr(sp, dp, ARG_MAX, &len))
783 			return (NULL);
784 
785 	if (copyout(&nullp, cpp++, sizeof(nullp)))
786 		return (NULL);
787 
788 	return (cpp);
789 }
790 
791 int
792 exec_sigcode_map(struct process *pr, struct emul *e)
793 {
794 	vsize_t sz;
795 
796 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
797 
798 	/*
799 	 * If we don't have a sigobject for this emulation, create one.
800 	 *
801 	 * sigobject is an anonymous memory object (just like SYSV shared
802 	 * memory) that we keep a permanent reference to and that we map
803 	 * in all processes that need this sigcode. The creation is simple,
804 	 * we create an object, add a permanent reference to it, map it in
805 	 * kernel space, copy out the sigcode to it and unmap it.
806 	 * Then we map it with PROT_READ|PROT_EXEC into the process just
807 	 * the way sys_mmap would map it.
808 	 */
809 	if (e->e_sigobject == NULL) {
810 		extern int sigfillsiz;
811 		extern u_char sigfill[];
812 		size_t off;
813 		vaddr_t va;
814 		int r;
815 
816 		e->e_sigobject = uao_create(sz, 0);
817 		uao_reference(e->e_sigobject);	/* permanent reference */
818 
819 		if ((r = uvm_map(kernel_map, &va, round_page(sz), e->e_sigobject,
820 		    0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,
821 		    MAP_INHERIT_SHARE, MADV_RANDOM, 0)))) {
822 			uao_detach(e->e_sigobject);
823 			return (ENOMEM);
824 		}
825 
826 		for (off = 0; off < round_page(sz); off += sigfillsiz)
827 			memcpy((caddr_t)va + off, sigfill, sigfillsiz);
828 		memcpy((caddr_t)va, e->e_sigcode, sz);
829 		uvm_unmap(kernel_map, va, va + round_page(sz));
830 	}
831 
832 	pr->ps_sigcode = 0; /* no hint */
833 	uao_reference(e->e_sigobject);
834 	if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_sigcode, round_page(sz),
835 	    e->e_sigobject, 0, 0, UVM_MAPFLAG(PROT_READ | PROT_EXEC,
836 	    PROT_READ | PROT_WRITE | PROT_EXEC, MAP_INHERIT_COPY,
837 	    MADV_RANDOM, UVM_FLAG_COPYONW))) {
838 		uao_detach(e->e_sigobject);
839 		return (ENOMEM);
840 	}
841 
842 	/* Calculate PC at point of sigreturn entry */
843 	pr->ps_sigcoderet = pr->ps_sigcode +
844 	    (pr->ps_emul->e_esigret - pr->ps_emul->e_sigcode);
845 
846 	return (0);
847 }
848