xref: /openbsd-src/sys/kern/kern_exec.c (revision cb39b41371628601fbe4c618205356d538b9d08a)
1 /*	$OpenBSD: kern_exec.c,v 1.161 2015/03/14 03:38:50 jsg Exp $	*/
2 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
3 
4 /*-
5  * Copyright (C) 1993, 1994 Christopher G. Demetriou
6  * Copyright (C) 1992 Wolfgang Solfrank.
7  * Copyright (C) 1992 TooLs GmbH.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by TooLs GmbH.
21  * 4. The name of TooLs GmbH may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/filedesc.h>
39 #include <sys/kernel.h>
40 #include <sys/proc.h>
41 #include <sys/mount.h>
42 #include <sys/malloc.h>
43 #include <sys/pool.h>
44 #include <sys/namei.h>
45 #include <sys/vnode.h>
46 #include <sys/file.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/ktrace.h>
50 #include <sys/resourcevar.h>
51 #include <sys/wait.h>
52 #include <sys/mman.h>
53 #include <sys/signalvar.h>
54 #include <sys/stat.h>
55 #include <sys/conf.h>
56 #ifdef SYSVSHM
57 #include <sys/shm.h>
58 #endif
59 
60 #include <sys/syscallargs.h>
61 
62 #include <uvm/uvm_extern.h>
63 
64 #ifdef __HAVE_MD_TCB
65 # include <machine/tcb.h>
66 #endif
67 
68 #include "systrace.h"
69 
70 #if NSYSTRACE > 0
71 #include <dev/systrace.h>
72 #endif
73 
74 const struct kmem_va_mode kv_exec = {
75 	.kv_wait = 1,
76 	.kv_map = &exec_map
77 };
78 
79 /*
80  * Map the shared signal code.
81  */
82 int exec_sigcode_map(struct process *, struct emul *);
83 
84 /*
85  * If non-zero, stackgap_random specifies the upper limit of the random gap size
86  * added to the fixed stack position. Must be n^2.
87  */
88 int stackgap_random = STACKGAP_RANDOM;
89 
90 /*
91  * check exec:
92  * given an "executable" described in the exec package's namei info,
93  * see what we can do with it.
94  *
95  * ON ENTRY:
96  *	exec package with appropriate namei info
97  *	proc pointer of exec'ing proc
98  *	NO SELF-LOCKED VNODES
99  *
100  * ON EXIT:
101  *	error:	nothing held, etc.  exec header still allocated.
102  *	ok:	filled exec package, one locked vnode.
103  *
104  * EXEC SWITCH ENTRY:
105  * 	Locked vnode to check, exec package, proc.
106  *
107  * EXEC SWITCH EXIT:
108  *	ok:	return 0, filled exec package, one locked vnode.
109  *	error:	destructive:
110  *			everything deallocated except exec header.
111  *		non-destructive:
112  *			error code, locked vnode, exec header unmodified
113  */
114 int
115 check_exec(struct proc *p, struct exec_package *epp)
116 {
117 	int error, i;
118 	struct vnode *vp;
119 	struct nameidata *ndp;
120 	size_t resid;
121 
122 	ndp = epp->ep_ndp;
123 	ndp->ni_cnd.cn_nameiop = LOOKUP;
124 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
125 	/* first get the vnode */
126 	if ((error = namei(ndp)) != 0)
127 		return (error);
128 	epp->ep_vp = vp = ndp->ni_vp;
129 
130 	/* check for regular file */
131 	if (vp->v_type == VDIR) {
132 		error = EISDIR;
133 		goto bad1;
134 	}
135 	if (vp->v_type != VREG) {
136 		error = EACCES;
137 		goto bad1;
138 	}
139 
140 	/* get attributes */
141 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
142 		goto bad1;
143 
144 	/* Check mount point */
145 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
146 		error = EACCES;
147 		goto bad1;
148 	}
149 
150 	if ((vp->v_mount->mnt_flag & MNT_NOSUID))
151 		epp->ep_vap->va_mode &= ~(VSUID | VSGID);
152 
153 	/* check access.  for root we have to see if any exec bit on */
154 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p)) != 0)
155 		goto bad1;
156 	if ((epp->ep_vap->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
157 		error = EACCES;
158 		goto bad1;
159 	}
160 
161 	/* try to open it */
162 	if ((error = VOP_OPEN(vp, FREAD, p->p_ucred, p)) != 0)
163 		goto bad1;
164 
