1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /* Copyright (c) 1988 AT&T */
27 /* All Rights Reserved */
28 /*
29 * Copyright 2014, Joyent, Inc. All rights reserved.
30 */
31
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/sysmacros.h>
35 #include <sys/systm.h>
36 #include <sys/signal.h>
37 #include <sys/cred_impl.h>
38 #include <sys/policy.h>
39 #include <sys/user.h>
40 #include <sys/errno.h>
41 #include <sys/file.h>
42 #include <sys/vfs.h>
43 #include <sys/vnode.h>
44 #include <sys/mman.h>
45 #include <sys/acct.h>
46 #include <sys/cpuvar.h>
47 #include <sys/proc.h>
48 #include <sys/cmn_err.h>
49 #include <sys/debug.h>
50 #include <sys/pathname.h>
51 #include <sys/vm.h>
52 #include <sys/lgrp.h>
53 #include <sys/vtrace.h>
54 #include <sys/exec.h>
55 #include <sys/exechdr.h>
56 #include <sys/kmem.h>
57 #include <sys/prsystm.h>
58 #include <sys/modctl.h>
59 #include <sys/vmparam.h>
60 #include <sys/door.h>
61 #include <sys/schedctl.h>
62 #include <sys/utrap.h>
63 #include <sys/systeminfo.h>
64 #include <sys/stack.h>
65 #include <sys/rctl.h>
66 #include <sys/dtrace.h>
67 #include <sys/lwpchan_impl.h>
68 #include <sys/pool.h>
69 #include <sys/sdt.h>
70 #include <sys/brand.h>
71 #include <sys/klpd.h>
72 #include <sys/random.h>
73
74 #include <c2/audit.h>
75
76 #include <vm/hat.h>
77 #include <vm/anon.h>
78 #include <vm/as.h>
79 #include <vm/seg.h>
80 #include <vm/seg_vn.h>
81
82 #define PRIV_RESET 0x01 /* needs to reset privs */
83 #define PRIV_SETID 0x02 /* needs to change uids */
84 #define PRIV_SETUGID 0x04 /* is setuid/setgid/forced privs */
85 #define PRIV_INCREASE 0x08 /* child runs with more privs */
86 #define MAC_FLAGS 0x10 /* need to adjust MAC flags */
87 #define PRIV_FORCED 0x20 /* has forced privileges */
88
89 static int execsetid(struct vnode *, struct vattr *, uid_t *, uid_t *,
90 priv_set_t *, cred_t *, const char *);
91 static int hold_execsw(struct execsw *);
92
93 uint_t auxv_hwcap = 0; /* auxv AT_SUN_HWCAP value; determined on the fly */
94 uint_t auxv_hwcap_2 = 0; /* AT_SUN_HWCAP2 */
95 #if defined(_SYSCALL32_IMPL)
96 uint_t auxv_hwcap32 = 0; /* 32-bit version of auxv_hwcap */
97 uint_t auxv_hwcap32_2 = 0; /* 32-bit version of auxv_hwcap2 */
98 #endif
99
100 #define PSUIDFLAGS (SNOCD|SUGID)
101
102 /*
103 * These are consumed within the specific exec modules, but are defined here because
104 *
105 * 1) The exec modules are unloadable, which would make this near useless.
106 *
107 * 2) We want them to be common across all of them, should more than ELF come
108 * to support them.
109 *
110 * All must be powers of 2.
111 */
112 volatile size_t aslr_max_brk_skew = 16 * 1024 * 1024; /* 16MB */
113 #pragma weak exec_stackgap = aslr_max_stack_skew /* Old, compatible name */
114 volatile size_t aslr_max_stack_skew = 64 * 1024; /* 64KB */
115
116 /*
117 * exece() - system call wrapper around exec_common()
118 */
119 int
120 exece(const char *fname, const char **argp, const char **envp)
121 {
122 int error;
123
124 error = exec_common(fname, argp, envp, EBA_NONE);
125 return (error ? (set_errno(error)) : 0);
126 }
127
128 int
129 exec_common(const char *fname, const char **argp, const char **envp,
130 int brand_action)
131 {
132 vnode_t *vp = NULL, *dir = NULL, *tmpvp = NULL;
133 proc_t *p = ttoproc(curthread);
134 klwp_t *lwp = ttolwp(curthread);
135 struct user *up = PTOU(p);
136 long execsz; /* temporary count of exec size */
137 int i;
138 int error;
139 char exec_file[MAXCOMLEN+1];
140 struct pathname pn;
141 struct pathname resolvepn;
142 struct uarg args;
143 struct execa ua;
144 k_sigset_t savedmask;
145 lwpdir_t *lwpdir = NULL;
146 tidhash_t *tidhash;
147 lwpdir_t *old_lwpdir = NULL;
148 uint_t old_lwpdir_sz;
149 tidhash_t *old_tidhash;
150 uint_t old_tidhash_sz;
151 ret_tidhash_t *ret_tidhash;
152 lwpent_t *lep;
153 boolean_t brandme = B_FALSE;
154
155 /*
156 * exec() is not supported for the /proc agent lwp.
157 */
158 if (curthread == p->p_agenttp)
159 return (ENOTSUP);
160
161 if (brand_action != EBA_NONE) {
162 /*
163 * Brand actions are not supported for processes that are not
164 * running in a branded zone.
165 */
166 if (!ZONE_IS_BRANDED(p->p_zone))
167 return (ENOTSUP);
168
169 if (brand_action == EBA_NATIVE) {
170 /* Only branded processes can be unbranded */
171 if (!PROC_IS_BRANDED(p))
172 return (ENOTSUP);
173 } else {
174 /* Only unbranded processes can be branded */
175 if (PROC_IS_BRANDED(p))
176 return (ENOTSUP);
177 brandme = B_TRUE;
178 }
179 } else {
180 /*
181 * If this is a native zone, or if the process is already
182 * branded, then we don't need to do anything. If this is
183 * a native process in a branded zone, we need to brand the
184 * process as it exec()s the new binary.
185 */
186 if (ZONE_IS_BRANDED(p->p_zone) && !PROC_IS_BRANDED(p))
187 brandme = B_TRUE;
188 }
189
190 /*
191 * Inform /proc that an exec() has started.
192 * Hold signals that are ignored by default so that we will
193 * not be interrupted by a signal that will be ignored after
194 * successful completion of gexec().
195 */
196 mutex_enter(&p->p_lock);
197 prexecstart();
198 schedctl_finish_sigblock(curthread);
199 savedmask = curthread->t_hold;
200 sigorset(&curthread->t_hold, &ignoredefault);
201 mutex_exit(&p->p_lock);
202
203 /*
204 * Look up path name and remember last component for later.
205 * To help coreadm expand its %d token, we attempt to save
206 * the directory containing the executable in p_execdir. The
207 * first call to lookuppn() may fail and return EINVAL because
208 * dirvpp is non-NULL. In that case, we make a second call to
209 * lookuppn() with dirvpp set to NULL; p_execdir will be NULL,
210 * but coreadm is allowed to expand %d to the empty string and
211 * there are other cases in which that failure may occur.
212 */
213 if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)
214 goto out;
215 pn_alloc(&resolvepn);
216 if ((error = lookuppn(&pn, &resolvepn, FOLLOW, &dir, &vp)) != 0) {
217 pn_free(&resolvepn);
218 pn_free(&pn);
219 if (error != EINVAL)
220 goto out;
221
222 dir = NULL;
223 if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)
224 goto out;
225 pn_alloc(&resolvepn);
226 if ((error = lookuppn(&pn, &resolvepn, FOLLOW, NULLVPP,
227 &vp)) != 0) {
228 pn_free(&resolvepn);
229 pn_free(&pn);
230 goto out;
231 }
232 }
233 if (vp == NULL) {
234 if (dir != NULL)
235 VN_RELE(dir);
236 error = ENOENT;
237 pn_free(&resolvepn);
238 pn_free(&pn);
239 goto out;
240 }
241
242 if ((error = secpolicy_basic_exec(CRED(), vp)) != 0) {
243 if (dir != NULL)
244 VN_RELE(dir);
245 pn_free(&resolvepn);
246 pn_free(&pn);
247 VN_RELE(vp);
248 goto out;
249 }
250
251 /*
252 * We do not allow executing files in attribute directories.
253 * We test this by determining whether the resolved path
254 * contains a "/" when we're in an attribute directory;
255 * only if the pathname does not contain a "/" the resolved path
256 * points to a file in the current working (attribute) directory.
257 */
258 if ((p->p_user.u_cdir->v_flag & V_XATTRDIR) != 0 &&
259 strchr(resolvepn.pn_path, '/') == NULL) {
260 if (dir != NULL)
261 VN_RELE(dir);
262 error = EACCES;
263 pn_free(&resolvepn);
264 pn_free(&pn);
265 VN_RELE(vp);
266 goto out;
267 }
268
269 bzero(exec_file, MAXCOMLEN+1);
270 (void) strncpy(exec_file, pn.pn_path, MAXCOMLEN);
271 bzero(&args, sizeof (args));
272 args.pathname = resolvepn.pn_path;
273 /* don't free resolvepn until we are done with args */
274 pn_free(&pn);
275
276 /*
277 * If we're running in a profile shell, then call pfexecd.
