]>
Commit | Line | Data |
---|---|---|
457c8996 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
23558693 LR |
2 | /* |
3 | * umh - the kernel usermode helper | |
4 | */ | |
5 | #include <linux/module.h> | |
6 | #include <linux/sched.h> | |
7 | #include <linux/sched/task.h> | |
8 | #include <linux/binfmts.h> | |
9 | #include <linux/syscalls.h> | |
10 | #include <linux/unistd.h> | |
11 | #include <linux/kmod.h> | |
12 | #include <linux/slab.h> | |
13 | #include <linux/completion.h> | |
14 | #include <linux/cred.h> | |
15 | #include <linux/file.h> | |
16 | #include <linux/fdtable.h> | |
17 | #include <linux/workqueue.h> | |
18 | #include <linux/security.h> | |
19 | #include <linux/mount.h> | |
20 | #include <linux/kernel.h> | |
21 | #include <linux/init.h> | |
22 | #include <linux/resource.h> | |
23 | #include <linux/notifier.h> | |
24 | #include <linux/suspend.h> | |
25 | #include <linux/rwsem.h> | |
26 | #include <linux/ptrace.h> | |
27 | #include <linux/async.h> | |
28 | #include <linux/uaccess.h> | |
29 | ||
30 | #include <trace/events/module.h> | |
31 | ||
32 | #define CAP_BSET (void *)1 | |
33 | #define CAP_PI (void *)2 | |
34 | ||
35 | static kernel_cap_t usermodehelper_bset = CAP_FULL_SET; | |
36 | static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET; | |
37 | static DEFINE_SPINLOCK(umh_sysctl_lock); | |
38 | static DECLARE_RWSEM(umhelper_sem); | |
39 | ||
40 | static void call_usermodehelper_freeinfo(struct subprocess_info *info) | |
41 | { | |
42 | if (info->cleanup) | |
43 | (*info->cleanup)(info); | |
44 | kfree(info); | |
45 | } | |
46 | ||
47 | static void umh_complete(struct subprocess_info *sub_info) | |
48 | { | |
49 | struct completion *comp = xchg(&sub_info->complete, NULL); | |
50 | /* | |
51 | * See call_usermodehelper_exec(). If xchg() returns NULL | |
52 | * we own sub_info, the UMH_KILLABLE caller has gone away | |
53 | * or the caller used UMH_NO_WAIT. | |
54 | */ | |
55 | if (comp) | |
56 | complete(comp); | |
57 | else | |
58 | call_usermodehelper_freeinfo(sub_info); | |
59 | } | |
60 | ||
61 | /* | |
62 | * This is the task which runs the usermode application | |
63 | */ | |
64 | static int call_usermodehelper_exec_async(void *data) | |
65 | { | |
66 | struct subprocess_info *sub_info = data; | |
67 | struct cred *new; | |
68 | int retval; | |
69 | ||
70 | spin_lock_irq(¤t->sighand->siglock); | |
71 | flush_signal_handlers(current, 1); | |
72 | spin_unlock_irq(¤t->sighand->siglock); | |
73 | ||
74 | /* | |
75 | * Our parent (unbound workqueue) runs with elevated scheduling | |
76 | * priority. Avoid propagating that into the userspace child. | |
77 | */ | |
78 | set_user_nice(current, 0); | |
79 | ||
80 | retval = -ENOMEM; | |
81 | new = prepare_kernel_cred(current); | |
82 | if (!new) | |
83 | goto out; | |
84 | ||
85 | spin_lock(&umh_sysctl_lock); | |
86 | new->cap_bset = cap_intersect(usermodehelper_bset, new->cap_bset); | |
87 | new->cap_inheritable = cap_intersect(usermodehelper_inheritable, | |
88 | new->cap_inheritable); | |
89 | spin_unlock(&umh_sysctl_lock); | |
90 | ||
91 | if (sub_info->init) { | |
92 | retval = sub_info->init(sub_info, new); | |
93 | if (retval) { | |
94 | abort_creds(new); | |
95 | goto out; | |
96 | } | |
97 | } | |
98 | ||
99 | commit_creds(new); | |
100 | ||
be619f7f EB |
101 | retval = kernel_execve(sub_info->path, |
102 | (const char *const *)sub_info->argv, | |
103 | (const char *const *)sub_info->envp); | |
23558693 LR |
104 | out: |