165 	/* unlock vp, we need it unlocked from here */
166 	VOP_UNLOCK(vp, 0, p);
167 
168 	/* now we have the file, get the exec header */
169 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
170 	    UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
171 	if (error)
172 		goto bad2;
173 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
174 
175 	/*
176 	 * set up the vmcmds for creation of the process
177 	 * address space
178 	 */
179 	error = ENOEXEC;
180 	for (i = 0; i < nexecs && error != 0; i++) {
181 		int newerror;
182 
183 		if (execsw[i].es_check == NULL)
184 			continue;
185 		newerror = (*execsw[i].es_check)(p, epp);
186 		if (!newerror && !(epp->ep_emul->e_flags & EMUL_ENABLED))
187 			newerror = EPERM;
188 		/* make sure the first "interesting" error code is saved. */
189 		if (!newerror || error == ENOEXEC)
190 			error = newerror;
191 		if (epp->ep_flags & EXEC_DESTR && error != 0)
192 			return (error);
193 	}
194 	if (!error) {
195 		/* check that entry point is sane */
196 		if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
197 			error = ENOEXEC;
198 		}
199 
200 		/* check limits */
201 		if ((epp->ep_tsize > MAXTSIZ) ||
202 		    (epp->ep_dsize > p->p_rlimit[RLIMIT_DATA].rlim_cur))
203 			error = ENOMEM;
204 
205 		if (!error)
206 			return (0);
207 	}
208 
209 	/*
210 	 * free any vmspace-creation commands,
211 	 * and release their references
212 	 */
213 	kill_vmcmds(&epp->ep_vmcmds);
214 
215 bad2:
216 	/*
217 	 * close the vnode, free the pathname buf, and punt.
218 	 */
219 	vn_close(vp, FREAD, p->p_ucred, p);
220 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
221 	return (error);
222 
223 bad1:
224 	/*
225 	 * free the namei pathname buffer, and put the vnode
226 	 * (which we don't yet have open).
227 	 */
228 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
229 	vput(vp);
230 	return (error);
231 }
232 
233 /*
234  * exec system call
235  */
236 /* ARGSUSED */
237 int
238 sys_execve(struct proc *p, void *v, register_t *retval)
239 {
240 	struct sys_execve_args /* {
241 		syscallarg(const char *) path;
242 		syscallarg(char *const *) argp;
243 		syscallarg(char *const *) envp;
244 	} */ *uap = v;
245 	int error;
246 	struct exec_package pack;
247 	struct nameidata nid;
248 	struct vattr attr;
249 	struct ucred *cred = p->p_ucred;
250 	char *argp;
251 	char * const *cpp, *dp, *sp;
252 	struct process *pr = p->p_p;
253 	long argc, envc;
254 	size_t len, sgap;
255 #ifdef MACHINE_STACK_GROWS_UP
256 	size_t slen;
257 #endif
258 	char *stack;
259 	struct ps_strings arginfo;
260 	struct vmspace *vm = pr->ps_vmspace;
261 	char **tmpfap;
262 	extern struct emul emul_native;
263 #if NSYSTRACE > 0
264 	int wassugid = ISSET(pr->ps_flags, PS_SUGID | PS_SUGIDEXEC);
265 	size_t pathbuflen;
266 #endif
267 	char *pathbuf = NULL;
268 	struct vnode *otvp;
269 
270 	/* get other threads to stop */
271 	if ((error = single_thread_set(p, SINGLE_UNWIND, 1)))
272 		return (error);
273 
274 	/*
275 	 * Cheap solution to complicated problems.
276 	 * Mark this process as "leave me alone, I'm execing".
277 	 */
278 	atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
279 
280 #if NSYSTRACE > 0
281 	if (ISSET(p->p_flag, P_SYSTRACE)) {
282 		systrace_execve0(p);
283 		pathbuf = pool_get(&namei_pool, PR_WAITOK);
284 		error = copyinstr(SCARG(uap, path), pathbuf, MAXPATHLEN,
285 		    &pathbuflen);
286 		if (error != 0)
287 			goto clrflag;
288 	}
289 #endif
290 	if (pathbuf != NULL) {
291 		NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_SYSSPACE, pathbuf, p);
292 	} else {
293 		NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE,
294 		    SCARG(uap, path), p);
295 	}
296 
297 	/*
298 	 * initialize the fields of the exec package.
