Commit | Line | Data |
---|---|---|
457c8996 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
23558693 LR |
2 | /* |
3 | * umh - the kernel usermode helper | |
4 | */ | |
5 | #include <linux/module.h> | |
6 | #include <linux/sched.h> | |
7 | #include <linux/sched/task.h> | |
8 | #include <linux/binfmts.h> | |
9 | #include <linux/syscalls.h> | |
10 | #include <linux/unistd.h> | |
11 | #include <linux/kmod.h> | |
12 | #include <linux/slab.h> | |
13 | #include <linux/completion.h> | |
14 | #include <linux/cred.h> | |
15 | #include <linux/file.h> | |
16 | #include <linux/fdtable.h> | |
4013c149 | 17 | #include <linux/fs_struct.h> |
23558693 LR |
18 | #include <linux/workqueue.h> |
19 | #include <linux/security.h> | |
20 | #include <linux/mount.h> | |
21 | #include <linux/kernel.h> | |
22 | #include <linux/init.h> | |
23 | #include <linux/resource.h> | |
24 | #include <linux/notifier.h> | |
25 | #include <linux/suspend.h> | |
26 | #include <linux/rwsem.h> | |
27 | #include <linux/ptrace.h> | |
28 | #include <linux/async.h> | |
29 | #include <linux/uaccess.h> | |
e7cb072e | 30 | #include <linux/initrd.h> |
23558693 LR |
31 | |
32 | #include <trace/events/module.h> | |
33 | ||
34 | #define CAP_BSET (void *)1 | |
35 | #define CAP_PI (void *)2 | |
36 | ||
37 | static kernel_cap_t usermodehelper_bset = CAP_FULL_SET; | |
38 | static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET; | |
39 | static DEFINE_SPINLOCK(umh_sysctl_lock); | |
40 | static DECLARE_RWSEM(umhelper_sem); | |
41 | ||
42 | static void call_usermodehelper_freeinfo(struct subprocess_info *info) | |
43 | { | |
44 | if (info->cleanup) | |
45 | (*info->cleanup)(info); | |
46 | kfree(info); | |
47 | } | |
48 | ||
49 | static void umh_complete(struct subprocess_info *sub_info) | |
50 | { | |
51 | struct completion *comp = xchg(&sub_info->complete, NULL); | |
52 | /* | |
53 | * See call_usermodehelper_exec(). If xchg() returns NULL | |
54 | * we own sub_info, the UMH_KILLABLE caller has gone away | |
55 | * or the caller used UMH_NO_WAIT. | |
56 | */ | |
57 | if (comp) | |
58 | complete(comp); | |
59 | else | |
60 | call_usermodehelper_freeinfo(sub_info); | |
61 | } | |
62 | ||
63 | /* | |
64 | * This is the task which runs the usermode application | |
65 | */ | |
66 | static int call_usermodehelper_exec_async(void *data) | |
67 | { | |
68 | struct subprocess_info *sub_info = data; | |
69 | struct cred *new; | |
70 | int retval; | |
71 | ||
72 | spin_lock_irq(¤t->sighand->siglock); | |
73 | flush_signal_handlers(current, 1); | |
74 | spin_unlock_irq(¤t->sighand->siglock); | |
75 | ||
4013c149 LT |
76 | /* |
77 | * Initial kernel threads share ther FS with init, in order to | |
78 | * get the init root directory. But we've now created a new | |
79 | * thread that is going to execve a user process and has its own | |
80 | * 'struct fs_struct'. Reset umask to the default. | |
81 | */ | |
82 | current->fs->umask = 0022; | |
83 | ||
23558693 LR |
84 | /* |
85 | * Our parent (unbound workqueue) runs with elevated scheduling | |
86 | * priority. Avoid propagating that into the userspace child. | |
87 | */ | |
88 | set_user_nice(current, 0); | |
89 | ||
90 | retval = -ENOMEM; | |
91 | new = prepare_kernel_cred(current); | |
92 | if (!new) | |
93 | goto out; | |
94 | ||
95 | spin_lock(&umh_sysctl_lock); | |
96 | new->cap_bset = cap_intersect(usermodehelper_bset, new->cap_bset); | |