105 | sub_info->retval = retval; | |
106 | /* | |
107 | * call_usermodehelper_exec_sync() will call umh_complete | |
108 | * if UHM_WAIT_PROC. | |
109 | */ | |
110 | if (!(sub_info->wait & UMH_WAIT_PROC)) | |
111 | umh_complete(sub_info); | |
112 | if (!retval) | |
113 | return 0; | |
114 | do_exit(0); | |
115 | } | |
116 | ||
117 | /* Handles UMH_WAIT_PROC. */ | |
118 | static void call_usermodehelper_exec_sync(struct subprocess_info *sub_info) | |
119 | { | |
120 | pid_t pid; | |
121 | ||
d300b610 | 122 | /* If SIGCLD is ignored kernel_wait4 won't populate the status. */ |
23558693 LR |
123 | kernel_sigaction(SIGCHLD, SIG_DFL); |
124 | pid = kernel_thread(call_usermodehelper_exec_async, sub_info, SIGCHLD); | |
125 | if (pid < 0) { | |
126 | sub_info->retval = pid; | |
127 | } else { | |
128 | int ret = -ECHILD; | |
129 | /* | |
130 | * Normally it is bogus to call wait4() from in-kernel because | |
131 | * wait4() wants to write the exit code to a userspace address. | |
132 | * But call_usermodehelper_exec_sync() always runs as kernel | |
133 | * thread (workqueue) and put_user() to a kernel address works | |
134 | * OK for kernel threads, due to their having an mm_segment_t | |
135 | * which spans the entire address space. | |
136 | * | |
137 | * Thus the __user pointer cast is valid here. | |
138 | */ | |
d300b610 | 139 | kernel_wait4(pid, (int __user *)&ret, 0, NULL); |
23558693 LR |
140 | |
141 | /* | |
142 | * If ret is 0, either call_usermodehelper_exec_async failed and | |
143 | * the real error code is already in sub_info->retval or | |
144 | * sub_info->retval is 0 anyway, so don't mess with it then. | |
145 | */ | |
146 | if (ret) | |
147 | sub_info->retval = ret; | |
148 | } | |
149 | ||
150 | /* Restore default kernel sig handler */ | |
151 | kernel_sigaction(SIGCHLD, SIG_IGN); | |
152 | ||
153 | umh_complete(sub_info); | |
154 | } | |
155 | ||
156 | /* | |
157 | * We need to create the usermodehelper kernel thread from a task that is affine | |
158 | * to an optimized set of CPUs (or nohz housekeeping ones) such that they | |
159 | * inherit a widest affinity irrespective of call_usermodehelper() callers with | |
160 | * possibly reduced affinity (eg: per-cpu workqueues). We don't want | |
161 | * usermodehelper targets to contend a busy CPU. | |
162 | * | |
163 | * Unbound workqueues provide such wide affinity and allow to block on | |
164 | * UMH_WAIT_PROC requests without blocking pending request (up to some limit). | |
165 | * | |
166 | * Besides, workqueues provide the privilege level that caller might not have | |
167 | * to perform the usermodehelper request. | |
168 | * | |
169 | */ | |
170 | static void call_usermodehelper_exec_work(struct work_struct *work) | |
171 | { | |
172 | struct subprocess_info *sub_info = | |
173 | container_of(work, struct subprocess_info, work); | |
174 | ||
175 | if (sub_info->wait & UMH_WAIT_PROC) { | |
176 | call_usermodehelper_exec_sync(sub_info); | |
177 | } else { | |
178 | pid_t pid; | |
179 | /* | |
180 | * Use CLONE_PARENT to reparent it to kthreadd; we do not | |
181 | * want to pollute current->children, and we need a parent | |
182 | * that always ignores SIGCHLD to ensure auto-reaping. | |
183 | */ | |
184 | pid = kernel_thread(call_usermodehelper_exec_async, sub_info, | |
185 | CLONE_PARENT | SIGCHLD); | |
186 | if (pid < 0) { | |
187 | sub_info->retval = pid; | |
188 | umh_complete(sub_info); | |
189 | } | |
190 | } | |
191 | } | |
192 | ||
