From patchwork Wed Jan 27 08:49:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petros Angelatos X-Patchwork-Id: 8131211 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6E64B9F818 for ; Wed, 27 Jan 2016 08:50:09 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4CF2020304 for ; Wed, 27 Jan 2016 08:50:08 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E90BF202FF for ; Wed, 27 Jan 2016 08:50:06 +0000 (UTC) Received: from localhost ([::1]:48608 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aOLni-0006Br-4v for patchwork-qemu-devel@patchwork.kernel.org; Wed, 27 Jan 2016 03:50:06 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38343) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aOLna-0006BX-GU for qemu-devel@nongnu.org; Wed, 27 Jan 2016 03:49:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aOLnZ-0002re-1T for qemu-devel@nongnu.org; Wed, 27 Jan 2016 03:49:58 -0500 Received: from mail-pf0-x229.google.com ([2607:f8b0:400e:c00::229]:33761) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aOLnY-0002rW-Ku for qemu-devel@nongnu.org; Wed, 27 Jan 2016 03:49:56 -0500 Received: by mail-pf0-x229.google.com with SMTP id x125so1510668pfb.0 for ; Wed, 27 Jan 2016 00:49:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=resin.io; s=googledkim; h=from:to:cc:subject:date:message-id; bh=o1krYtYx4OdHgWiBdueykQ4Oqjp45RC9H/2mtkrRDOU=; b=UIRwBURNx8LSqJU7lxrrxzjO/Lq8EWoOLcPyJtXL+WRfbsbUqyUUUEpFhDSGcbnEve sPd721GnHapX5mXIUV4kG7O9Ijaxp5KhoW2sTs2aYKH5NNcBFpCvFTvzkR8LQ7Q+NQTy 3LIbiJWfHSWuc5XmhXtZxxsvUjhaLuFhXEfzY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=o1krYtYx4OdHgWiBdueykQ4Oqjp45RC9H/2mtkrRDOU=; b=FVV7Es/++WH1nMwjonOPGr7uSKc52DE7AWiv/kqmiYBejeTOVlHZd9vE/zbvjiGiQ/ 6foPJ9L3HIOZHtqHFb4jR1CIfs0bAF8RFAkSMiAT9d50T+D055n4pxA3Joq3zviWscos xmR2zGIa8NsAZX1C7xqFR0RrJYmuZ2pgz/KI1jmBe22WSTg+hNTV2V+lq5hu6wBM3+PW kCcTmsFWPZBfKTo24+mO8D3zoHIVZ0zAR7Mpd7UQAfveaCG8X18O30r5G7+gOoyS3LLE Gg8FF+gNrz7umbq6x/K4uFaU/3F63RiyPITDAgWfqkfy0rYpS2ZNQF+pWwdyDxrvs035 ylzw== X-Gm-Message-State: AG10YOSgfJPI6UE/dvyLHZ0jSTby4NADrWMR+Bpwaxcr2ItDW9voNCyQavBcotFLnKaFUw== X-Received: by 10.98.13.195 with SMTP id 64mr40668736pfn.164.1453884595297; Wed, 27 Jan 2016 00:49:55 -0800 (PST) Received: from rachmaninoff.localdomain ([2605:9080:1103:3004:d6be:d9ff:fe6e:b7de]) by smtp.googlemail.com with ESMTPSA id lq10sm7131127pab.36.2016.01.27.00.49.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 27 Jan 2016 00:49:54 -0800 (PST) From: Petros Angelatos X-Google-Original-From: Petros Angelatos To: qemu-devel@nongnu.org Date: Wed, 27 Jan 2016 00:49:33 -0800 Message-Id: <1453884573-12864-1-git-send-email-petrosagg@gmail.com> X-Mailer: git-send-email 2.7.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2607:f8b0:400e:c00::229 Cc: lucas.kaldstrom@hotmail.co.uk, peter.maydell@linaro.org, riku.voipio@iki.fi, laurent@vivier.eu, Petros Angelatos Subject: [Qemu-devel] [PATCH v2] linux-user: add option to intercept execve() syscalls X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Petros Angelatos In order for one to use QEMU user mode emulation under a chroot, it is required to use binfmt_misc. This can be avoided by QEMU never doing a raw execve() to the host system. Introduce a new option, -execve, that uses the current QEMU interpreter to intercept execve(). qemu_execve() will prepend the interpreter path , similar to what binfmt_misc would do, and then pass the modified execve() to the host. It is necessary to parse hashbang scripts in that function otherwise the kernel will try to run the interpreter of a script without QEMU and get an invalid exec format error. Signed-off-by: Petros Angelatos Tested-by: Laurent Vivier Reviewed-by: Laurent Vivier --- linux-user/main.c | 36 ++++++++++++++++ linux-user/qemu.h | 1 + linux-user/syscall.c | 117 ++++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 153 insertions(+), 1 deletion(-) diff --git a/linux-user/main.c b/linux-user/main.c index ee12035..751eafa 100644 --- a/linux-user/main.c +++ b/linux-user/main.c @@ -22,6 +22,7 @@ #include #include #include +#include #include #include #include @@ -79,6 +80,7 @@ static void usage(int exitcode); static const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX; const char *qemu_uname_release; +const char *qemu_execve_path; /* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so we allocate a bigger stack. Need a better solution, for example @@ -3828,6 +3830,38 @@ static void handle_arg_guest_base(const char *arg) have_guest_base = 1; } +static void handle_arg_execve(const char *arg) +{ + const char *execfn; + char buf[PATH_MAX]; + char *ret; + int