97 | new->cap_inheritable = cap_intersect(usermodehelper_inheritable, | |
98 | new->cap_inheritable); | |
99 | spin_unlock(&umh_sysctl_lock); | |
100 | ||
101 | if (sub_info->init) { | |
102 | retval = sub_info->init(sub_info, new); | |
103 | if (retval) { | |
104 | abort_creds(new); | |
105 | goto out; | |
106 | } | |
107 | } | |
108 | ||
109 | commit_creds(new); | |
110 | ||
e7cb072e | 111 | wait_for_initramfs(); |
be619f7f EB |
112 | retval = kernel_execve(sub_info->path, |
113 | (const char *const *)sub_info->argv, | |
114 | (const char *const *)sub_info->envp); | |
23558693 LR |
115 | out: |
116 | sub_info->retval = retval; | |
117 | /* | |
118 | * call_usermodehelper_exec_sync() will call umh_complete | |
119 | * if UHM_WAIT_PROC. | |
120 | */ | |
121 | if (!(sub_info->wait & UMH_WAIT_PROC)) | |
122 | umh_complete(sub_info); | |
123 | if (!retval) | |
124 | return 0; | |
125 | do_exit(0); | |
126 | } | |
127 | ||
128 | /* Handles UMH_WAIT_PROC. */ | |
129 | static void call_usermodehelper_exec_sync(struct subprocess_info *sub_info) | |
130 | { | |
131 | pid_t pid; | |
132 | ||
8043fc14 | 133 | /* If SIGCLD is ignored do_wait won't populate the status. */ |
23558693 LR |
134 | kernel_sigaction(SIGCHLD, SIG_DFL); |
135 | pid = kernel_thread(call_usermodehelper_exec_async, sub_info, SIGCHLD); | |
8043fc14 | 136 | if (pid < 0) |
23558693 | 137 | sub_info->retval = pid; |
8043fc14 CH |
138 | else |
139 | kernel_wait(pid, &sub_info->retval); | |
23558693 LR |
140 | |
141 | /* Restore default kernel sig handler */ | |
142 | kernel_sigaction(SIGCHLD, SIG_IGN); | |
23558693 LR |
143 | umh_complete(sub_info); |
144 | } | |
145 | ||
146 | /* | |
147 | * We need to create the usermodehelper kernel thread from a task that is affine | |
148 | * to an optimized set of CPUs (or nohz housekeeping ones) such that they | |
149 | * inherit a widest affinity irrespective of call_usermodehelper() callers with | |
150 | * possibly reduced affinity (eg: per-cpu workqueues). We don't want | |
151 | * usermodehelper targets to contend a busy CPU. | |
152 | * | |
153 | * Unbound workqueues provide such wide affinity and allow to block on | |
154 | * UMH_WAIT_PROC requests without blocking pending request (up to some limit). | |
155 | * | |
156 | * Besides, workqueues provide the privilege level that caller might not have | |
157 | * to perform the usermodehelper request. | |
158 | * | |
159 | */ | |
160 | static void call_usermodehelper_exec_work(struct work_struct *work) | |
161 | { | |
162 | struct subprocess_info *sub_info = | |
163 | container_of(work, struct subprocess_info, work); | |
164 | ||
165 | if (sub_info->wait & UMH_WAIT_PROC) { | |
166 | call_usermodehelper_exec_sync(sub_info); | |
167 | } else { | |
168 | pid_t pid; | |
169 | /* | |
170 | * Use CLONE_PARENT to reparent it to kthreadd; we do not | |
171 | * want to pollute current->children, and we need a parent | |
172 | * that always ignores SIGCHLD to ensure auto-reaping. | |
173 | */ | |
174 | pid = kernel_thread(call_usermodehelper_exec_async, sub_info, | |
175 | CLONE_PARENT | SIGCHLD); | |
176 | if (pid < 0) { | |
177 | sub_info->retval = pid; | |
178 | umh_complete(sub_info); | |
179 | } | |
180 | } | |
181 | } | |
182 | ||
183 | /* | |
184 | * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY | |
185 | * (used for preventing user land processes from being created after the user | |
186 | * land has been frozen during a system-wide hibernation or suspend operation). | |