193 | /* | |
194 | * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY | |
195 | * (used for preventing user land processes from being created after the user | |
196 | * land has been frozen during a system-wide hibernation or suspend operation). | |
197 | * Should always be manipulated under umhelper_sem acquired for write. | |
198 | */ | |
199 | static enum umh_disable_depth usermodehelper_disabled = UMH_DISABLED; | |
200 | ||
201 | /* Number of helpers running */ | |
202 | static atomic_t running_helpers = ATOMIC_INIT(0); | |
203 | ||
204 | /* | |
205 | * Wait queue head used by usermodehelper_disable() to wait for all running | |
206 | * helpers to finish. | |
207 | */ | |
208 | static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq); | |
209 | ||
210 | /* | |
211 | * Used by usermodehelper_read_lock_wait() to wait for usermodehelper_disabled | |
212 | * to become 'false'. | |
213 | */ | |
214 | static DECLARE_WAIT_QUEUE_HEAD(usermodehelper_disabled_waitq); | |
215 | ||
216 | /* | |
217 | * Time to wait for running_helpers to become zero before the setting of | |
218 | * usermodehelper_disabled in usermodehelper_disable() fails | |
219 | */ | |
220 | #define RUNNING_HELPERS_TIMEOUT (5 * HZ) | |
221 | ||
222 | int usermodehelper_read_trylock(void) | |
223 | { | |
224 | DEFINE_WAIT(wait); | |
225 | int ret = 0; | |
226 | ||
227 | down_read(&umhelper_sem); | |
228 | for (;;) { | |
229 | prepare_to_wait(&usermodehelper_disabled_waitq, &wait, | |
230 | TASK_INTERRUPTIBLE); | |
231 | if (!usermodehelper_disabled) | |
232 | break; | |
233 | ||
234 | if (usermodehelper_disabled == UMH_DISABLED) | |
235 | ret = -EAGAIN; | |
236 | ||
237 | up_read(&umhelper_sem); | |
238 | ||
239 | if (ret) | |
240 | break; | |
241 | ||
242 | schedule(); | |
243 | try_to_freeze(); | |
244 | ||
245 | down_read(&umhelper_sem); | |
246 | } | |
247 | finish_wait(&usermodehelper_disabled_waitq, &wait); | |
248 | return ret; | |
249 | } | |
250 | EXPORT_SYMBOL_GPL(usermodehelper_read_trylock); | |
251 | ||
252 | long usermodehelper_read_lock_wait(long timeout) | |
253 | { | |
254 | DEFINE_WAIT(wait); | |
255 | ||
256 | if (timeout < 0) | |
257 | return -EINVAL; | |
258 | ||
259 | down_read(&umhelper_sem); | |
260 | for (;;) { | |
261 | prepare_to_wait(&usermodehelper_disabled_waitq, &wait, | |
262 | TASK_UNINTERRUPTIBLE); | |
263 | if (!usermodehelper_disabled) | |
264 | break; | |
265 | ||
266 | up_read(&umhelper_sem); | |
267 | ||
268 | timeout = schedule_timeout(timeout); | |
269 | if (!timeout) | |
270 | break; | |
271 | ||
272 | down_read(&umhelper_sem); | |
273 | } | |
274 | finish_wait(&usermodehelper_disabled_waitq, &wait); | |
275 | return timeout; | |
276 | } | |
277 | EXPORT_SYMBOL_GPL(usermodehelper_read_lock_wait); | |
278 | ||
279 | void usermodehelper_read_unlock(void) | |
280 | { | |
281 | up_read(&umhelper_sem); | |
282 | } | |
283 | EXPORT_SYMBOL_GPL(usermodehelper_read_unlock); | |
284 | ||
285 | /** | |
286 | * __usermodehelper_set_disable_depth - Modify usermodehelper_disabled. | |
287 | * @depth: New value to assign to usermodehelper_disabled. | |
288 | * | |
289 | * Change the value of usermodehelper_disabled (under umhelper_sem locked for | |
290 | * writing) and wakeup tasks waiting for it to change. | |
291 | */ | |
292 | void __usermodehelper_set_disable_depth(enum umh_disable_depth depth) | |
293 | { | |
294 | down_write(&umhelper_sem); | |
295 | usermodehelper_disabled = depth; | |