278 */
279 if ((CR_FLAGS(p->p_cred) & PRIV_PFEXEC) != 0) {
280 error = pfexec_call(p->p_cred, &resolvepn, &args.pfcred,
281 &args.scrubenv);
282
283 /* Returning errno in case we're not allowed to execute. */
284 if (error > 0) {
285 if (dir != NULL)
286 VN_RELE(dir);
287 pn_free(&resolvepn);
288 VN_RELE(vp);
289 goto out;
290 }
291
292 /* Don't change the credentials when using old ptrace. */
293 if (args.pfcred != NULL &&
294 (p->p_proc_flag & P_PR_PTRACE) != 0) {
295 crfree(args.pfcred);
296 args.pfcred = NULL;
297 args.scrubenv = B_FALSE;
298 }
299 }
300
301 /*
302 * Specific exec handlers, or policies determined via
303 * /etc/system may override the historical default.
304 */
305 args.stk_prot = PROT_ZFOD;
306 args.dat_prot = PROT_ZFOD;
307
308 CPU_STATS_ADD_K(sys, sysexec, 1);
309 DTRACE_PROC1(exec, char *, args.pathname);
310
311 ua.fname = fname;
312 ua.argp = argp;
313 ua.envp = envp;
314
315 /* If necessary, brand this process before we start the exec. */
316 if (brandme)
317 brand_setbrand(p);
318
319 if ((error = gexec(&vp, &ua, &args, NULL, 0, &execsz,
320 exec_file, p->p_cred, brand_action)) != 0) {
321 if (brandme)
322 brand_clearbrand(p, B_FALSE);
323 VN_RELE(vp);
324 if (dir != NULL)
325 VN_RELE(dir);
326 pn_free(&resolvepn);
327 goto fail;
328 }
329
330 /*
331 * Free floating point registers (sun4u only)
332 */
333 ASSERT(lwp != NULL);
334 lwp_freeregs(lwp, 1);
335
336 /*
337 * Free thread and process context ops.
338 */
339 if (curthread->t_ctx)
340 freectx(curthread, 1);
341 if (p->p_pctx)
342 freepctx(p, 1);
343
344 /*
345 * Remember file name for accounting; clear any cached DTrace predicate.
346 */
347 up->u_acflag &= ~AFORK;
348 bcopy(exec_file, up->u_comm, MAXCOMLEN+1);
349 curthread->t_predcache = NULL;
350
351 /*
352 * Clear contract template state
353 */
354 lwp_ctmpl_clear(lwp);
355
356 /*
357 * Save the directory in which we found the executable for expanding
358 * the %d token used in core file patterns.
359 */
360 mutex_enter(&p->p_lock);
361 tmpvp = p->p_execdir;
362 p->p_execdir = dir;
363 if (p->p_execdir != NULL)
364 VN_HOLD(p->p_execdir);
365 mutex_exit(&p->p_lock);
366
367 if (tmpvp != NULL)
368 VN_RELE(tmpvp);
369
370 /*
371 * Reset stack state to the user stack, clear set of signals
372 * caught on the signal stack, and reset list of signals that
373 * restart system calls; the new program's environment should
374 * not be affected by detritus from the old program. Any
375 * pending held signals remain held, so don't clear t_hold.
376 */
377 mutex_enter(&p->p_lock);
378 lwp->lwp_oldcontext = 0;
379 lwp->lwp_ustack = 0;
380 lwp->lwp_old_stk_ctl = 0;
381 sigemptyset(&up->u_signodefer);
382 sigemptyset(&up->u_sigonstack);
383 sigemptyset(&up->u_sigresethand);
384 lwp->lwp_sigaltstack.ss_sp = 0;
385 lwp->lwp_sigaltstack.ss_size = 0;
386 lwp->lwp_sigaltstack.ss_flags = SS_DISABLE;
387
388 /*
389 * Make saved resource limit == current resource limit.
390 */
391 for (i = 0; i < RLIM_NLIMITS; i++) {
392 /*CONSTCOND*/
393 if (RLIM_SAVED(i)) {
394 (void) rctl_rlimit_get(rctlproc_legacy[i], p,
395 &up->u_saved_rlimit[i]);
396 }
397 }
398
399 /*
400 * If the action was to catch the signal, then the action
401 * must be reset to SIG_DFL.
402 */
403 sigdefault(p);
404 p->p_flag &= ~(SNOWAIT|SJCTL);
405 p->p_flag |= (SEXECED|SMSACCT|SMSFORK);
406 up->u_signal[SIGCLD - 1] = SIG_DFL;
407
408 /*
409 * Delete the dot4 sigqueues/signotifies.
410 */
411 sigqfree(p);
412
413 mutex_exit(&p->p_lock);
414
415 mutex_enter(&p->p_pflock);
416 p->p_prof.pr_base = NULL;
417 p->p_prof.pr_size = 0;
418 p->p_prof.pr_off = 0;
419 p->p_prof.pr_scale = 0;
420 p->p_prof.pr_samples = 0;
421 mutex_exit(&p->p_pflock);
422
423 ASSERT(curthread->t_schedctl == NULL);
424
425 #if defined(__sparc)
426 if (p->p_utraps != NULL)
427 utrap_free(p);
428 #endif /* __sparc */
429
430 /*
431 * Close all close-on-exec files.
432 */
433 close_exec(P_FINFO(p));
434 TRACE_2(TR_FAC_PROC, TR_PROC_EXEC, "proc_exec:p %p up %p", p, up);
435
436 /* Unbrand ourself if necessary. */
437 if (PROC_IS_BRANDED(p) && (brand_action == EBA_NATIVE))
438 brand_clearbrand(p, B_FALSE);
439
440 setregs(&args);
441
442 /* Mark this as an executable vnode */
443 mutex_enter(&vp->v_lock);
444 vp->v_flag |= VVMEXEC;
445 mutex_exit(&vp->v_lock);
446
447 VN_RELE(vp);
448 if (dir != NULL)
449 VN_RELE(dir);
450 pn_free(&resolvepn);
451
452 /*
453 * Allocate a new lwp directory and lwpid hash table if necessary.
454 */
455 if (curthread->t_tid != 1 || p->p_lwpdir_sz != 2) {
456 lwpdir = kmem_zalloc(2 * sizeof (lwpdir_t), KM_SLEEP);
457 lwpdir->ld_next = lwpdir + 1;
458 tidhash = kmem_zalloc(2 * sizeof (tidhash_t), KM_SLEEP);
459 if (p->p_lwpdir != NULL)
460 lep = p->p_lwpdir[curthread->t_dslot].ld_entry;
461 else
462 lep = kmem_zalloc(sizeof (*lep), KM_SLEEP);
463 }
464
465 if (PROC_IS_BRANDED(p))
466 BROP(p)->b_exec();
467
468 mutex_enter(&p->p_lock);
469 prbarrier(p);
470
471 /*
472 * Reset lwp id to the default value of 1.
473 * This is a single-threaded process now
474 * and lwp #1 is lwp_wait()able by default.
475 * The t_unpark flag should not be inherited.
476 */
477 ASSERT(p->p_lwpcnt == 1 && p->p_zombcnt == 0);
478 curthread->t_tid = 1;
479 kpreempt_disable();
480 ASSERT(curthread->t_lpl != NULL);
481 p->p_t1_lgrpid = curthread->t_lpl->lpl_lgrpid;
482 kpreempt_enable();
483 if (p->p_tr_lgrpid != LGRP_NONE && p->p_tr_lgrpid != p->p_t1_lgrpid) {
484 lgrp_update_trthr_migrations(1);
485 }
486 curthread->t_unpark = 0;
487 curthread->t_proc_flag |= TP_TWAIT;
488 curthread->t_proc_flag &= ~TP_DAEMON; /* daemons shouldn't exec */
489 p->p_lwpdaemon = 0; /* but oh well ... */
490 p->p_lwpid = 1;
491
492 /*
493 * Install the newly-allocated lwp directory and lwpid hash table
494 * and insert the current thread into the new hash table.
495 */
496 if (lwpdir != NULL) {
497 old_lwpdir = p->p_lwpdir;
498 old_lwpdir_sz = p->p_lwpdir_sz;
499 old_tidhash = p->p_tidhash;
500 old_tidhash_sz = p->p_tidhash_sz;
501 p->p_lwpdir = p->p_lwpfree = lwpdir;
502 p->p_lwpdir_sz = 2;
503 lep->le_thread = curthread;
504 lep->le_lwpid = curthread->t_tid;
505 lep->le_start = curthread->t_start;
506 lwp_hash_in(p, lep, tidhash, 2, 0);
507 p->p_tidhash = tidhash;
508 p->p_tidhash_sz = 2;
509 }
510 ret_tidhash = p->p_ret_tidhash;
511 p->p_ret_tidhash = NULL;
512
513 /*
514 * Restore the saved signal mask and
515 * inform /proc that the exec() has finished.