187 | * Should always be manipulated under umhelper_sem acquired for write. | |
188 | */ | |
189 | static enum umh_disable_depth usermodehelper_disabled = UMH_DISABLED; | |
190 | ||
191 | /* Number of helpers running */ | |
192 | static atomic_t running_helpers = ATOMIC_INIT(0); | |
193 | ||
194 | /* | |
195 | * Wait queue head used by usermodehelper_disable() to wait for all running | |
196 | * helpers to finish. | |
197 | */ | |
198 | static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq); | |
199 | ||
200 | /* | |
201 | * Used by usermodehelper_read_lock_wait() to wait for usermodehelper_disabled | |
202 | * to become 'false'. | |
203 | */ | |
204 | static DECLARE_WAIT_QUEUE_HEAD(usermodehelper_disabled_waitq); | |
205 | ||
206 | /* | |
207 | * Time to wait for running_helpers to become zero before the setting of | |
208 | * usermodehelper_disabled in usermodehelper_disable() fails | |
209 | */ | |
210 | #define RUNNING_HELPERS_TIMEOUT (5 * HZ) | |
211 | ||
212 | int usermodehelper_read_trylock(void) | |
213 | { | |
214 | DEFINE_WAIT(wait); | |
215 | int ret = 0; | |
216 | ||
217 | down_read(&umhelper_sem); | |
218 | for (;;) { | |
219 | prepare_to_wait(&usermodehelper_disabled_waitq, &wait, | |
220 | TASK_INTERRUPTIBLE); | |
221 | if (!usermodehelper_disabled) | |
222 | break; | |
223 | ||
224 | if (usermodehelper_disabled == UMH_DISABLED) | |
225 | ret = -EAGAIN; | |
226 | ||
227 | up_read(&umhelper_sem); | |
228 | ||
229 | if (ret) | |
230 | break; | |
231 | ||
232 | schedule(); | |
233 | try_to_freeze(); | |
234 | ||
235 | down_read(&umhelper_sem); | |
236 | } | |
237 | finish_wait(&usermodehelper_disabled_waitq, &wait); | |
238 | return ret; | |
239 | } | |
240 | EXPORT_SYMBOL_GPL(usermodehelper_read_trylock); | |
241 | ||
242 | long usermodehelper_read_lock_wait(long timeout) | |
243 | { | |
244 | DEFINE_WAIT(wait); | |
245 | ||
246 | if (timeout < 0) | |
247 | return -EINVAL; | |
248 | ||
249 | down_read(&umhelper_sem); | |
250 | for (;;) { | |
251 | prepare_to_wait(&usermodehelper_disabled_waitq, &wait, | |
252 | TASK_UNINTERRUPTIBLE); | |
253 | if (!usermodehelper_disabled) | |
254 | break; | |
255 | ||
256 | up_read(&umhelper_sem); | |
257 | ||
258 | timeout = schedule_timeout(timeout); | |
259 | if (!timeout) | |
260 | break; | |
261 | ||
262 | down_read(&umhelper_sem); | |
263 | } | |
264 | finish_wait(&usermodehelper_disabled_waitq, &wait); | |
265 | return timeout; | |
266 | } | |
267 | EXPORT_SYMBOL_GPL(usermodehelper_read_lock_wait); | |
268 | ||
269 | void usermodehelper_read_unlock(void) | |
270 | { | |
271 | up_read(&umhelper_sem); | |
272 | } | |
273 | EXPORT_SYMBOL_GPL(usermodehelper_read_unlock); | |
274 | ||
275 | /** | |
276 | * __usermodehelper_set_disable_depth - Modify usermodehelper_disabled. | |
277 | * @depth: New value to assign to usermodehelper_disabled. | |
278 | * | |
279 | * Change the value of usermodehelper_disabled (under umhelper_sem locked for | |
280 | * writing) and wakeup tasks waiting for it to change. | |
281 | */ | |
282 | void __usermodehelper_set_disable_depth(enum umh_disable_depth depth) | |
283 | { | |
284 | down_write(&umhelper_sem); | |
285 | usermodehelper_disabled = depth; | |
286 | wake_up(&usermodehelper_disabled_waitq); | |
287 | up_write(&umhelper_sem); | |
288 | } | |
289 | ||
290 | /** | |
291 | * __usermodehelper_disable - Prevent new helpers from being started. | |