299 	 */
300 	if (pathbuf != NULL)
301 		pack.ep_name = pathbuf;
302 	else
303 		pack.ep_name = (char *)SCARG(uap, path);
304 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
305 	pack.ep_hdrlen = exec_maxhdrsz;
306 	pack.ep_hdrvalid = 0;
307 	pack.ep_ndp = &nid;
308 	pack.ep_interp = NULL;
309 	pack.ep_emul_arg = NULL;
310 	VMCMDSET_INIT(&pack.ep_vmcmds);
311 	pack.ep_vap = &attr;
312 	pack.ep_emul = &emul_native;
313 	pack.ep_flags = 0;
314 
315 	/* see if we can run it. */
316 	if ((error = check_exec(p, &pack)) != 0) {
317 		goto freehdr;
318 	}
319 
320 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
321 
322 	/* allocate an argument buffer */
323 	argp = km_alloc(NCARGS, &kv_exec, &kp_pageable, &kd_waitok);
324 #ifdef DIAGNOSTIC
325 	if (argp == NULL)
326 		panic("execve: argp == NULL");
327 #endif
328 	dp = argp;
329 	argc = 0;
330 
331 	/* copy the fake args list, if there's one, freeing it as we go */
332 	if (pack.ep_flags & EXEC_HASARGL) {
333 		tmpfap = pack.ep_fa;
334 		while (*tmpfap != NULL) {
335 			char *cp;
336 
337 			cp = *tmpfap;
338 			while (*cp)
339 				*dp++ = *cp++;
340 			*dp++ = '\0';
341 
342 			free(*tmpfap, M_EXEC, 0);
343 			tmpfap++; argc++;
344 		}
345 		free(pack.ep_fa, M_EXEC, 0);
346 		pack.ep_flags &= ~EXEC_HASARGL;
347 	}
348 
349 	/* Now get argv & environment */
350 	if (!(cpp = SCARG(uap, argp))) {
351 		error = EFAULT;
352 		goto bad;
353 	}
354 
355 	if (pack.ep_flags & EXEC_SKIPARG)
356 		cpp++;
357 
358 	while (1) {
359 		len = argp + ARG_MAX - dp;
360 		if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
361 			goto bad;
362 		if (!sp)
363 			break;
364 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
365 			if (error == ENAMETOOLONG)
366 				error = E2BIG;
367 			goto bad;
368 		}
369 		dp += len;
370 		cpp++;
371 		argc++;
372 	}
373 
374 	/* must have at least one argument */
375 	if (argc == 0) {
376 		error = EINVAL;
377 		goto bad;
378 	}
379 
380 	envc = 0;
381 	/* environment does not need to be there */
382 	if ((cpp = SCARG(uap, envp)) != NULL ) {
383 		while (1) {
384 			len = argp + ARG_MAX - dp;
385 			if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
386 				goto bad;
387 			if (!sp)
388 				break;
389 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
390 				if (error == ENAMETOOLONG)
391 					error = E2BIG;
392 				goto bad;
393 			}
394 			dp += len;
395 			cpp++;
396 			envc++;
397 		}
398 	}
399 
400 	dp = (char *)(((long)dp + _STACKALIGNBYTES) & ~_STACKALIGNBYTES);
401 
402 	sgap = STACKGAPLEN;
403 
404 	/*
405 	 * If we have enabled random stackgap, the stack itself has already
406 	 * been moved from a random location, but is still aligned to a page
407 	 * boundary.  Provide the lower bits of random placement now.
408 	 */
409 	if (stackgap_random != 0) {
410 		sgap += arc4random() & PAGE_MASK;
411 		sgap = (sgap + _STACKALIGNBYTES) & ~_STACKALIGNBYTES;
412 	}
413 
414 	/* Now check if args & environ fit into new stack */
415 	len = ((argc + envc + 2 + pack.ep_emul->e_arglen) * sizeof(char *) +
416 	    sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
417 
418 	len = (len + _STACKALIGNBYTES) &~ _STACKALIGNBYTES;
419 
420 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
421 		error = ENOMEM;
422 		goto bad;
423 	}
424 
425 	/* adjust "active stack depth" for process VSZ */
426 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
427 
428 	/*
429 	 * we're committed: any further errors will kill the process, so
430 	 * kill the other threads now.