len; + + /* try getauxval() */ + execfn = (const char *) getauxval(AT_EXECFN); + + if (execfn != 0) { + ret = realpath(execfn, buf); + + if (ret != NULL) { + qemu_execve_path = strdup(buf); + return; + } + } + + /* try /proc/self/exe */ + len = readlink("/proc/self/exe", buf, sizeof(buf) - 1); + + if (len != -1) { + buf[len] = '\0'; + qemu_execve_path = strdup(buf); + return; + } + + fprintf(stderr, "qemu_execve: unable to determine intepreter's path\n"); + exit(EXIT_FAILURE); +} + static void handle_arg_reserved_va(const char *arg) { char *p; @@ -3913,6 +3947,8 @@ static const struct qemu_argument arg_table[] = { "uname", "set qemu uname release string to 'uname'"}, {"B", "QEMU_GUEST_BASE", true, handle_arg_guest_base, "address", "set guest_base address to 'address'"}, + {"execve", "QEMU_EXECVE", false, handle_arg_execve, + "", "use this interpreter when a process calls execve()"}, {"R", "QEMU_RESERVED_VA", true, handle_arg_reserved_va, "size", "reserve 'size' bytes for guest virtual address space"}, {"d", "QEMU_LOG", true, handle_arg_log, diff --git a/linux-user/qemu.h b/linux-user/qemu.h index bd90cc3..0d9b058 100644 --- a/linux-user/qemu.h +++ b/linux-user/qemu.h @@ -140,6 +140,7 @@ void init_task_state(TaskState *ts); void task_settid(TaskState *); void stop_all_tasks(void); extern const char *qemu_uname_release; +extern const char *qemu_execve_path; extern unsigned long mmap_min_addr; /* ??? See if we can avoid exposing so much of the loader internals. */ diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 0cbace4..4755978 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -111,6 +111,7 @@ int __clone2(int (*fn)(void *), void *child_stack_base, #include #include #include +#include #include "linux_loop.h" #include "uname.h" @@ -5854,6 +5855,118 @@ static target_timer_t get_timer_id(abi_long arg) return timerid; } +/* qemu_execve() Must return target values and target errnos. */ +static abi_long qemu_execve(char *filename, char *argv[], + char *envp[]) +{ + char *i_arg = NULL, *i_name = NULL; + char **new_argp; + int argc, fd, ret, i, offset = 3; + char *cp; + char buf[BINPRM_BUF_SIZE]; + + /* normal execve case */ + if (qemu_execve_path == NULL || *qemu_execve_path == 0) { + return get_errno(execve(filename, argv, envp)); + } + + for (argc = 0; argv[argc] != NULL; argc++) { + /* nothing */ ; + } + + fd = open(filename, O_RDONLY); + if (fd == -1) { + return get_errno(fd); + } + + ret = read(fd, buf, BINPRM_BUF_SIZE); + if (ret == -1) { + close(fd); + return get_errno(ret); + } + + /* if we have less than 2 bytes, we can guess it is not executable */ + if (ret < 2) { + close(fd); + return -host_to_target_errno(ENOEXEC); + } + + close(fd); + + /* adapted from the kernel + * https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/fs/binfmt_script.c + */ + if ((buf[0] == '#') && (buf[1] == '!')) { + /* + * This section does the #! interpretation. + * Sorta complicated, but hopefully it will work. -TYT + */ + + buf[BINPRM_BUF_SIZE - 1] = '\0'; + cp = strchr(buf, '\n'); + if (cp == NULL) { + cp = buf + BINPRM_BUF_SIZE - 1; + } + *cp = '\0'; + while (cp > buf) { + cp--; + if ((*cp == ' ') || (*cp == '\t')) { + *cp = '\0'; + } else { + break; + } + } + for (cp = buf + 2; (*cp == ' ') || (*cp == '\t'); cp++) { + /* nothing */ ; + } + if (*cp == '\0') { + return -ENOEXEC; /* No interpreter name found */ + } + i_name = cp; + i_arg = NULL; + for ( ; *cp && (*cp != ' ') && (*cp != '\t'); cp++) { + /* nothing */ ; + } + while ((*cp == ' ') || (*cp == '\t')) { + *cp++ = '\0'; + } + if (*cp) { + i_arg = cp; + } + + if (i_arg) { + offset = 5; + } else { + offset = 4; + } + } + + new_argp = alloca((argc + offset + 1) * sizeof(void *)); + + /* Copy the original arguments with offset */ + for (i = 0; i < argc; i++) { + new_argp[i + offset] = argv[i]; + } + + new_argp[0] = strdup(qemu_execve_path); + new_argp[1] = strdup("-0"); + new_argp[offset] = filename; + new_argp[argc + offset] = NULL; + + if (i_name) { + new_argp[2] = i_name; + new_argp[3] = i_name; + + if (i_arg) { + new_argp[4] = i_arg; + } + } else { + new_argp[2] = argv[0]; + } + + return get_errno(execve(qemu_execve_path, new_argp, envp)); +} + /* do_syscall() should always have a single exit point at the end so that actions, such as logging of syscall results, can be performed. All errnos that do_syscall() returns must be -TARGET_. */ @@ -6113,7 +6226,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, if (!(p = lock_user_string(arg1))) goto execve_efault; - ret = get_errno(execve(p, argp, envp)); + + ret = qemu_execve(p, argp, envp); + unlock_user(p, arg1, 0); goto execve_end;