516 */
517 curthread->t_hold = savedmask;
518 prexecend();
519 mutex_exit(&p->p_lock);
520 if (old_lwpdir) {
521 kmem_free(old_lwpdir, old_lwpdir_sz * sizeof (lwpdir_t));
522 kmem_free(old_tidhash, old_tidhash_sz * sizeof (tidhash_t));
523 }
524 while (ret_tidhash != NULL) {
525 ret_tidhash_t *next = ret_tidhash->rth_next;
526 kmem_free(ret_tidhash->rth_tidhash,
527 ret_tidhash->rth_tidhash_sz * sizeof (tidhash_t));
528 kmem_free(ret_tidhash, sizeof (*ret_tidhash));
529 ret_tidhash = next;
530 }
531
532 ASSERT(error == 0);
533 DTRACE_PROC(exec__success);
534 return (0);
535
536 fail:
537 DTRACE_PROC1(exec__failure, int, error);
538 out: /* error return */
539 mutex_enter(&p->p_lock);
540 curthread->t_hold = savedmask;
541 prexecend();
542 mutex_exit(&p->p_lock);
543 ASSERT(error != 0);
544 return (error);
545 }
546
547
548 /*
549 * Perform generic exec duties and switchout to object-file specific
550 * handler.
551 */
552 int
553 gexec(
554 struct vnode **vpp,
555 struct execa *uap,
556 struct uarg *args,
557 struct intpdata *idatap,
558 int level,
559 long *execsz,
560 caddr_t exec_file,
561 struct cred *cred,
562 int brand_action)
563 {
564 struct vnode *vp, *execvp = NULL;
565 proc_t *pp = ttoproc(curthread);
566 struct execsw *eswp;
567 int error = 0;
568 int suidflags = 0;
569 ssize_t resid;
570 uid_t uid, gid;
571 struct vattr vattr;
572 char magbuf[MAGIC_BYTES];
573 int setid;
574 cred_t *oldcred, *newcred = NULL;
575 int privflags = 0;
576 int setidfl;
577 priv_set_t fset;
578
579 /*
580 * If the SNOCD or SUGID flag is set, turn it off and remember the
581 * previous setting so we can restore it if we encounter an error.
582 */
583 if (level == 0 && (pp->p_flag & PSUIDFLAGS)) {
584 mutex_enter(&pp->p_lock);
585 suidflags = pp->p_flag & PSUIDFLAGS;
586 pp->p_flag &= ~PSUIDFLAGS;
587 mutex_exit(&pp->p_lock);
588 }
589
590 if ((error = execpermissions(*vpp, &vattr, args)) != 0)
591 goto bad_noclose;
592
593 /* need to open vnode for stateful file systems */
594 if ((error = VOP_OPEN(vpp, FREAD, CRED(), NULL)) != 0)
595 goto bad_noclose;
596 vp = *vpp;
597
598 /*
599 * Note: to support binary compatibility with SunOS a.out
600 * executables, we read in the first four bytes, as the
601 * magic number is in bytes 2-3.
602 */
603 if (error = vn_rdwr(UIO_READ, vp, magbuf, sizeof (magbuf),
604 (offset_t)0, UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))
605 goto bad;
606 if (resid != 0)
607 goto bad;
608
609 if ((eswp = findexec_by_hdr(magbuf)) == NULL)
610 goto bad;
611
612 if (level == 0 &&
613 (privflags = execsetid(vp, &vattr, &uid, &gid, &fset,
614 args->pfcred == NULL ? cred : args->pfcred, args->pathname)) != 0) {
615
616 /* Pfcred is a credential with a ref count of 1 */
617
618 if (args->pfcred != NULL) {
619 privflags |= PRIV_INCREASE|PRIV_RESET;
620 newcred = cred = args->pfcred;
621 } else {
622 newcred = cred = crdup(cred);
623 }
624
625 /* If we can, drop the PA bit */
626 if ((privflags & PRIV_RESET) != 0)
627 priv_adjust_PA(cred);
628
629 if (privflags & PRIV_SETID) {
630 cred->cr_uid = uid;
631 cred->cr_gid = gid;
632 cred->cr_suid = uid;
633 cred->cr_sgid = gid;
634 }
635
636 if (privflags & MAC_FLAGS) {
637 if (!(CR_FLAGS(cred) & NET_MAC_AWARE_INHERIT))
638 CR_FLAGS(cred) &= ~NET_MAC_AWARE;
639 CR_FLAGS(cred) &= ~NET_MAC_AWARE_INHERIT;
640 }
641
642 /*
643 * Implement the privilege updates:
644 *
645 * Restrict with L:
646 *
647 * I' = I & L
648 *
649 * E' = P' = (I' + F) & A
650 *
651 * But if running under ptrace, we cap I and F with P.
652 */
653 if ((privflags & (PRIV_RESET|PRIV_FORCED)) != 0) {
654 if ((privflags & PRIV_INCREASE) != 0 &&
655 (pp->p_proc_flag & P_PR_PTRACE) != 0) {
656 priv_intersect(&CR_OPPRIV(cred),
657 &CR_IPRIV(cred));
658 priv_intersect(&CR_OPPRIV(cred), &fset);
659 }
660 priv_intersect(&CR_LPRIV(cred), &CR_IPRIV(cred));
661 CR_EPRIV(cred) = CR_PPRIV(cred) = CR_IPRIV(cred);
662 if (privflags & PRIV_FORCED) {
663 priv_set_PA(cred);
664 priv_union(&fset, &CR_EPRIV(cred));
665 priv_union(&fset, &CR_PPRIV(cred));
666 }
667 priv_adjust_PA(cred);
668 }
669 } else if (level == 0 && args->pfcred != NULL) {
670 newcred = cred = args->pfcred;
671 privflags |= PRIV_INCREASE;
672 /* pfcred is not forced to adhere to these settings */
673 priv_intersect(&CR_LPRIV(cred), &CR_IPRIV(cred));
674 CR_EPRIV(cred) = CR_PPRIV(cred) = CR_IPRIV(cred);
675 priv_adjust_PA(cred);
676 }
677
678 /* The new image gets the inheritable secflags as its secflags */
679 /* XXX: This probably means we have the wrong secflags when exec fails */
680 secflag_promote(pp);
681
682 /* SunOS 4.x buy-back */
683 if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) &&
684 (vattr.va_mode & (VSUID|VSGID))) {
685 char path[MAXNAMELEN];
686 refstr_t *mntpt = NULL;
687 int ret = -1;
688
689 bzero(path, sizeof (path));
690 zone_hold(pp->p_zone);
691
692 ret = vnodetopath(pp->p_zone->zone_rootvp, vp, path,
693 sizeof (path), cred);
694
695 /* fallback to mountpoint if a path can't be found */
696 if ((ret != 0) || (ret == 0 && path[0] == '\0'))
697 mntpt = vfs_getmntpoint(vp->v_vfsp);
698
699 if (mntpt == NULL)
700 zcmn_err(pp->p_zone->zone_id, CE_NOTE,
701 "!uid %d: setuid execution not allowed, "
702 "file=%s", cred->cr_uid, path);
703 else
704 zcmn_err(pp->p_zone->zone_id, CE_NOTE,
705 "!uid %d: setuid execution not allowed, "
706 "fs=%s, file=%s", cred->cr_uid,
707 ZONE_PATH_TRANSLATE(refstr_value(mntpt),
708 pp->p_zone), exec_file);
709
710 if (!INGLOBALZONE(pp)) {
711 /* zone_rootpath always has trailing / */
712 if (mntpt == NULL)
713 cmn_err(CE_NOTE, "!zone: %s, uid: %d "
714 "setuid execution not allowed, file=%s%s",
715 pp->p_zone->zone_name, cred->cr_uid,
716 pp->p_zone->zone_rootpath, path + 1);
717 else
718 cmn_err(CE_NOTE, "!zone: %s, uid: %d "
719 "setuid execution not allowed, fs=%s, "
720 "file=%s", pp->p_zone->zone_name,
721 cred->cr_uid, refstr_value(mntpt),
722 exec_file);
723 }
724
725 if (mntpt != NULL)
726 refstr_rele(mntpt);
727
728 zone_rele(pp->p_zone);
729 }
730
731 /*
732 * execsetid() told us whether or not we had to change the
733 * credentials of the process. In privflags, it told us
734 * whether we gained any privileges or executed a set-uid executable.
735 */
736 setid = (privflags & (PRIV_SETUGID|PRIV_INCREASE|PRIV_FORCED));
737
738 /*
739 * Use /etc/system variable to determine if the stack
740 * should be marked as executable by default.
741 */
742 if (noexec_user_stack)
743 args->stk_prot &= ~PROT_EXEC;
744
745 args->execswp = eswp; /* Save execsw pointer in uarg for exec_func */
746 args->ex_vp = vp;
747
748 /*
749 * Traditionally, the setid flags told the sub processes whether
750 * the file just executed was set-uid or set-gid; this caused
751 * some confusion as the 'setid' flag did not match the SUGID
752 * process flag which is only set when the uids/gids do not match.
753 * A script set-gid/set-uid to the real uid/gid would start with
754 * /dev/fd/X but an executable would happily trust LD_LIBRARY_PATH.
755 * Now we flag those cases where the calling process cannot
756 * be trusted to influence the newly exec'ed process, either
757 * because it runs with more privileges or when the uids/gids
758 * do in fact not match.
759 * This also makes the runtime linker agree with the on exec
760 * values of SNOCD and SUGID.