296 | wake_up(&usermodehelper_disabled_waitq); | |
297 | up_write(&umhelper_sem); | |
298 | } | |
299 | ||
300 | /** | |
301 | * __usermodehelper_disable - Prevent new helpers from being started. | |
302 | * @depth: New value to assign to usermodehelper_disabled. | |
303 | * | |
304 | * Set usermodehelper_disabled to @depth and wait for running helpers to exit. | |
305 | */ | |
306 | int __usermodehelper_disable(enum umh_disable_depth depth) | |
307 | { | |
308 | long retval; | |
309 | ||
310 | if (!depth) | |
311 | return -EINVAL; | |
312 | ||
313 | down_write(&umhelper_sem); | |
314 | usermodehelper_disabled = depth; | |
315 | up_write(&umhelper_sem); | |
316 | ||
317 | /* | |
318 | * From now on call_usermodehelper_exec() won't start any new | |
319 | * helpers, so it is sufficient if running_helpers turns out to | |
320 | * be zero at one point (it may be increased later, but that | |
321 | * doesn't matter). | |
322 | */ | |
323 | retval = wait_event_timeout(running_helpers_waitq, | |
324 | atomic_read(&running_helpers) == 0, | |
325 | RUNNING_HELPERS_TIMEOUT); | |
326 | if (retval) | |
327 | return 0; | |
328 | ||
329 | __usermodehelper_set_disable_depth(UMH_ENABLED); | |
330 | return -EAGAIN; | |
331 | } | |
332 | ||
333 | static void helper_lock(void) | |
334 | { | |
335 | atomic_inc(&running_helpers); | |
336 | smp_mb__after_atomic(); | |
337 | } | |
338 | ||
339 | static void helper_unlock(void) | |
340 | { | |
341 | if (atomic_dec_and_test(&running_helpers)) | |
342 | wake_up(&running_helpers_waitq); | |
343 | } | |
344 | ||
345 | /** | |
346 | * call_usermodehelper_setup - prepare to call a usermode helper | |
347 | * @path: path to usermode executable | |
348 | * @argv: arg vector for process | |
349 | * @envp: environment for process | |
350 | * @gfp_mask: gfp mask for memory allocation | |
351 | * @cleanup: a cleanup function | |
352 | * @init: an init function | |
353 | * @data: arbitrary context sensitive data | |
354 | * | |
355 | * Returns either %NULL on allocation failure, or a subprocess_info | |
356 | * structure. This should be passed to call_usermodehelper_exec to | |
357 | * exec the process and free the structure. | |
358 | * | |
359 | * The init function is used to customize the helper process prior to | |
360 | * exec. A non-zero return code causes the process to error out, exit, | |
361 | * and return the failure to the calling process | |
362 | * | |
363 | * The cleanup function is just before ethe subprocess_info is about to | |
364 | * be freed. This can be used for freeing the argv and envp. The | |
365 | * Function must be runnable in either a process context or the | |
366 | * context in which call_usermodehelper_exec is called. | |
367 | */ | |
368 | struct subprocess_info *call_usermodehelper_setup(const char *path, char **argv, | |
369 | char **envp, gfp_t gfp_mask, | |
370 | int (*init)(struct subprocess_info *info, struct cred *new), | |
371 | void (*cleanup)(struct subprocess_info *info), | |
372 | void *data) | |
373 | { | |
374 | struct subprocess_info *sub_info; | |
375 | sub_info = kzalloc(sizeof(struct subprocess_info), gfp_mask); | |
376 | if (!sub_info) | |
377 | goto out; | |
378 | ||
379 | INIT_WORK(&sub_info->work, call_usermodehelper_exec_work); | |
380 | ||
381 | #ifdef CONFIG_STATIC_USERMODEHELPER | |
382 | sub_info->path = CONFIG_STATIC_USERMODEHELPER_PATH; | |
383 | #else | |
384 | sub_info->path = path; | |
385 | #endif | |
386 | sub_info->argv = argv; | |