431 	 */
432 	single_thread_set(p, SINGLE_EXIT, 0);
433 
434 	/*
435 	 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
436 	 * pr_vmspace!
437 	 */
438 	uvmspace_exec(p, VM_MIN_ADDRESS, VM_MAXUSER_ADDRESS);
439 
440 	vm = pr->ps_vmspace;
441 	/* Now map address space */
442 	vm->vm_taddr = (char *)trunc_page(pack.ep_taddr);
443 	vm->vm_tsize = atop(round_page(pack.ep_taddr + pack.ep_tsize) -
444 	    trunc_page(pack.ep_taddr));
445 	vm->vm_daddr = (char *)trunc_page(pack.ep_daddr);
446 	vm->vm_dsize = atop(round_page(pack.ep_daddr + pack.ep_dsize) -
447 	    trunc_page(pack.ep_daddr));
448 	vm->vm_dused = 0;
449 	vm->vm_ssize = atop(round_page(pack.ep_ssize));
450 	vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
451 	vm->vm_minsaddr = (char *)pack.ep_minsaddr;
452 
453 	/* create the new process's VM space by running the vmcmds */
454 #ifdef DIAGNOSTIC
455 	if (pack.ep_vmcmds.evs_used == 0)
456 		panic("execve: no vmcmds");
457 #endif
458 	error = exec_process_vmcmds(p, &pack);
459 
460 	/* if an error happened, deallocate and punt */
461 	if (error)
462 		goto exec_abort;
463 
464 	/* old "stackgap" is gone now */
465 	pr->ps_stackgap = 0;
466 
467 #ifdef MACHINE_STACK_GROWS_UP
468 	pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
469         if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
470             trunc_page(pr->ps_strings), PROT_NONE, TRUE))
471                 goto exec_abort;
472 #else
473 	pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
474         if (uvm_map_protect(&vm->vm_map,
475             round_page(pr->ps_strings + sizeof(arginfo)),
476             (vaddr_t)vm->vm_minsaddr, PROT_NONE, TRUE))
477                 goto exec_abort;
478 #endif
479 
480 	/* remember information about the process */
481 	arginfo.ps_nargvstr = argc;
482 	arginfo.ps_nenvstr = envc;
483 
484 #ifdef MACHINE_STACK_GROWS_UP
485 	stack = (char *)vm->vm_maxsaddr + sizeof(arginfo) + sgap;
486 	slen = len - sizeof(arginfo) - sgap;
487 #else
488 	stack = (char *)(vm->vm_minsaddr - len);
489 #endif
490 	/* Now copy argc, args & environ to new stack */
491 	if (!(*pack.ep_emul->e_copyargs)(&pack, &arginfo, stack, argp))
492 		goto exec_abort;
493 
494 	/* copy out the process's ps_strings structure */
495 	if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
496 		goto exec_abort;
497 
498 	stopprofclock(pr);	/* stop profiling */
499 	fdcloseexec(p);		/* handle close on exec */
500 	execsigs(p);		/* reset caught signals */
501 	TCB_SET(p, NULL);	/* reset the TCB address */
502 
503 	/* set command name & other accounting info */
504 	memset(p->p_comm, 0, sizeof(p->p_comm));
505 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
506 	memcpy(p->p_comm, nid.ni_cnd.cn_nameptr, len);
507 	pr->ps_acflag &= ~AFORK;
508 
509 	/* record proc's vnode, for use by sysctl */
510 	otvp = pr->ps_textvp;
511 	vref(pack.ep_vp);
512 	pr->ps_textvp = pack.ep_vp;
513 	if (otvp)
514 		vrele(otvp);
515 
516 	atomic_setbits_int(&pr->ps_flags, PS_EXEC);
517 	if (pr->ps_flags & PS_PPWAIT) {
518 		atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
519 		atomic_clearbits_int(&pr->ps_pptr->ps_flags, PS_ISPWAIT);
520 		wakeup(pr->ps_pptr);
521 	}
522 
523 	/*
524 	 * If process does execve() while it has a mismatched real,
525 	 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
526 	 */
527 	if (cred->cr_uid != cred->cr_ruid ||
528 	    cred->cr_uid != cred->cr_svuid ||
529 	    cred->cr_gid != cred->cr_rgid ||
530 	    cred->cr_gid != cred->cr_svgid)
531 		atomic_setbits_int(&pr->ps_flags, PS_SUGIDEXEC);
532 	else
533 		atomic_clearbits_int(&pr->ps_flags, PS_SUGIDEXEC);
534 
535 	/*
536 	 * deal with set[ug]id.