761 */
762 setidfl = 0;
763 if (cred->cr_uid != cred->cr_ruid || (cred->cr_rgid != cred->cr_gid &&
764 !supgroupmember(cred->cr_gid, cred))) {
765 setidfl |= EXECSETID_UGIDS;
766 }
767 if (setid & PRIV_SETUGID)
768 setidfl |= EXECSETID_SETID;
769 if (setid & PRIV_FORCED)
770 setidfl |= EXECSETID_PRIVS;
771
772 execvp = pp->p_exec;
773 if (execvp)
774 VN_HOLD(execvp);
775
776 error = (*eswp->exec_func)(vp, uap, args, idatap, level, execsz,
777 setidfl, exec_file, cred, brand_action);
778 rw_exit(eswp->exec_lock);
779 if (error != 0) {
780 if (execvp)
781 VN_RELE(execvp);
782 /*
783 * If this process's p_exec has been set to the vp of
784 * the executable by exec_func, we will return without
785 * calling VOP_CLOSE because proc_exit will close it
786 * on exit.
787 */
788 if (pp->p_exec == vp)
789 goto bad_noclose;
790 else
791 goto bad;
792 }
793
794 if (level == 0) {
795 uid_t oruid;
796
797 if (execvp != NULL) {
798 /*
799 * Close the previous executable only if we are
800 * at level 0.
801 */
802 (void) VOP_CLOSE(execvp, FREAD, 1, (offset_t)0,
803 cred, NULL);
804 }
805
806 mutex_enter(&pp->p_crlock);
807
808 oruid = pp->p_cred->cr_ruid;
809
810 if (newcred != NULL) {
811 /*
812 * Free the old credentials, and set the new ones.
813 * Do this for both the process and the (single) thread.
814 */
815 crfree(pp->p_cred);
816 pp->p_cred = cred; /* cred already held for proc */
817 crhold(cred); /* hold new cred for thread */
818 /*
819 * DTrace accesses t_cred in probe context. t_cred
820 * must always be either NULL, or point to a valid,
821 * allocated cred structure.
822 */
823 oldcred = curthread->t_cred;
824 curthread->t_cred = cred;
825 crfree(oldcred);
826
827 if (priv_basic_test >= 0 &&
828 !PRIV_ISASSERT(&CR_IPRIV(newcred),
829 priv_basic_test)) {
830 pid_t pid = pp->p_pid;
831 char *fn = PTOU(pp)->u_comm;
832
833 cmn_err(CE_WARN, "%s[%d]: exec: basic_test "
834 "privilege removed from E/I", fn, pid);
835 }
836 }
837 /*
838 * On emerging from a successful exec(), the saved
839 * uid and gid equal the effective uid and gid.
840 */
841 cred->cr_suid = cred->cr_uid;
842 cred->cr_sgid = cred->cr_gid;
843
844 /*
845 * If the real and effective ids do not match, this
846 * is a setuid process that should not dump core.
847 * The group comparison is tricky; we prevent the code
848 * from flagging SNOCD when executing with an effective gid
849 * which is a supplementary group.
850 */
851 if (cred->cr_ruid != cred->cr_uid ||
852 (cred->cr_rgid != cred->cr_gid &&
853 !supgroupmember(cred->cr_gid, cred)) ||
854 (privflags & PRIV_INCREASE) != 0)
855 suidflags = PSUIDFLAGS;
856 else
857 suidflags = 0;
858
859 mutex_exit(&pp->p_crlock);
860 if (newcred != NULL && oruid != newcred->cr_ruid) {
861 /* Note that the process remains in the same zone. */
862 mutex_enter(&pidlock);
863 upcount_dec(oruid, crgetzoneid(newcred));
864 upcount_inc(newcred->cr_ruid, crgetzoneid(newcred));
865 mutex_exit(&pidlock);
866 }
867 if (suidflags) {
868 mutex_enter(&pp->p_lock);
869 pp->p_flag |= suidflags;
870 mutex_exit(&pp->p_lock);
871 }
872 if (setid && (pp->p_proc_flag & P_PR_PTRACE) == 0) {
873 /*
874 * If process is traced via /proc, arrange to
875 * invalidate the associated /proc vnode.
876 */
877 if (pp->p_plist || (pp->p_proc_flag & P_PR_TRACE))
878 args->traceinval = 1;
879 }
880 if (pp->p_proc_flag & P_PR_PTRACE)
881 psignal(pp, SIGTRAP);
882 if (args->traceinval)
883 prinvalidate(&pp->p_user);
884 }
885 if (execvp)
886 VN_RELE(execvp);
887 return (0);
888
889 bad:
890 (void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL);
891
892 bad_noclose:
893 if (newcred != NULL)
894 crfree(newcred);
895 if (error == 0)
896 error = ENOEXEC;
897
898 if (suidflags) {
899 mutex_enter(&pp->p_lock);
900 pp->p_flag |= suidflags;
901 mutex_exit(&pp->p_lock);
902 }
903 return (error);
904 }
905
906 extern char *execswnames[];
907
908 struct execsw *
909 allocate_execsw(char *name, char *magic, size_t magic_size)
910 {
911 int i, j;
912 char *ename;
913 char *magicp;
914
915 mutex_enter(&execsw_lock);
916 for (i = 0; i < nexectype; i++) {
917 if (execswnames[i] == NULL) {
918 ename = kmem_alloc(strlen(name) + 1, KM_SLEEP);
919 (void) strcpy(ename, name);
920 execswnames[i] = ename;
921 /*
922 * Set the magic number last so that we
923 * don't need to hold the execsw_lock in
924 * findexectype().
925 */
926 magicp = kmem_alloc(magic_size, KM_SLEEP);
927 for (j = 0; j < magic_size; j++)
928 magicp[j] = magic[j];
929 execsw[i].exec_magic = magicp;
930 mutex_exit(&execsw_lock);
931 return (&execsw[i]);
932 }
933 }
934 mutex_exit(&execsw_lock);
935 return (NULL);
936 }
937
938 /*
939 * Find the exec switch table entry with the corresponding magic string.
940 */
941 struct execsw *
942 findexecsw(char *magic)
943 {
944 struct execsw *eswp;
945
946 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
947 ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
948 if (magic && eswp->exec_maglen != 0 &&
949 bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0)
950 return (eswp);
951 }
952 return (NULL);
953 }
954
955 /*
956 * Find the execsw[] index for the given exec header string by looking for the
957 * magic string at a specified offset and length for each kind of executable
958 * file format until one matches. If no execsw[] entry is found, try to
959 * autoload a module for this magic string.
960 */
961 struct execsw *
962 findexec_by_hdr(char *header)
963 {
964 struct execsw *eswp;
965
966 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
967 ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
968 if (header && eswp->exec_maglen != 0 &&
969 bcmp(&header[eswp->exec_magoff], eswp->exec_magic,
970 eswp->exec_maglen) == 0) {
971 if (hold_execsw(eswp) != 0)
972 return (NULL);
973 return (eswp);
974 }
975 }
976 return (NULL); /* couldn't find the type */
977 }
978
979 /*
980 * Find the execsw[] index for the given magic string. If no execsw[] entry
981 * is found, try to autoload a module for this magic string.
982 */
983 struct execsw *
984 findexec_by_magic(char *magic)
985 {
986 struct execsw *eswp;
987
988 for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
989 ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
990 if (magic && eswp->exec_maglen != 0 &&
991 bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0) {
992 if (hold_execsw(eswp) != 0)
993 return (NULL);
994 return (eswp);
995 }
996 }
997 return (NULL); /* couldn't find the type */
998 }
999
1000 static int
1001 hold_execsw(struct execsw *eswp)
1002 {
1003 char *name;
1004
1005 rw_enter(eswp->exec_lock, RW_READER);
1006 while (!LOADED_EXEC(eswp)) {
1007 rw_exit(eswp->exec_lock);
1008 name = execswnames[eswp-execsw];
1009 ASSERT(name);
1010 if (modload("exec", name) == -1)
1011 return (-1);
1012 rw_enter(eswp->exec_lock, RW_READER);
1013 }
1014 return (0);
1015 }
1016
1017 static int
1018 execsetid(struct vnode *vp, struct vattr *vattrp, uid_t *uidp, uid_t *gidp,
1019 priv_set_t *fset, cred_t *cr, const char *pathname)
1020 {
1021 proc_t *pp = ttoproc(curthread);
1022 uid_t uid, gid;
1023 int privflags = 0;
1024
1025 /*
1026 * Remember credentials.
1027 */
1028 uid = cr->cr_uid;
1029 gid = cr->cr_gid;
1030
1031 /* Will try to reset the PRIV_AWARE bit later. */
1032 if ((CR_FLAGS(cr) & (PRIV_AWARE|PRIV_AWARE_INHERIT)) == PRIV_AWARE)
1033 privflags |= PRIV_RESET;
1034
1035 if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) == 0) {
1036 /*
1037 * If it's a set-uid root program we perform the
1038 * forced privilege look-aside. This has three possible
1039 * outcomes:
1040 * no look aside information -> treat as before
1041 * look aside in Limit set -> apply forced privs
1042 * look aside not in Limit set -> ignore set-uid root
1043 *
1044 * Ordinary set-uid root execution only allowed if the limit
1045 * set holds all unsafe privileges.
1046 */
1047 if (vattrp->va_mode & VSUID) {
1048 if (vattrp->va_uid == 0) {
1049 int res = get_forced_privs(cr, pathname, fset);
1050
1051 switch (res) {
1052 case -1:
1053 if (priv_issubset(&priv_unsafe,
1054 &CR_LPRIV(cr))) {
1055 uid = vattrp->va_uid;
1056 privflags |= PRIV_SETUGID;
1057 }
1058 break;
1059 case 0:
1060 privflags |= PRIV_FORCED|PRIV_INCREASE;
1061 break;
1062 default:
1063 break;
1064 }
1065 } else {
1066 uid = vattrp->va_uid;
1067 privflags |= PRIV_SETUGID;
1068 }
1069 }
1070 if (vattrp->va_mode & VSGID) {
1071 gid = vattrp->va_gid;
1072 privflags |= PRIV_SETUGID;
1073 }
1074 }
1075
1076 /*
1077 * Do we need to change our credential anyway?