387 | sub_info->envp = envp; | |
388 | ||
389 | sub_info->cleanup = cleanup; | |
390 | sub_info->init = init; | |
391 | sub_info->data = data; | |
392 | out: | |
393 | return sub_info; | |
394 | } | |
395 | EXPORT_SYMBOL(call_usermodehelper_setup); | |
396 | ||
397 | /** | |
398 | * call_usermodehelper_exec - start a usermode application | |
399 | * @sub_info: information about the subprocessa | |
400 | * @wait: wait for the application to finish and return status. | |
401 | * when UMH_NO_WAIT don't wait at all, but you get no useful error back | |
402 | * when the program couldn't be exec'ed. This makes it safe to call | |
403 | * from interrupt context. | |
404 | * | |
405 | * Runs a user-space application. The application is started | |
406 | * asynchronously if wait is not set, and runs as a child of system workqueues. | |
407 | * (ie. it runs with full root capabilities and optimized affinity). | |
3740d93e LC |
408 | * |
409 | * Note: successful return value does not guarantee the helper was called at | |
410 | * all. You can't rely on sub_info->{init,cleanup} being called even for | |
411 | * UMH_WAIT_* wait modes as STATIC_USERMODEHELPER_PATH="" turns all helpers | |
412 | * into a successful no-op. | |
23558693 LR |
413 | */ |
414 | int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait) | |
415 | { | |
416 | DECLARE_COMPLETION_ONSTACK(done); | |
417 | int retval = 0; | |
418 | ||
419 | if (!sub_info->path) { | |
420 | call_usermodehelper_freeinfo(sub_info); | |
421 | return -EINVAL; | |
422 | } | |
423 | helper_lock(); | |
424 | if (usermodehelper_disabled) { | |
425 | retval = -EBUSY; | |
426 | goto out; | |
427 | } | |
428 | ||
429 | /* | |
430 | * If there is no binary for us to call, then just return and get out of | |
431 | * here. This allows us to set STATIC_USERMODEHELPER_PATH to "" and | |
432 | * disable all call_usermodehelper() calls. | |
433 | */ | |
434 | if (strlen(sub_info->path) == 0) | |
435 | goto out; | |
436 | ||
437 | /* | |
438 | * Set the completion pointer only if there is a waiter. | |
439 | * This makes it possible to use umh_complete to free | |
440 | * the data structure in case of UMH_NO_WAIT. | |
441 | */ | |
442 | sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done; | |
443 | sub_info->wait = wait; | |
444 | ||
445 | queue_work(system_unbound_wq, &sub_info->work); | |
446 | if (wait == UMH_NO_WAIT) /* task has freed sub_info */ | |
447 | goto unlock; | |
448 | ||
449 | if (wait & UMH_KILLABLE) { | |
450 | retval = wait_for_completion_killable(&done); | |
451 | if (!retval) | |
452 | goto wait_done; | |
453 | ||
454 | /* umh_complete() will see NULL and free sub_info */ | |
455 | if (xchg(&sub_info->complete, NULL)) | |
456 | goto unlock; | |
457 | /* fallthrough, umh_complete() was already called */ | |
458 | } | |
459 | ||
460 | wait_for_completion(&done); | |
461 | wait_done: | |
462 | retval = sub_info->retval; | |
463 | out: | |
464 | call_usermodehelper_freeinfo(sub_info); | |
465 | unlock: | |
466 | helper_unlock(); | |
467 | return retval; | |
468 | } | |
469 | EXPORT_SYMBOL(call_usermodehelper_exec); | |
470 | ||
471 | /** | |
472 | * call_usermodehelper() - prepare and start a usermode application | |
473 | * @path: path to usermode executable | |
474 | * @argv: arg vector for process | |
475 | * @envp: environment for process | |
476 | * @wait: wait for the application to finish and return status. | |
477 | * when UMH_NO_WAIT don't wait at all, but you get no useful error back | |