292 | * @depth: New value to assign to usermodehelper_disabled. | |
293 | * | |
294 | * Set usermodehelper_disabled to @depth and wait for running helpers to exit. | |
295 | */ | |
296 | int __usermodehelper_disable(enum umh_disable_depth depth) | |
297 | { | |
298 | long retval; | |
299 | ||
300 | if (!depth) | |
301 | return -EINVAL; | |
302 | ||
303 | down_write(&umhelper_sem); | |
304 | usermodehelper_disabled = depth; | |
305 | up_write(&umhelper_sem); | |
306 | ||
307 | /* | |
308 | * From now on call_usermodehelper_exec() won't start any new | |
309 | * helpers, so it is sufficient if running_helpers turns out to | |
310 | * be zero at one point (it may be increased later, but that | |
311 | * doesn't matter). | |
312 | */ | |
313 | retval = wait_event_timeout(running_helpers_waitq, | |
314 | atomic_read(&running_helpers) == 0, | |
315 | RUNNING_HELPERS_TIMEOUT); | |
316 | if (retval) | |
317 | return 0; | |
318 | ||
319 | __usermodehelper_set_disable_depth(UMH_ENABLED); | |
320 | return -EAGAIN; | |
321 | } | |
322 | ||
323 | static void helper_lock(void) | |
324 | { | |
325 | atomic_inc(&running_helpers); | |
326 | smp_mb__after_atomic(); | |
327 | } | |
328 | ||
329 | static void helper_unlock(void) | |
330 | { | |
331 | if (atomic_dec_and_test(&running_helpers)) | |
332 | wake_up(&running_helpers_waitq); | |
333 | } | |
334 | ||
335 | /** | |
336 | * call_usermodehelper_setup - prepare to call a usermode helper | |
337 | * @path: path to usermode executable | |
338 | * @argv: arg vector for process | |
339 | * @envp: environment for process | |
340 | * @gfp_mask: gfp mask for memory allocation | |
23558693 | 341 | * @init: an init function |
48207f7d | 342 | * @cleanup: a cleanup function |
23558693 LR |
343 | * @data: arbitrary context sensitive data |
344 | * | |
345 | * Returns either %NULL on allocation failure, or a subprocess_info | |
346 | * structure. This should be passed to call_usermodehelper_exec to | |
347 | * exec the process and free the structure. | |
348 | * | |
349 | * The init function is used to customize the helper process prior to | |
350 | * exec. A non-zero return code causes the process to error out, exit, | |
351 | * and return the failure to the calling process | |
352 | * | |
48207f7d | 353 | * The cleanup function is just before the subprocess_info is about to |
23558693 LR |
354 | * be freed. This can be used for freeing the argv and envp. The |
355 | * Function must be runnable in either a process context or the | |
356 | * context in which call_usermodehelper_exec is called. | |
357 | */ | |
358 | struct subprocess_info *call_usermodehelper_setup(const char *path, char **argv, | |
359 | char **envp, gfp_t gfp_mask, | |
360 | int (*init)(struct subprocess_info *info, struct cred *new), | |
361 | void (*cleanup)(struct subprocess_info *info), | |
362 | void *data) | |
363 | { | |
364 | struct subprocess_info *sub_info; | |
365 | sub_info = kzalloc(sizeof(struct subprocess_info), gfp_mask); | |
366 | if (!sub_info) | |
367 | goto out; | |
368 | ||
369 | INIT_WORK(&sub_info->work, call_usermodehelper_exec_work); | |
370 | ||
371 | #ifdef CONFIG_STATIC_USERMODEHELPER | |
372 | sub_info->path = CONFIG_STATIC_USERMODEHELPER_PATH; | |
373 | #else | |
374 | sub_info->path = path; | |
375 | #endif | |
376 | sub_info->argv = argv; | |
377 | sub_info->envp = envp; | |
378 | ||
379 | sub_info->cleanup = cleanup; | |
380 | sub_info->init = init; | |