1078 * This is the case when E != I or P != I, as
1079 * we need to do the assignments (with F empty and A full)
1080 * Or when I is not a subset of L; in that case we need to
1081 * enforce L.
1082 *
1083 * I' = L & I
1084 *
1085 * E' = P' = (I' + F) & A
1086 * or
1087 * E' = P' = I'
1088 */
1089 if (!priv_isequalset(&CR_EPRIV(cr), &CR_IPRIV(cr)) ||
1090 !priv_issubset(&CR_IPRIV(cr), &CR_LPRIV(cr)) ||
1091 !priv_isequalset(&CR_PPRIV(cr), &CR_IPRIV(cr)))
1092 privflags |= PRIV_RESET;
1093
1094 /* Child has more privileges than parent */
1095 if (!priv_issubset(&CR_IPRIV(cr), &CR_PPRIV(cr)))
1096 privflags |= PRIV_INCREASE;
1097
1098 /* If MAC-aware flag(s) are on, need to update cred to remove. */
1099 if ((CR_FLAGS(cr) & NET_MAC_AWARE) ||
1100 (CR_FLAGS(cr) & NET_MAC_AWARE_INHERIT))
1101 privflags |= MAC_FLAGS;
1102 /*
1103 * Set setuid/setgid protections if no ptrace() compatibility.
1104 * For privileged processes, honor setuid/setgid even in
1105 * the presence of ptrace() compatibility.
1106 */
1107 if (((pp->p_proc_flag & P_PR_PTRACE) == 0 ||
1108 PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, (uid == 0))) &&
1109 (cr->cr_uid != uid ||
1110 cr->cr_gid != gid ||
1111 cr->cr_suid != uid ||
1112 cr->cr_sgid != gid)) {
1113 *uidp = uid;
1114 *gidp = gid;
1115 privflags |= PRIV_SETID;
1116 }
1117 return (privflags);
1118 }
1119
1120 int
1121 execpermissions(struct vnode *vp, struct vattr *vattrp, struct uarg *args)
1122 {
1123 int error;
1124 proc_t *p = ttoproc(curthread);
1125
1126 vattrp->va_mask = AT_MODE | AT_UID | AT_GID | AT_SIZE;
1127 if (error = VOP_GETATTR(vp, vattrp, ATTR_EXEC, p->p_cred, NULL))
1128 return (error);
1129 /*
1130 * Check the access mode.
1131 * If VPROC, ask /proc if the file is an object file.
1132 */
1133 if ((error = VOP_ACCESS(vp, VEXEC, 0, p->p_cred, NULL)) != 0 ||
1134 !(vp->v_type == VREG || (vp->v_type == VPROC && pr_isobject(vp))) ||
1135 (vp->v_vfsp->vfs_flag & VFS_NOEXEC) != 0 ||
1136 (vattrp->va_mode & (VEXEC|(VEXEC>>3)|(VEXEC>>6))) == 0) {
1137 if (error == 0)
1138 error = EACCES;
1139 return (error);
1140 }
1141
1142 if ((p->p_plist || (p->p_proc_flag & (P_PR_PTRACE|P_PR_TRACE))) &&
1143 (error = VOP_ACCESS(vp, VREAD, 0, p->p_cred, NULL))) {
1144 /*
1145 * If process is under ptrace(2) compatibility,
1146 * fail the exec(2).
1147 */
1148 if (p->p_proc_flag & P_PR_PTRACE)
1149 goto bad;
1150 /*
1151 * Process is traced via /proc.
1152 * Arrange to invalidate the /proc vnode.
1153 */
1154 args->traceinval = 1;
1155 }
1156 return (0);
1157 bad:
1158 if (error == 0)
1159 error = ENOEXEC;
1160 return (error);
1161 }
1162
1163 /*
1164 * Map a section of an executable file into the user's
1165 * address space.
1166 */
1167 int
1168 execmap(struct vnode *vp, caddr_t addr, size_t len, size_t zfodlen,
1169 off_t offset, int prot, int page, uint_t szc)
1170 {
1171 int error = 0;
1172 off_t oldoffset;
1173 caddr_t zfodbase, oldaddr;
1174 size_t end, oldlen;
1175 size_t zfoddiff;
1176 label_t ljb;
1177 proc_t *p = ttoproc(curthread);
1178
1179 oldaddr = addr;
1180 addr = (caddr_t)((uintptr_t)addr & (uintptr_t)PAGEMASK);
1181 if (len) {
1182 oldlen = len;
1183 len += ((size_t)oldaddr - (size_t)addr);
1184 oldoffset = offset;
1185 offset = (off_t)((uintptr_t)offset & PAGEMASK);
1186 if (page) {
1187 spgcnt_t prefltmem, availm, npages;
1188 int preread;
1189 uint_t mflag = MAP_PRIVATE | MAP_FIXED;
1190
1191 if ((prot & (PROT_WRITE | PROT_EXEC)) == PROT_EXEC) {
1192 mflag |= MAP_TEXT;
1193 } else {
1194 mflag |= MAP_INITDATA;
1195 }
1196
1197 if (valid_usr_range(addr, len, prot, p->p_as,
1198 p->p_as->a_userlimit) != RANGE_OKAY) {
1199 error = ENOMEM;
1200 goto bad;
1201 }
1202 if (error = VOP_MAP(vp, (offset_t)offset,
1203 p->p_as, &addr, len, prot, PROT_ALL,
1204 mflag, CRED(), NULL))
1205 goto bad;
1206
1207 /*
1208 * If the segment can fit, then we prefault
1209 * the entire segment in. This is based on the
1210 * model that says the best working set of a
1211 * small program is all of its pages.
1212 */
1213 npages = (spgcnt_t)btopr(len);
1214 prefltmem = freemem - desfree;
1215 preread =
1216 (npages < prefltmem && len < PGTHRESH) ? 1 : 0;
1217
1218 /*
1219 * If we aren't prefaulting the segment,
1220 * increment "deficit", if necessary to ensure
1221 * that pages will become available when this
1222 * process starts executing.
1223 */
1224 availm = freemem - lotsfree;
1225 if (preread == 0 && npages > availm &&
1226 deficit < lotsfree) {
1227 deficit += MIN((pgcnt_t)(npages - availm),
1228 lotsfree - deficit);
1229 }
1230
1231 if (preread) {
1232 TRACE_2(TR_FAC_PROC, TR_EXECMAP_PREREAD,
1233 "execmap preread:freemem %d size %lu",
1234 freemem, len);
1235 (void) as_fault(p->p_as->a_hat, p->p_as,
1236 (caddr_t)addr, len, F_INVAL, S_READ);
1237 }
1238 } else {
1239 if (valid_usr_range(addr, len, prot, p->p_as,
1240 p->p_as->a_userlimit) != RANGE_OKAY) {
1241 error = ENOMEM;
1242 goto bad;
1243 }
1244
1245 if (error = as_map(p->p_as, addr, len,
1246 segvn_create, zfod_argsp))
1247 goto bad;
1248 /*
1249 * Read in the segment in one big chunk.
1250 */
1251 if (error = vn_rdwr(UIO_READ, vp, (caddr_t)oldaddr,
1252 oldlen, (offset_t)oldoffset, UIO_USERSPACE, 0,
1253 (rlim64_t)0, CRED(), (ssize_t *)0))
1254 goto bad;
1255 /*
1256 * Now set protections.
1257 */
1258 if (prot != PROT_ZFOD) {
1259 (void) as_setprot(p->p_as, (caddr_t)addr,
1260 len, prot);
1261 }
1262 }
1263 }
1264
1265 if (zfodlen) {
1266 struct as *as = curproc->p_as;
1267 struct seg *seg;
1268 uint_t zprot = 0;
1269
1270 end = (size_t)addr + len;
1271 zfodbase = (caddr_t)roundup(end, PAGESIZE);
1272 zfoddiff = (uintptr_t)zfodbase - end;
1273 if (zfoddiff) {
1274 /*
1275 * Before we go to zero the remaining space on the last
1276 * page, make sure we have write permission.
1277 *
1278 * Normal illumos binaries don't even hit the case
1279 * where we have to change permission on the last page
1280 * since their protection is typically either
1281 * PROT_USER | PROT_WRITE | PROT_READ
1282 * or
1283 * PROT_ZFOD (same as PROT_ALL).
1284 *
1285 * We need to be careful how we zero-fill the last page
1286 * if the segment protection does not include
1287 * PROT_WRITE. Using as_setprot() can cause the VM
1288 * segment code to call segvn_vpage(), which must
1289 * allocate a page struct for each page in the segment.
1290 * If we have a very large segment, this may fail, so
1291 * we have to check for that, even though we ignore
1292 * other return values from as_setprot.