537 	 * MNT_NOEXEC has already been used to disable s[ug]id.
538 	 */
539 	if ((attr.va_mode & (VSUID | VSGID)) && proc_cansugid(p)) {
540 		int i;
541 
542 		atomic_setbits_int(&pr->ps_flags, PS_SUGID|PS_SUGIDEXEC);
543 
544 #ifdef KTRACE
545 		/*
546 		 * If process is being ktraced, turn off - unless
547 		 * root set it.
548 		 */
549 		if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT))
550 			ktrcleartrace(pr);
551 #endif
552 		p->p_ucred = cred = crcopy(cred);
553 		if (attr.va_mode & VSUID)
554 			cred->cr_uid = attr.va_uid;
555 		if (attr.va_mode & VSGID)
556 			cred->cr_gid = attr.va_gid;
557 
558 		/*
559 		 * For set[ug]id processes, a few caveats apply to
560 		 * stdin, stdout, and stderr.
561 		 */
562 		error = 0;
563 		fdplock(p->p_fd);
564 		for (i = 0; i < 3; i++) {
565 			struct file *fp = NULL;
566 
567 			/*
568 			 * NOTE - This will never return NULL because of
569 			 * immature fds. The file descriptor table is not
570 			 * shared because we're suid.
571 			 */
572 			fp = fd_getfile(p->p_fd, i);
573 
574 			/*
575 			 * Ensure that stdin, stdout, and stderr are already
576 			 * allocated.  We do not want userland to accidentally
577 			 * allocate descriptors in this range which has implied
578 			 * meaning to libc.
579 			 */
580 			if (fp == NULL) {
581 				short flags = FREAD | (i == 0 ? 0 : FWRITE);
582 				struct vnode *vp;
583 				int indx;
584 
585 				if ((error = falloc(p, &fp, &indx)) != 0)
586 					break;
587 #ifdef DIAGNOSTIC
588 				if (indx != i)
589 					panic("sys_execve: falloc indx != i");
590 #endif
591 				if ((error = cdevvp(getnulldev(), &vp)) != 0) {
592 					fdremove(p->p_fd, indx);
593 					closef(fp, p);
594 					break;
595 				}
596 				if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
597 					fdremove(p->p_fd, indx);
598 					closef(fp, p);
599 					vrele(vp);
600 					break;
601 				}
602 				if (flags & FWRITE)
603 					vp->v_writecount++;
604 				fp->f_flag = flags;
605 				fp->f_type = DTYPE_VNODE;
606 				fp->f_ops = &vnops;
607 				fp->f_data = (caddr_t)vp;
608 				FILE_SET_MATURE(fp, p);
609 			}
610 		}
611 		fdpunlock(p->p_fd);
612 		if (error)
613 			goto exec_abort;
614 	} else
615 		atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
616 
617 	/*
618 	 * Reset the saved ugids and update the process's copy of the
619 	 * creds if the creds have been changed
620 	 */
621 	if (cred->cr_uid != cred->cr_svuid ||
622 	    cred->cr_gid != cred->cr_svgid) {
623 		/* make sure we have unshared ucreds */
624 		p->p_ucred = cred = crcopy(cred);
625 		cred->cr_svuid = cred->cr_uid;
626 		cred->cr_svgid = cred->cr_gid;
627 	}
628 
629 	if (pr->ps_ucred != cred) {
630 		struct ucred *ocred;
631 
632 		ocred = pr->ps_ucred;
633 		crhold(cred);
634 		pr->ps_ucred = cred;
635 		crfree(ocred);
636 	}
637 
638 	if (pr->ps_flags & PS_SUGIDEXEC) {
639 		int i, s = splclock();
640 
641 		timeout_del(&pr->ps_realit_to);
642 		for (i = 0; i < nitems(pr->ps_timer); i++) {
643 			timerclear(&pr->ps_timer[i].it_interval);
644 			timerclear(&pr->ps_timer[i].it_value);
645 		}
646 		splx(s);
647 	}
648 
649 	/* reset CPU time usage for the thread, but not the process */
650 	timespecclear(&p->p_tu.tu_runtime);
651 	p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
652 
653 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
654 
655 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
656 	vn_close(pack.ep_vp, FREAD, cred, p);
657 
658 	/*