478 | * when the program couldn't be exec'ed. This makes it safe to call | |
479 | * from interrupt context. | |
480 | * | |
481 | * This function is the equivalent to use call_usermodehelper_setup() and | |
482 | * call_usermodehelper_exec(). | |
483 | */ | |
484 | int call_usermodehelper(const char *path, char **argv, char **envp, int wait) | |
485 | { | |
486 | struct subprocess_info *info; | |
487 | gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL; | |
488 | ||
489 | info = call_usermodehelper_setup(path, argv, envp, gfp_mask, | |
490 | NULL, NULL, NULL); | |
491 | if (info == NULL) | |
492 | return -ENOMEM; | |
493 | ||
494 | return call_usermodehelper_exec(info, wait); | |
495 | } | |
496 | EXPORT_SYMBOL(call_usermodehelper); | |
497 | ||
498 | static int proc_cap_handler(struct ctl_table *table, int write, | |
32927393 | 499 | void *buffer, size_t *lenp, loff_t *ppos) |
23558693 LR |
500 | { |
501 | struct ctl_table t; | |
502 | unsigned long cap_array[_KERNEL_CAPABILITY_U32S]; | |
503 | kernel_cap_t new_cap; | |
504 | int err, i; | |
505 | ||
506 | if (write && (!capable(CAP_SETPCAP) || | |
507 | !capable(CAP_SYS_MODULE))) | |
508 | return -EPERM; | |
509 | ||
510 | /* | |
511 | * convert from the global kernel_cap_t to the ulong array to print to | |
512 | * userspace if this is a read. | |
513 | */ | |
514 | spin_lock(&umh_sysctl_lock); | |
515 | for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++) { | |
516 | if (table->data == CAP_BSET) | |
517 | cap_array[i] = usermodehelper_bset.cap[i]; | |
518 | else if (table->data == CAP_PI) | |
519 | cap_array[i] = usermodehelper_inheritable.cap[i]; | |
520 | else | |
521 | BUG(); | |
522 | } | |
523 | spin_unlock(&umh_sysctl_lock); | |
524 | ||
525 | t = *table; | |
526 | t.data = &cap_array; | |
527 | ||
528 | /* | |
529 | * actually read or write and array of ulongs from userspace. Remember | |
530 | * these are least significant 32 bits first | |
531 | */ | |
532 | err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos); | |
533 | if (err < 0) | |
534 | return err; | |
535 | ||
536 | /* | |
537 | * convert from the sysctl array of ulongs to the kernel_cap_t | |
538 | * internal representation | |
539 | */ | |
540 | for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++) | |
541 | new_cap.cap[i] = cap_array[i]; | |
542 | ||
543 | /* | |
544 | * Drop everything not in the new_cap (but don't add things) | |
545 | */ | |
23558693 | 546 | if (write) { |
8c703d66 | 547 | spin_lock(&umh_sysctl_lock); |
23558693 LR |
548 | if (table->data == CAP_BSET) |
549 | usermodehelper_bset = cap_intersect(usermodehelper_bset, new_cap); | |
550 | if (table->data == CAP_PI) | |
551 | usermodehelper_inheritable = cap_intersect(usermodehelper_inheritable, new_cap); | |
8c703d66 | 552 | spin_unlock(&umh_sysctl_lock); |
23558693 | 553 | } |
23558693 LR |
554 | |
555 | return 0; | |
556 | } | |
557 | ||
558 | struct ctl_table usermodehelper_table[] = { | |
559 | { | |
560 | .procname = "bset", | |
561 | .data = CAP_BSET, | |
562 | .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long), | |
563 | .mode = 0600, | |
564 | .proc_handler = proc_cap_handler, | |
565 | }, | |
566 | { | |
567 | .procname = "inheritable", | |
568 | .data = CAP_PI, | |
569 | .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long), | |
570 | .mode = 0600, | |
571 | .proc_handler = proc_cap_handler, | |
572 | }, | |
573 | { } | |
574 | }; |