1293 */
1294
1295 AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
1296 seg = as_segat(curproc->p_as, (caddr_t)end);
1297 if (seg != NULL)
1298 SEGOP_GETPROT(seg, (caddr_t)end, zfoddiff - 1,
1299 &zprot);
1300 AS_LOCK_EXIT(as, &as->a_lock);
1301
1302 if (seg != NULL && (zprot & PROT_WRITE) == 0) {
1303 if (as_setprot(as, (caddr_t)end, zfoddiff - 1,
1304 zprot | PROT_WRITE) == ENOMEM) {
1305 error = ENOMEM;
1306 goto bad;
1307 }
1308 }
1309
1310 if (on_fault(&ljb)) {
1311 no_fault();
1312 if (seg != NULL && (zprot & PROT_WRITE) == 0)
1313 (void) as_setprot(as, (caddr_t)end,
1314 zfoddiff - 1, zprot);
1315 error = EFAULT;
1316 goto bad;
1317 }
1318 uzero((void *)end, zfoddiff);
1319 no_fault();
1320 if (seg != NULL && (zprot & PROT_WRITE) == 0)
1321 (void) as_setprot(as, (caddr_t)end,
1322 zfoddiff - 1, zprot);
1323 }
1324 if (zfodlen > zfoddiff) {
1325 struct segvn_crargs crargs =
1326 SEGVN_ZFOD_ARGS(PROT_ZFOD, PROT_ALL);
1327
1328 zfodlen -= zfoddiff;
1329 if (valid_usr_range(zfodbase, zfodlen, prot, p->p_as,
1330 p->p_as->a_userlimit) != RANGE_OKAY) {
1331 error = ENOMEM;
1332 goto bad;
1333 }
1334 if (szc > 0) {
1335 /*
1336 * ASSERT alignment because the mapelfexec()
1337 * caller for the szc > 0 case extended zfod
1338 * so it's end is pgsz aligned.
1339 */
1340 size_t pgsz = page_get_pagesize(szc);
1341 ASSERT(IS_P2ALIGNED(zfodbase + zfodlen, pgsz));
1342
1343 if (IS_P2ALIGNED(zfodbase, pgsz)) {
1344 crargs.szc = szc;
1345 } else {
1346 crargs.szc = AS_MAP_HEAP;
1347 }
1348 } else {
1349 crargs.szc = AS_MAP_NO_LPOOB;
1350 }
1351 if (error = as_map(p->p_as, (caddr_t)zfodbase,
1352 zfodlen, segvn_create, &crargs))
1353 goto bad;
1354 if (prot != PROT_ZFOD) {
1355 (void) as_setprot(p->p_as, (caddr_t)zfodbase,
1356 zfodlen, prot);
1357 }
1358 }
1359 }
1360 return (0);
1361 bad:
1362 return (error);
1363 }
1364
1365 void
1366 setexecenv(struct execenv *ep)
1367 {
1368 proc_t *p = ttoproc(curthread);
1369 klwp_t *lwp = ttolwp(curthread);
1370 struct vnode *vp;
1371
1372 p->p_bssbase = ep->ex_bssbase;
1373 p->p_brkbase = ep->ex_brkbase;
1374 p->p_brksize = ep->ex_brksize;
1375 if (p->p_exec)
1376 VN_RELE(p->p_exec); /* out with the old */
1377 vp = p->p_exec = ep->ex_vp;
1378 if (vp != NULL)
1379 VN_HOLD(vp); /* in with the new */
1380
1381 lwp->lwp_sigaltstack.ss_sp = 0;
1382 lwp->lwp_sigaltstack.ss_size = 0;
1383 lwp->lwp_sigaltstack.ss_flags = SS_DISABLE;
1384 }
1385
1386 int
1387 execopen(struct vnode **vpp, int *fdp)
1388 {
1389 struct vnode *vp = *vpp;
1390 file_t *fp;
1391 int error = 0;
1392 int filemode = FREAD;
1393
1394 VN_HOLD(vp); /* open reference */
1395 if (error = falloc(NULL, filemode, &fp, fdp)) {
1396 VN_RELE(vp);
1397 *fdp = -1; /* just in case falloc changed value */
1398 return (error);
1399 }
1400 if (error = VOP_OPEN(&vp, filemode, CRED(), NULL)) {
1401 VN_RELE(vp);
1402 setf(*fdp, NULL);
1403 unfalloc(fp);
1404 *fdp = -1;
1405 return (error);
1406 }
1407 *vpp = vp; /* vnode should not have changed */
1408 fp->f_vnode = vp;
1409 mutex_exit(&fp->f_tlock);
1410 setf(*fdp, fp);
1411 return (0);
1412 }
1413
1414 int
1415 execclose(int fd)
1416 {
1417 return (closeandsetf(fd, NULL));
1418 }
1419
1420
1421 /*
1422 * noexec stub function.
1423 */
1424 /*ARGSUSED*/
1425 int
1426 noexec(
1427 struct vnode *vp,
1428 struct execa *uap,
1429 struct uarg *args,
1430 struct intpdata *idatap,
1431 int level,
1432 long *execsz,
1433 int setid,
1434 caddr_t exec_file,
1435 struct cred *cred)
1436 {
1437 cmn_err(CE_WARN, "missing exec capability for %s", uap->fname);
1438 return (ENOEXEC);
1439 }
1440
1441 /*
1442 * Support routines for building a user stack.
1443 *
1444 * execve(path, argv, envp) must construct a new stack with the specified
1445 * arguments and environment variables (see exec_args() for a description
1446 * of the user stack layout). To do this, we copy the arguments and
1447 * environment variables from the old user address space into the kernel,
1448 * free the old as, create the new as, and copy our buffered information
1449 * to the new stack. Our kernel buffer has the following structure:
1450 *
1451 * +-----------------------+ <--- stk_base + stk_size
1452 * | string offsets |
1453 * +-----------------------+ <--- stk_offp
1454 * | |
1455 * | STK_AVAIL() space |
1456 * | |
1457 * +-----------------------+ <--- stk_strp
1458 * | strings |
1459 * +-----------------------+ <--- stk_base
1460 *
1461 * When we add a string, we store the string's contents (including the null
1462 * terminator) at stk_strp, and we store the offset of the string relative to
1463 * stk_base at --stk_offp. At strings are added, stk_strp increases and
1464 * stk_offp decreases. The amount of space remaining, STK_AVAIL(), is just
1465 * the difference between these pointers. If we run out of space, we return
1466 * an error and exec_args() starts all over again with a buffer twice as large.
1467 * When we're all done, the kernel buffer looks like this:
1468 *
1469 * +-----------------------+ <--- stk_base + stk_size
1470 * | argv[0] offset |
1471 * +-----------------------+
1472 * | ... |
1473 * +-----------------------+
1474 * | argv[argc-1] offset |
1475 * +-----------------------+
1476 * | envp[0] offset |
1477 * +-----------------------+
1478 * | ... |
1479 * +-----------------------+
1480 * | envp[envc-1] offset |
1481 * +-----------------------+
1482 * | AT_SUN_PLATFORM offset|
1483 * +-----------------------+
1484 * | AT_SUN_EXECNAME offset|
1485 * +-----------------------+ <--- stk_offp
1486 * | |
1487 * | STK_AVAIL() space |
1488 * | |
1489 * +-----------------------+ <--- stk_strp
1490 * | AT_SUN_EXECNAME offset|
1491 * +-----------------------+
1492 * | AT_SUN_PLATFORM offset|
1493 * +-----------------------+
1494 * | envp[envc-1] string |
1495 * +-----------------------+
1496 * | ... |
1497 * +-----------------------+
1498 * | envp[0] string |
1499 * +-----------------------+
1500 * | argv[argc-1] string |
1501 * +-----------------------+
1502 * | ... |
1503 * +-----------------------+
1504 * | argv[0] string |
1505 * +-----------------------+ <--- stk_base
1506 */
1507
1508 #define STK_AVAIL(args) ((char *)(args)->stk_offp - (args)->stk_strp)
1509
1510 /*
1511 * Add a string to the stack.
1512 */
1513 static int
1514 stk_add(uarg_t *args, const char *sp, enum uio_seg segflg)
1515 {
1516 int error;
1517 size_t len;
1518
1519 if (STK_AVAIL(args) < sizeof (int))
1520 return (E2BIG);
1521 *--args->stk_offp = args->stk_strp - args->stk_base;
1522
1523 if (segflg == UIO_USERSPACE) {
1524 error = copyinstr(sp, args->stk_strp, STK_AVAIL(args), &len);
1525 if (error != 0)
1526 return (error);
1527 } else {
1528 len = strlen(sp) + 1;
1529 if (len > STK_AVAIL(args))
1530 return (E2BIG);
1531 bcopy(sp, args->stk_strp, len);
1532 }
1533
1534 args->stk_strp += len;
1535
1536 return (0);
1537 }
1538
1539 static int
1540 stk_getptr(uarg_t *args, char *src, char **dst)
1541 {
1542 int error;
1543
1544 if (args->from_model == DATAMODEL_NATIVE) {
1545 ulong_t ptr;
1546 error = fulword(src, &ptr);
1547 *dst = (caddr_t)ptr;
1548 } else {
1549 uint32_t ptr;
1550 error = fuword32(src, &ptr);
1551 *dst = (caddr_t)(uintptr_t)ptr;
1552 }
1553 return (error);
1554 }
1555
1556 static int
1557 stk_putptr(uarg_t *args, char *addr, char *value)
1558 {
1559 if (args->to_model == DATAMODEL_NATIVE)
1560 return (sulword(addr, (ulong_t)value));
1561 else
1562 return (suword32(addr, (uint32_t)(uintptr_t)value));
1563 }
1564
1565 static int
1566 stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
1567 {
1568 char *sp;
1569 int argc, error;
1570 int argv_empty = 0;
1571 size_t ptrsize = args->from_ptrsize;
1572 size_t size, pad;
1573 char *argv = (char *)uap->argp;
1574 char *envp = (char *)uap->envp;
1575
1576 /*
1577 * Copy interpreter's name and argument to argv[0] and argv[1].