381 | sub_info->data = data; | |
382 | out: | |
383 | return sub_info; | |
384 | } | |
385 | EXPORT_SYMBOL(call_usermodehelper_setup); | |
386 | ||
387 | /** | |
388 | * call_usermodehelper_exec - start a usermode application | |
48207f7d | 389 | * @sub_info: information about the subprocess |
23558693 LR |
390 | * @wait: wait for the application to finish and return status. |
391 | * when UMH_NO_WAIT don't wait at all, but you get no useful error back | |
392 | * when the program couldn't be exec'ed. This makes it safe to call | |
393 | * from interrupt context. | |
394 | * | |
395 | * Runs a user-space application. The application is started | |
396 | * asynchronously if wait is not set, and runs as a child of system workqueues. | |
397 | * (ie. it runs with full root capabilities and optimized affinity). | |
3740d93e LC |
398 | * |
399 | * Note: successful return value does not guarantee the helper was called at | |
400 | * all. You can't rely on sub_info->{init,cleanup} being called even for | |
401 | * UMH_WAIT_* wait modes as STATIC_USERMODEHELPER_PATH="" turns all helpers | |
402 | * into a successful no-op. | |
23558693 LR |
403 | */ |
404 | int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait) | |
405 | { | |
406 | DECLARE_COMPLETION_ONSTACK(done); | |
407 | int retval = 0; | |
408 | ||
409 | if (!sub_info->path) { | |
410 | call_usermodehelper_freeinfo(sub_info); | |
411 | return -EINVAL; | |
412 | } | |
413 | helper_lock(); | |
414 | if (usermodehelper_disabled) { | |
415 | retval = -EBUSY; | |
416 | goto out; | |
417 | } | |
418 | ||
419 | /* | |
420 | * If there is no binary for us to call, then just return and get out of | |
421 | * here. This allows us to set STATIC_USERMODEHELPER_PATH to "" and | |
422 | * disable all call_usermodehelper() calls. | |
423 | */ | |
424 | if (strlen(sub_info->path) == 0) | |
425 | goto out; | |
426 | ||
427 | /* | |
428 | * Set the completion pointer only if there is a waiter. | |
429 | * This makes it possible to use umh_complete to free | |
430 | * the data structure in case of UMH_NO_WAIT. | |
431 | */ | |
432 | sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done; | |
433 | sub_info->wait = wait; | |
434 | ||
435 | queue_work(system_unbound_wq, &sub_info->work); | |
436 | if (wait == UMH_NO_WAIT) /* task has freed sub_info */ | |
437 | goto unlock; | |
438 | ||
439 | if (wait & UMH_KILLABLE) { | |
440 | retval = wait_for_completion_killable(&done); | |
441 | if (!retval) | |
442 | goto wait_done; | |
443 | ||
444 | /* umh_complete() will see NULL and free sub_info */ | |
445 | if (xchg(&sub_info->complete, NULL)) | |
446 | goto unlock; | |
447 | /* fallthrough, umh_complete() was already called */ | |
448 | } | |
449 | ||
450 | wait_for_completion(&done); | |
451 | wait_done: | |
452 | retval = sub_info->retval; | |
453 | out: | |
454 | call_usermodehelper_freeinfo(sub_info); | |
455 | unlock: | |
456 | helper_unlock(); | |
457 | return retval; | |
458 | } | |
459 | EXPORT_SYMBOL(call_usermodehelper_exec); | |
460 | ||
461 | /** | |
462 | * call_usermodehelper() - prepare and start a usermode application | |
463 | * @path: path to usermode executable | |
464 | * @argv: arg vector for process | |
465 | * @envp: environment for process | |
466 | * @wait: wait for the application to finish and return status. | |
467 | * when UMH_NO_WAIT don't wait at all, but you get no useful error back | |