659 	 * notify others that we exec'd
660 	 */
661 	KNOTE(&pr->ps_klist, NOTE_EXEC);
662 
663 	/* setup new registers and do misc. setup. */
664 	if (pack.ep_emul->e_fixup != NULL) {
665 		if ((*pack.ep_emul->e_fixup)(p, &pack) != 0)
666 			goto free_pack_abort;
667 	}
668 #ifdef MACHINE_STACK_GROWS_UP
669 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack + slen, retval);
670 #else
671 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack, retval);
672 #endif
673 
674 	/* map the process's signal trampoline code */
675 	if (exec_sigcode_map(pr, pack.ep_emul))
676 		goto free_pack_abort;
677 
678 #ifdef __HAVE_EXEC_MD_MAP
679 	/* perform md specific mappings that process might need */
680 	if (exec_md_map(p, &pack))
681 		goto free_pack_abort;
682 #endif
683 
684 	if (pr->ps_flags & PS_TRACED)
685 		psignal(p, SIGTRAP);
686 
687 	free(pack.ep_hdr, M_EXEC, 0);
688 
689 	/*
690 	 * Call emulation specific exec hook. This can setup per-process
691 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
692 	 *
693 	 * If we are executing process of different emulation than the
694 	 * original forked process, call e_proc_exit() of the old emulation
695 	 * first, then e_proc_exec() of new emulation. If the emulation is
696 	 * same, the exec hook code should deallocate any old emulation
697 	 * resources held previously by this process.
698 	 */
699 	if (pr->ps_emul && pr->ps_emul->e_proc_exit &&
700 	    pr->ps_emul != pack.ep_emul)
701 		(*pr->ps_emul->e_proc_exit)(p);
702 
703 	p->p_descfd = 255;
704 	if ((pack.ep_flags & EXEC_HASFD) && pack.ep_fd < 255)
705 		p->p_descfd = pack.ep_fd;
706 
707 	/*
708 	 * Call exec hook. Emulation code may NOT store reference to anything
709 	 * from &pack.
710 	 */
711 	if (pack.ep_emul->e_proc_exec)
712 		(*pack.ep_emul->e_proc_exec)(p, &pack);
713 
714 	/* update ps_emul, the old value is no longer needed */
715 	pr->ps_emul = pack.ep_emul;
716 
717 #ifdef KTRACE
718 	if (KTRPOINT(p, KTR_EMUL))
719 		ktremul(p);
720 #endif
721 
722 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
723 	single_thread_clear(p, P_SUSPSIG);
724 
725 #if NSYSTRACE > 0
726 	if (ISSET(p->p_flag, P_SYSTRACE) &&
727 	    wassugid && !ISSET(pr->ps_flags, PS_SUGID | PS_SUGIDEXEC))
728 		systrace_execve1(pathbuf, p);
729 #endif
730 
731 	if (pathbuf != NULL)
732 		pool_put(&namei_pool, pathbuf);
733 
734 	return (0);
735 
736 bad:
737 	/* free the vmspace-creation commands, and release their references */
738 	kill_vmcmds(&pack.ep_vmcmds);
739 	/* kill any opened file descriptor, if necessary */
740 	if (pack.ep_flags & EXEC_HASFD) {
741 		pack.ep_flags &= ~EXEC_HASFD;
742 		fdplock(p->p_fd);
743 		(void) fdrelease(p, pack.ep_fd);
744 		fdpunlock(p->p_fd);
745 	}
746 	if (pack.ep_interp != NULL)
747 		pool_put(&namei_pool, pack.ep_interp);
748 	if (pack.ep_emul_arg != NULL)
749 		free(pack.ep_emul_arg, M_TEMP, 0);
750 	/* close and put the exec'd file */
751 	vn_close(pack.ep_vp, FREAD, cred, p);
752 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
753 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
754 
755  freehdr:
756 	free(pack.ep_hdr, M_EXEC, 0);
757 #if NSYSTRACE > 0
758  clrflag:
759 #endif
760 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
761 	single_thread_clear(p, P_SUSPSIG);
762 
763 	if (pathbuf != NULL)
764 		pool_put(&namei_pool, pathbuf);
765 
766 	return (error);
767 
768 exec_abort:
769 	/*
770 	 * the old process doesn't exist anymore.  exit gracefully.