1578 */
1579 if (intp != NULL && intp->intp_name != NULL) {
1580 if ((error = stk_add(args, intp->intp_name, UIO_SYSSPACE)) != 0)
1581 return (error);
1582 if (intp->intp_arg != NULL &&
1583 (error = stk_add(args, intp->intp_arg, UIO_SYSSPACE)) != 0)
1584 return (error);
1585 if (args->fname != NULL)
1586 error = stk_add(args, args->fname, UIO_SYSSPACE);
1587 else
1588 error = stk_add(args, uap->fname, UIO_USERSPACE);
1589 if (error)
1590 return (error);
1591
1592 /*
1593 * Check for an empty argv[].
1594 */
1595 if (stk_getptr(args, argv, &sp))
1596 return (EFAULT);
1597 if (sp == NULL)
1598 argv_empty = 1;
1599
1600 argv += ptrsize; /* ignore original argv[0] */
1601 }
1602
1603 if (argv_empty == 0) {
1604 /*
1605 * Add argv[] strings to the stack.
1606 */
1607 for (;;) {
1608 if (stk_getptr(args, argv, &sp))
1609 return (EFAULT);
1610 if (sp == NULL)
1611 break;
1612 if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0)
1613 return (error);
1614 argv += ptrsize;
1615 }
1616 }
1617 argc = (int *)(args->stk_base + args->stk_size) - args->stk_offp;
1618 args->arglen = args->stk_strp - args->stk_base;
1619
1620 /*
1621 * Add environ[] strings to the stack.
1622 */
1623 if (envp != NULL) {
1624 for (;;) {
1625 char *tmp = args->stk_strp;
1626 if (stk_getptr(args, envp, &sp))
1627 return (EFAULT);
1628 if (sp == NULL)
1629 break;
1630 if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0)
1631 return (error);
1632 if (args->scrubenv && strncmp(tmp, "LD_", 3) == 0) {
1633 /* Undo the copied string */
1634 args->stk_strp = tmp;
1635 *(args->stk_offp++) = NULL;
1636 }
1637 envp += ptrsize;
1638 }
1639 }
1640 args->na = (int *)(args->stk_base + args->stk_size) - args->stk_offp;
1641 args->ne = args->na - argc;
1642
1643 /*
1644 * Add AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME, and
1645 * AT_SUN_EMULATOR strings to the stack.
1646 */
1647 if (auxvpp != NULL && *auxvpp != NULL) {
1648 if ((error = stk_add(args, platform, UIO_SYSSPACE)) != 0)
1649 return (error);
1650 if ((error = stk_add(args, args->pathname, UIO_SYSSPACE)) != 0)
1651 return (error);
1652 if (args->brandname != NULL &&
1653 (error = stk_add(args, args->brandname, UIO_SYSSPACE)) != 0)
1654 return (error);
1655 if (args->emulator != NULL &&
1656 (error = stk_add(args, args->emulator, UIO_SYSSPACE)) != 0)
1657 return (error);
1658 }
1659
1660 /*
1661 * Compute the size of the stack. This includes all the pointers,
1662 * the space reserved for the aux vector, and all the strings.
1663 * The total number of pointers is args->na (which is argc + envc)
1664 * plus 4 more: (1) a pointer's worth of space for argc; (2) the NULL
1665 * after the last argument (i.e. argv[argc]); (3) the NULL after the
1666 * last environment variable (i.e. envp[envc]); and (4) the NULL after
1667 * all the strings, at the very top of the stack.
1668 */
1669 size = (args->na + 4) * args->to_ptrsize + args->auxsize +
1670 (args->stk_strp - args->stk_base);
1671
1672 /*
1673 * Pad the string section with zeroes to align the stack size.
1674 */
1675 pad = P2NPHASE(size, args->stk_align);
1676
1677 if (STK_AVAIL(args) < pad)
1678 return (E2BIG);
1679
1680 args->usrstack_size = size + pad;
1681
1682 while (pad-- != 0)
1683 *args->stk_strp++ = 0;
1684
1685 args->nc = args->stk_strp - args->stk_base;
1686
1687 return (0);
1688 }
1689
1690 static int
1691 stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up)
1692 {
1693 size_t ptrsize = args->to_ptrsize;
1694 ssize_t pslen;
1695 char *kstrp = args->stk_base;
1696 char *ustrp = usrstack - args->nc - ptrsize;
1697 char *usp = usrstack - args->usrstack_size;
1698 int *offp = (int *)(args->stk_base + args->stk_size);
1699 int envc = args->ne;
1700 int argc = args->na - envc;
1701 int i;
1702
1703 /*
1704 * Record argc for /proc.
1705 */
1706 up->u_argc = argc;
1707
1708 /*
1709 * Put argc on the stack. Note that even though it's an int,
1710 * it always consumes ptrsize bytes (for alignment).
1711 */
1712 if (stk_putptr(args, usp, (char *)(uintptr_t)argc))
1713 return (-1);
1714
1715 /*
1716 * Add argc space (ptrsize) to usp and record argv for /proc.
1717 */
1718 up->u_argv = (uintptr_t)(usp += ptrsize);
1719
1720 /*
1721 * Put the argv[] pointers on the stack.
1722 */
1723 for (i = 0; i < argc; i++, usp += ptrsize)
1724 if (stk_putptr(args, usp, &ustrp[*--offp]))
1725 return (-1);
1726
1727 /*
1728 * Copy arguments to u_psargs.
1729 */
1730 pslen = MIN(args->arglen, PSARGSZ) - 1;
1731 for (i = 0; i < pslen; i++)
1732 up->u_psargs[i] = (kstrp[i] == '\0' ? ' ' : kstrp[i]);
1733 while (i < PSARGSZ)
1734 up->u_psargs[i++] = '\0';
1735
1736 /*
1737 * Add space for argv[]'s NULL terminator (ptrsize) to usp and
1738 * record envp for /proc.
1739 */
1740 up->u_envp = (uintptr_t)(usp += ptrsize);
1741
1742 /*
1743 * Put the envp[] pointers on the stack.
1744 */
1745 for (i = 0; i < envc; i++, usp += ptrsize)
1746 if (stk_putptr(args, usp, &ustrp[*--offp]))
1747 return (-1);
1748
1749 /*
1750 * Add space for envp[]'s NULL terminator (ptrsize) to usp and
1751 * remember where the stack ends, which is also where auxv begins.
1752 */
1753 args->stackend = usp += ptrsize;
1754
1755 /*
1756 * Put all the argv[], envp[], and auxv strings on the stack.
1757 */
1758 if (copyout(args->stk_base, ustrp, args->nc))
1759 return (-1);
1760
1761 /*
1762 * Fill in the aux vector now that we know the user stack addresses
1763 * for the AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME and
1764 * AT_SUN_EMULATOR strings.
1765 */
1766 if (auxvpp != NULL && *auxvpp != NULL) {
1767 if (args->to_model == DATAMODEL_NATIVE) {
1768 auxv_t **a = (auxv_t **)auxvpp;
1769 ADDAUX(*a, AT_SUN_PLATFORM, (long)&ustrp[*--offp])
1770 ADDAUX(*a, AT_SUN_EXECNAME, (long)&ustrp[*--offp])
1771 if (args->brandname != NULL)
1772 ADDAUX(*a,
1773 AT_SUN_BRANDNAME, (long)&ustrp[*--offp])
1774 if (args->emulator != NULL)
1775 ADDAUX(*a,
1776 AT_SUN_EMULATOR, (long)&ustrp[*--offp])
1777 } else {
1778 auxv32_t **a = (auxv32_t **)auxvpp;
1779 ADDAUX(*a,
1780 AT_SUN_PLATFORM, (int)(uintptr_t)&ustrp[*--offp])
1781 ADDAUX(*a,
1782 AT_SUN_EXECNAME, (int)(uintptr_t)&ustrp[*--offp])
1783 if (args->brandname != NULL)
1784 ADDAUX(*a, AT_SUN_BRANDNAME,
1785 (int)(uintptr_t)&ustrp[*--offp])
1786 if (args->emulator != NULL)
1787 ADDAUX(*a, AT_SUN_EMULATOR,
1788 (int)(uintptr_t)&ustrp[*--offp])
1789 }
1790 }
1791
1792 return (0);
1793 }
1794
1795 /*
1796 * Though the actual stack base is constant, slew the %sp by a random aligned
1797 * amount in [0,aslr_max_stack_skew). Mostly, this makes life slightly more
1798 * complicated for buffer overflows hoping to overwrite the return address.
1799 *
1800 * On some platforms this helps avoid cache thrashing when identical processes
1801 * simultaneously share caches that don't provide enough associativity
1802 * (e.g. sun4v systems). In this case stack slewing makes the same hot stack
1803 * variables in different processes live in different cache sets increasing
1804 * effective associativity.