468 | * when the program couldn't be exec'ed. This makes it safe to call | |
469 | * from interrupt context. | |
470 | * | |
471 | * This function is the equivalent to use call_usermodehelper_setup() and | |
472 | * call_usermodehelper_exec(). | |
473 | */ | |
474 | int call_usermodehelper(const char *path, char **argv, char **envp, int wait) | |
475 | { | |
476 | struct subprocess_info *info; | |
477 | gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL; | |
478 | ||
479 | info = call_usermodehelper_setup(path, argv, envp, gfp_mask, | |
480 | NULL, NULL, NULL); | |
481 | if (info == NULL) | |
482 | return -ENOMEM; | |
483 | ||
484 | return call_usermodehelper_exec(info, wait); | |
485 | } | |
486 | EXPORT_SYMBOL(call_usermodehelper); | |
487 | ||
488 | static int proc_cap_handler(struct ctl_table *table, int write, | |
32927393 | 489 | void *buffer, size_t *lenp, loff_t *ppos) |
23558693 LR |
490 | { |
491 | struct ctl_table t; | |
492 | unsigned long cap_array[_KERNEL_CAPABILITY_U32S]; | |
493 | kernel_cap_t new_cap; | |
494 | int err, i; | |
495 | ||
496 | if (write && (!capable(CAP_SETPCAP) || | |
497 | !capable(CAP_SYS_MODULE))) | |
498 | return -EPERM; | |
499 | ||
500 | /* | |
501 | * convert from the global kernel_cap_t to the ulong array to print to | |
502 | * userspace if this is a read. | |
503 | */ | |
504 | spin_lock(&umh_sysctl_lock); | |
505 | for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++) { | |
506 | if (table->data == CAP_BSET) | |
507 | cap_array[i] = usermodehelper_bset.cap[i]; | |
508 | else if (table->data == CAP_PI) | |
509 | cap_array[i] = usermodehelper_inheritable.cap[i]; | |
510 | else | |
511 | BUG(); | |
512 | } | |
513 | spin_unlock(&umh_sysctl_lock); | |
514 | ||
515 | t = *table; | |
516 | t.data = &cap_array; | |
517 | ||
518 | /* | |
519 | * actually read or write and array of ulongs from userspace. Remember | |
520 | * these are least significant 32 bits first | |
521 | */ | |
522 | err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos); | |
523 | if (err < 0) | |
524 | return err; | |
525 | ||
526 | /* | |
527 | * convert from the sysctl array of ulongs to the kernel_cap_t | |
528 | * internal representation | |
529 | */ | |
530 | for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++) | |
531 | new_cap.cap[i] = cap_array[i]; | |
532 | ||
533 | /* | |
534 | * Drop everything not in the new_cap (but don't add things) | |
535 | */ | |
23558693 | 536 | if (write) { |
8c703d66 | 537 | spin_lock(&umh_sysctl_lock); |
23558693 LR |
538 | if (table->data == CAP_BSET) |
539 | usermodehelper_bset = cap_intersect(usermodehelper_bset, new_cap); | |
540 | if (table->data == CAP_PI) | |
541 | usermodehelper_inheritable = cap_intersect(usermodehelper_inheritable, new_cap); | |
8c703d66 | 542 | spin_unlock(&umh_sysctl_lock); |
23558693 | 543 | } |
23558693 LR |
544 | |
545 | return 0; | |
546 | } | |
547 | ||
548 | struct ctl_table usermodehelper_table[] = { | |
549 | { | |
550 | .procname = "bset", | |
551 | .data = CAP_BSET, | |
552 | .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long), | |
553 | .mode = 0600, | |
554 | .proc_handler = proc_cap_handler, | |
555 | }, | |
556 | { | |
557 | .procname = "inheritable", | |
558 | .data = CAP_PI, | |
559 | .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long), | |
560 | .mode = 0600, | |
561 | .proc_handler = proc_cap_handler, | |
562 | }, | |
563 | { } | |
564 | }; |