/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright 2019 Joyent, Inc.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/sysmacros.h>
#include <sys/signal.h>
#include <sys/cred.h>
#include <sys/user.h>
#include <sys/errno.h>
#include <sys/vnode.h>
#include <sys/proc.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/pathname.h>
#include <sys/disp.h>
#include <sys/exec.h>
#include <sys/kmem.h>
#include <sys/note.h>

/*
 * This is the loadable module wrapper.
 */
#include <sys/modctl.h>

/* Local prototypes */
static int
shbinexec(
        struct vnode *vp,
        struct execa *uap,
        struct uarg *args,
        struct intpdata *idatap,
        int level,
        size_t *execsz,
        int setid,
        caddr_t exec_file,
        struct cred *cred,
        int brand_action);

#define SHBIN_CNTL(x)   ((x)&037)
#define SHBINMAGIC_LEN  4
extern char shbinmagicstr[];

/*
 * Our list where we may find a copy of ksh93. The ordering is:
 * 1. 64bit (may not be installed or not supported in hardware)
 * 2. 32bit
 * 3. Use /sbin/ksh93 when /usr is not available
 *
 * ([1] and [2] explicitly bypass /usr/bin/ksh93 to avoid the
 * isaexec overhead).
 */
static char *shell_list[] =
{
/* Bypass /usr/bin/ksh93 (which is "isaexec") for performance */
#if defined(__sparc)
        "/usr/bin/sparcv9/ksh93",
        "/usr/bin/sparcv7/ksh93",
#elif defined(__x86)
        "/usr/bin/amd64/ksh93",
        "/usr/bin/i86/ksh93",
#else
#error "Unrecognized platform/CPU (use /usr/bin/ksh93 when in doubt)."
#endif
        "/sbin/ksh93",
        NULL
};

static struct execsw esw = {
        shbinmagicstr,
        0,
        SHBINMAGIC_LEN,
        shbinexec,
        NULL
};

/*
 * Module linkage information for the kernel.
 */
extern struct mod_ops mod_execops;

static struct modlexec modlexec = {
        &mod_execops, "exec mod for shell binaries (ksh93)", &esw
};

static struct modlinkage modlinkage = {
        MODREV_1, (void *)&modlexec, NULL
};

int
_init(void)
{
        return (mod_install(&modlinkage));
}

int
_fini(void)
{
        return (mod_remove(&modlinkage));
}

int
_info(struct modinfo *modinfop)
{
        return (mod_info(&modlinkage, modinfop));
}

static int
checkshbinmagic(struct vnode *vp)
{
        int error;
        char linep[SHBINMAGIC_LEN];
        ssize_t resid;

        /*
         * Read the entire line and confirm that it starts with the magic
         * sequence for compiled ksh93 shell scripts.
         */
        if (error = vn_rdwr(UIO_READ, vp, linep, sizeof (linep), (offset_t)0,
            UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))
                return (error);

        if (memcmp(linep, shbinmagicstr, SHBINMAGIC_LEN) != 0)
                return (ENOEXEC);

        return (0);
}

static int
shbinexec(
        struct vnode *vp,
        struct execa *uap,
        struct uarg *args,
        struct intpdata *idatap,
        int level,
        size_t *execsz,
        int setid,
        caddr_t exec_file,
        struct cred *cred,
        int brand_action)
{
        _NOTE(ARGUNUSED(brand_action))
        vnode_t *nvp;
        int error = 0;
        struct intpdata idata;
        struct pathname intppn;
        struct pathname resolvepn;
        char *opath;
        char devfd[19]; /* 32-bit int fits in 10 digits + 8 for "/dev/fd/" */
        int fd = -1;
        int i;

        if (level) {            /* Can't recurse */
                error = ENOEXEC;
                goto bad;
        }

        ASSERT(idatap == (struct intpdata *)NULL);

        /*
         * Check whether the executable has the correct magic value.
         */
        if (error = checkshbinmagic(vp))
                goto fail;

        pn_alloc(&resolvepn);

        /*
         * Travel the list of shells and look for one which is available...
         */
        for (i = 0; shell_list[i] != NULL; i++) {
                error = pn_get(shell_list[i], UIO_SYSSPACE, &intppn);
                if (error != 0) {
                        break;
                }

                error = lookuppn(&intppn, &resolvepn, FOLLOW, NULLVPP, &nvp);
                if (!error) {
                        /* Found match */
                        break;
                }

                /* No match found ? Then continue with the next item... */
                pn_free(&intppn);
        }

        if (error) {
                pn_free(&resolvepn);
                goto fail;
        }

        /*
         * Set up interpreter data
         * "--" is passed to mark the end-of-arguments before adding
         * the script's file name, preventing problems when a
         * script's name starts with a '-' character.
         */
        bzero(&idata, sizeof (intpdata_t));
        idata.intp = NULL;
        idata.intp_name[0] = shell_list[i];
        idata.intp_arg[0] = "--";

        opath = args->pathname;
        args->pathname = resolvepn.pn_path;
        /* don't free resolvepn until we are done with args */
        pn_free(&intppn);

        /*
         * When we're executing a set-uid script resulting in uids
         * mismatching or when we execute with additional privileges,
         * we close the "replace script between exec and open by shell"
         * hole by passing the script as /dev/fd parameter.
         */
        if ((setid & EXECSETID_PRIVS) != 0 ||
            (setid & (EXECSETID_UGIDS|EXECSETID_SETID)) ==
            (EXECSETID_UGIDS|EXECSETID_SETID)) {
                (void) strcpy(devfd, "/dev/fd/");
                if (error = execopen(&vp, &fd))
                        goto done;
                numtos(fd, &devfd[8]);
                args->fname = devfd;
        }

        error = gexec(&nvp, uap, args, &idata, ++level, execsz, exec_file, cred,
            EBA_NONE);

        if (!error) {
                /*
                 * Close this script as the sh interpreter
                 * will open and close it later on.
                 */
                (void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL);
        }
done:
        VN_RELE(nvp);
        args->pathname = opath;
        pn_free(&resolvepn);
fail:
        if (error && fd != -1)
                (void) execclose(fd);
bad:
        return (error);
}