1805 */
1806 size_t
1807 exec_get_spslew(void)
1808 {
1809 #ifdef sun4v
1810 static uint_t sp_color_stride = 16;
1811 static uint_t sp_color_mask = 0x1f;
1812 static uint_t sp_current_color = (uint_t)-1;
1813 #endif
1814 size_t off;
1815
1816 ASSERT(ISP2(aslr_max_stack_skew));
1817
1818 if ((aslr_max_stack_skew == 0) ||
1819 !secflag_enabled(curproc, PROC_SEC_ASLR)) {
1820 #ifdef sun4v
1821 uint_t spcolor = atomic_inc_32_nv(&sp_current_color);
1822 return ((size_t)((spcolor & sp_color_mask) * SA(sp_color_stride)));
1823 #else
1824 return (0);
1825 #endif
1826 }
1827
1828 (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
1829 return SA(P2PHASE(off, aslr_max_stack_skew));
1830 }
1831
1832 /*
1833 * Initialize a new user stack with the specified arguments and environment.
1834 * The initial user stack layout is as follows:
1835 *
1836 * User Stack
1837 * +---------------+ <--- curproc->p_usrstack
1838 * | |
1839 * | slew |
1840 * | |
1841 * +---------------+
1842 * | NULL |
1843 * +---------------+
1844 * | |
1845 * | auxv strings |
1846 * | |
1847 * +---------------+
1848 * | |
1849 * | envp strings |
1850 * | |
1851 * +---------------+
1852 * | |
1853 * | argv strings |
1854 * | |
1855 * +---------------+ <--- ustrp
1856 * | |
1857 * | aux vector |
1858 * | |
1859 * +---------------+ <--- auxv
1860 * | NULL |
1861 * +---------------+
1862 * | envp[envc-1] |
1863 * +---------------+
1864 * | ... |
1865 * +---------------+
1866 * | envp[0] |
1867 * +---------------+ <--- envp[]
1868 * | NULL |
1869 * +---------------+
1870 * | argv[argc-1] |
1871 * +---------------+
1872 * | ... |
1873 * +---------------+
1874 * | argv[0] |
1875 * +---------------+ <--- argv[]
1876 * | argc |
1877 * +---------------+ <--- stack base
1878 */
1879 int
1880 exec_args(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
1881 {
1882 size_t size;
1883 int error;
1884 proc_t *p = ttoproc(curthread);
1885 user_t *up = PTOU(p);
1886 char *usrstack;
1887 rctl_entity_p_t e;
1888 struct as *as;
1889 extern int use_stk_lpg;
1890 size_t sp_slew;
1891
1892 args->from_model = p->p_model;
1893 if (p->p_model == DATAMODEL_NATIVE) {
1894 args->from_ptrsize = sizeof (long);
1895 } else {
1896 args->from_ptrsize = sizeof (int32_t);
1897 }
1898
1899 if (args->to_model == DATAMODEL_NATIVE) {
1900 args->to_ptrsize = sizeof (long);
1901 args->ncargs = NCARGS;
1902 args->stk_align = STACK_ALIGN;
1903 if (args->addr32)
1904 usrstack = (char *)USRSTACK64_32;
1905 else
1906 usrstack = (char *)USRSTACK;
1907 } else {
1908 args->to_ptrsize = sizeof (int32_t);
1909 args->ncargs = NCARGS32;
1910 args->stk_align = STACK_ALIGN32;
1911 usrstack = (char *)USRSTACK32;
1912 }
1913
1914 ASSERT(P2PHASE((uintptr_t)usrstack, args->stk_align) == 0);
1915
1916 #if defined(__sparc)
1917 /*
1918 * Make sure user register windows are empty before
1919 * attempting to make a new stack.
1920 */
1921 (void) flush_user_windows_to_stack(NULL);
1922 #endif
1923
1924 for (size = PAGESIZE; ; size *= 2) {
1925 args->stk_size = size;
1926 args->stk_base = kmem_alloc(size, KM_SLEEP);
1927 args->stk_strp = args->stk_base;
1928 args->stk_offp = (int *)(args->stk_base + size);
1929 error = stk_copyin(uap, args, intp, auxvpp);
1930 if (error == 0)
1931 break;
1932 kmem_free(args->stk_base, size);
1933 if (error != E2BIG && error != ENAMETOOLONG)
1934 return (error);
1935 if (size >= args->ncargs)
1936 return (E2BIG);
1937 }
1938
1939 size = args->usrstack_size;
1940
1941 ASSERT(error == 0);
1942 ASSERT(P2PHASE(size, args->stk_align) == 0);
1943 ASSERT((ssize_t)STK_AVAIL(args) >= 0);
1944
1945 if (size > args->ncargs) {
1946 kmem_free(args->stk_base, args->stk_size);
1947 return (E2BIG);
1948 }
1949
1950 /*
1951 * Leave only the current lwp and force the other lwps to exit.
1952 * If another lwp beat us to the punch by calling exit(), bail out.
1953 */
1954 if ((error = exitlwps(0)) != 0) {
1955 kmem_free(args->stk_base, args->stk_size);
1956 return (error);
1957 }
1958
1959 /*
1960 * Revoke any doors created by the process.
1961 */
1962 if (p->p_door_list)
1963 door_exit();
1964
1965 /*
1966 * Release schedctl data structures.
1967 */
1968 if (p->p_pagep)
1969 schedctl_proc_cleanup();
1970
1971 /*
1972 * Clean up any DTrace helpers for the process.
1973 */
1974 if (p->p_dtrace_helpers != NULL) {
1975 ASSERT(dtrace_helpers_cleanup != NULL);
1976 (*dtrace_helpers_cleanup)();
1977 }
1978
1979 mutex_enter(&p->p_lock);
1980 /*
1981 * Cleanup the DTrace provider associated with this process.
1982 */
1983 if (p->p_dtrace_probes) {
1984 ASSERT(dtrace_fasttrap_exec_ptr != NULL);
1985 dtrace_fasttrap_exec_ptr(p);
1986 }
1987 mutex_exit(&p->p_lock);
1988
1989 /*
1990 * discard the lwpchan cache.
1991 */
1992 if (p->p_lcp != NULL)
1993 lwpchan_destroy_cache(1);
1994
1995 /*
1996 * Delete the POSIX timers.
1997 */
1998 if (p->p_itimer != NULL)
1999 timer_exit();
2000
2001 /*
2002 * Delete the ITIMER_REALPROF interval timer.
2003 * The other ITIMER_* interval timers are specified
2004 * to be inherited across exec().
2005 */
2006 delete_itimer_realprof();
2007
2008 if (AU_AUDITING())
2009 audit_exec(args->stk_base, args->stk_base + args->arglen,
2010 args->na - args->ne, args->ne, args->pfcred);
2011
2012 /*
2013 * Ensure that we don't change resource associations while we
2014 * change address spaces.
2015 */
2016 mutex_enter(&p->p_lock);
2017 pool_barrier_enter();
2018 mutex_exit(&p->p_lock);
2019
2020 /*
2021 * Destroy the old address space and create a new one.
2022 * From here on, any errors are fatal to the exec()ing process.
2023 * On error we return -1, which means the caller must SIGKILL
2024 * the process.
2025 */
2026 relvm();
2027
2028 mutex_enter(&p->p_lock);
2029 pool_barrier_exit();
2030 mutex_exit(&p->p_lock);
2031
2032 up->u_execsw = args->execswp;
2033
2034 p->p_brkbase = NULL;
2035 p->p_brksize = 0;
2036 p->p_brkpageszc = 0;
2037 p->p_stksize = 0;
2038 p->p_stkpageszc = 0;
2039 p->p_model = args->to_model;
2040 p->p_usrstack = usrstack;
2041 p->p_stkprot = args->stk_prot;
2042 p->p_datprot = args->dat_prot;
2043
2044 /*
2045 * Reset resource controls such that all controls are again active as
2046 * well as appropriate to the potentially new address model for the
2047 * process.
2048 */
2049 e.rcep_p.proc = p;
2050 e.rcep_t = RCENTITY_PROCESS;
2051 rctl_set_reset(p->p_rctls, p, &e);
2052
2053 /* Too early to call map_pgsz for the heap */
2054 if (use_stk_lpg) {
2055 p->p_stkpageszc = page_szc(map_pgsz(MAPPGSZ_STK, p, 0, 0, 0));
2056 }
2057
2058 mutex_enter(&p->p_lock);
2059 p->p_flag |= SAUTOLPG; /* kernel controls page sizes */
2060 mutex_exit(&p->p_lock);
2061
2062 sp_slew = exec_get_spslew();
2063 ASSERT(P2PHASE(sp_slew, args->stk_align) == 0);
2064 /* Be certain we don't underflow */
2065 VERIFY((curproc->p_usrstack - (size + sp_slew)) < curproc->p_usrstack);
2066 exec_set_sp(size + sp_slew);
2067
2068 as = as_alloc();
2069 p->p_as = as;
2070 as->a_proc = p;
2071 if (p->p_model == DATAMODEL_ILP32 || args->addr32)
2072 as->a_userlimit = (caddr_t)USERLIMIT32;
2073 (void) hat_setup(as->a_hat, HAT_ALLOC);
2074 hat_join_srd(as->a_hat, args->ex_vp);
2075
2076 /*
2077 * Finally, write out the contents of the new stack.
2078 */
2079 error = stk_copyout(args, usrstack - sp_slew, auxvpp, up);
2080 kmem_free(args->stk_base, args->stk_size);
2081 return (error);
2082 }