771 	 * get rid of the (new) address space we have created, if any, get rid
772 	 * of our namei data and vnode, and exit noting failure
773 	 */
774 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
775 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
776 	if (pack.ep_interp != NULL)
777 		pool_put(&namei_pool, pack.ep_interp);
778 	if (pack.ep_emul_arg != NULL)
779 		free(pack.ep_emul_arg, M_TEMP, 0);
780 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
781 	vn_close(pack.ep_vp, FREAD, cred, p);
782 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
783 
784 free_pack_abort:
785 	free(pack.ep_hdr, M_EXEC, 0);
786 	exit1(p, W_EXITCODE(0, SIGABRT), EXIT_NORMAL);
787 
788 	/* NOTREACHED */
789 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
790 	if (pathbuf != NULL)
791 		pool_put(&namei_pool, pathbuf);
792 
793 	return (0);
794 }
795 
796 
797 void *
798 copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
799     void *argp)
800 {
801 	char **cpp = stack;
802 	char *dp, *sp;
803 	size_t len;
804 	void *nullp = NULL;
805 	long argc = arginfo->ps_nargvstr;
806 	int envc = arginfo->ps_nenvstr;
807 
808 	if (copyout(&argc, cpp++, sizeof(argc)))
809 		return (NULL);
810 
811 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_emul->e_arglen);
812 	sp = argp;
813 
814 	/* XXX don't copy them out, remap them! */
815 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
816 
817 	for (; --argc >= 0; sp += len, dp += len)
818 		if (copyout(&dp, cpp++, sizeof(dp)) ||
819 		    copyoutstr(sp, dp, ARG_MAX, &len))
820 			return (NULL);
821 
822 	if (copyout(&nullp, cpp++, sizeof(nullp)))
823 		return (NULL);
824 
825 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
826 
827 	for (; --envc >= 0; sp += len, dp += len)
828 		if (copyout(&dp, cpp++, sizeof(dp)) ||
829 		    copyoutstr(sp, dp, ARG_MAX, &len))
830 			return (NULL);
831 
832 	if (copyout(&nullp, cpp++, sizeof(nullp)))
833 		return (NULL);
834 
835 	return (cpp);
836 }
837 
838 int
839 exec_sigcode_map(struct process *pr, struct emul *e)
840 {
841 	vsize_t sz;
842 
843 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
844 
845 	/*
846 	 * If we don't have a sigobject for this emulation, create one.
847 	 *
848 	 * sigobject is an anonymous memory object (just like SYSV shared
849 	 * memory) that we keep a permanent reference to and that we map
850 	 * in all processes that need this sigcode. The creation is simple,
851 	 * we create an object, add a permanent reference to it, map it in
852 	 * kernel space, copy out the sigcode to it and unmap it.
853 	 * Then we map it with PROT_READ|PROT_EXEC into the process just
854 	 * the way sys_mmap would map it.
855 	 */
856 	if (e->e_sigobject == NULL) {
857 		vaddr_t va;
858 		int r;
859 
860 		e->e_sigobject = uao_create(sz, 0);
861 		uao_reference(e->e_sigobject);	/* permanent reference */
862 
863 		if ((r = uvm_map(kernel_map, &va, round_page(sz), e->e_sigobject,
864 		    0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,
865 		    MAP_INHERIT_SHARE, MADV_RANDOM, 0)))) {
866 			uao_detach(e->e_sigobject);
867 			return (ENOMEM);
868 		}
869 		memcpy((void *)va, e->e_sigcode, sz);
870 		uvm_unmap(kernel_map, va, va + round_page(sz));
871 	}
872 
873 	pr->ps_sigcode = 0; /* no hint */
874 	uao_reference(e->e_sigobject);
875 	if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_sigcode, round_page(sz),
876 	    e->e_sigobject, 0, 0, UVM_MAPFLAG(PROT_READ | PROT_EXEC,
877 	    PROT_READ | PROT_WRITE | PROT_EXEC, MAP_INHERIT_COPY,
878 	    MADV_RANDOM, UVM_FLAG_COPYONW))) {
879 		uao_detach(e->e_sigobject);
880 		return (ENOMEM);
881 	}
882 
883 	return (0);
884 }
885