From nobody Thu Feb 10 20:22:21 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 3DB6A19C0C10; Thu, 10 Feb 2022 20:22:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Jvp7x35V8z3mdV; Thu, 10 Feb 2022 20:22:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1644524542; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UHeTRbPGSlNWPOtwsW+24qJROtZKU/681baBfOVTTeQ=; b=VgUZEqALDkO2ogkJ4YAmw6D93xGZTrUuLZ0GlVOXyybWnz1CHiHu8jdqQ7OZMlOpxI38Qj HpqzEtRaKxsai4eLlChW0o2Ffq28MwQ1s16AqD/MKdTUp90hUwJkBPzgnCMoNa6AK+tx5T 3oMOotI4Xxds9RmoUzYKRL2MmVzyj9AyAHQNZ2399OkvYaRWEZ7kpeqSmeNkweYpf7ldDb 942rEP4+WGCjCDYfrxDPVILo3+uUI3jarEcVZlGsbEo/hyefqer3p6nxDvvfjAf54fvp1g nPsdifUlZWR+Fm+XhnOnLvv6UboqgCdH8dXXasyhV5SchRLuS8GKxOooVApLEg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 33305270F9; Thu, 10 Feb 2022 20:22:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 21AKMLBW089205; Thu, 10 Feb 2022 20:22:21 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 21AKMLC8089190; Thu, 10 Feb 2022 20:22:21 GMT (envelope-from git) Date: Thu, 10 Feb 2022 20:22:21 GMT Message-Id: <202202102022.21AKMLC8089190@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 151922253f92 - stable/12 - execve: disallow argc == 0 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 151922253f927350a3f427d100b6291a7b8d676e Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1644524542; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UHeTRbPGSlNWPOtwsW+24qJROtZKU/681baBfOVTTeQ=; b=cquADYtrMBO45ahRkDGisH4pPwGQPNwl5wOK3b8TIAkxQJVb0pG+nOBdcQn8zB/11gV6SQ brdwXx4cA5gCRqtEmCnr0jtQ12zbVvCcXU9fa6IFTtCTlSdJVSSz0WOON1Q/soYNEneRlp 8H9kvUHdtwjAUKDsOdyPII11Vw8A3sN2oGW8fMt2ZzFcAgOaHMXp3MOZ9661rx6uiEjSB4 2Z+eXJTTJO3qMQ68O/b2KDd7Xk9Y82gbpnA71xltRPbuQT0sfETs8sA5T64S+bv3UyrNf+ 0qbyNDGbuI2QFLrrO+Su1gdeHGS5S8V3Rty7m5bABUbCA/nAQCCJFBRyXxvqJg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1644524542; a=rsa-sha256; cv=none; b=gP4BeCPOiw94dY2bT0sf9Yj4G0gIpJlC150H4W+xa7J6OWacLihJaIakwryuU/zU3+H56I pa+5OZxdcrU9+e/U895mFiUHSz2BTIBEwT0wh9XTRlAuS01CdybYvuczOsYaaTVJ+adQNc RArBawinx3/0pKM8Uxb/YLM1/zjiNUIuiXPdX1jXS7RtG7ArgEe/QF69ym2tqxGv+QUYHm g3xSgHUTcjVxPj0c76qAWUG89lHA4yqD82Z9Kft3EbVu8UjA94niT2VxC9JBtM8hkxrlCg YqUep8bsgXmE1/Gz7EJb2hTFChLGmERtJc5WgmXjwIA6ZKEhAHOXHM6H37OeOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=151922253f927350a3f427d100b6291a7b8d676e commit 151922253f927350a3f427d100b6291a7b8d676e Author: Kyle Evans AuthorDate: 2022-01-25 22:47:23 +0000 Commit: Kyle Evans CommitDate: 2022-02-10 20:17:27 +0000 execve: disallow argc == 0 The manpage has contained the following verbiage on the matter for just under 31 years: "At least one argument must be present in the array" Previous to this version, it had been prefaced with the weakening phrase "By convention." Carry through and document it the rest of the way. Allowing argc == 0 has been a source of security issues in the past, and it's hard to imagine a valid use-case for allowing it. Toss back EINVAL if we ended up not copying in any args for *execve(). The manpage change can be considered "Obtained from: OpenBSD" (cherry picked from commit 773fa8cd136a5775241c3e3a70f1997633ebeedf) (cherry picked from commit c9afc7680f3e1f0510518de9de4264553a31aade) --- lib/libc/sys/execve.2 | 5 ++++- lib/libc/tests/gen/posix_spawn_test.c | 9 +++------ sys/kern/kern_exec.c | 6 ++++++ 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/lib/libc/sys/execve.2 b/lib/libc/sys/execve.2 index 20b73342f96e..2b9bed41a10f 100644 --- a/lib/libc/sys/execve.2 +++ b/lib/libc/sys/execve.2 @@ -28,7 +28,7 @@ .\" @(#)execve.2 8.5 (Berkeley) 6/1/94 .\" $FreeBSD$ .\" -.Dd March 30, 2020 +.Dd January 26, 2022 .Dt EXECVE 2 .Os .Sh NAME @@ -273,6 +273,9 @@ Search permission is denied for a component of the path prefix. The new process file is not an ordinary file. .It Bq Er EACCES The new process file mode denies execute permission. +.It Bq Er EINVAL +.Fa argv +did not contain at least one element. .It Bq Er ENOEXEC The new process file has the appropriate access permission, but has an invalid magic number in its header. diff --git a/lib/libc/tests/gen/posix_spawn_test.c b/lib/libc/tests/gen/posix_spawn_test.c index 5e2c485473d0..46259cbf8cde 100644 --- a/lib/libc/tests/gen/posix_spawn_test.c +++ b/lib/libc/tests/gen/posix_spawn_test.c @@ -117,17 +117,14 @@ ATF_TC_BODY(posix_spawnp_enoexec_fallback_null_argv0, tc) { char buf[FILENAME_MAX]; char *myargs[1]; - int error, status; - pid_t pid, waitres; + int error; + pid_t pid; snprintf(buf, sizeof(buf), "%s/spawnp_enoexec.sh", atf_tc_get_config_var(tc, "srcdir")); myargs[0] = NULL; error = posix_spawnp(&pid, buf, NULL, NULL, myargs, myenv); - ATF_REQUIRE(error == 0); - waitres = waitpid(pid, &status, 0); - ATF_REQUIRE(waitres == pid); - ATF_REQUIRE(WIFEXITED(status) && WEXITSTATUS(status) == 42); + ATF_REQUIRE(error == EINVAL); } ATF_TP_ADD_TCS(tp) diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 64c9e84db07c..acc2d38ba689 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -349,6 +349,12 @@ kern_execve(struct thread *td, struct image_args *args, struct mac *mac_p, args->begin_envv - args->begin_argv); AUDIT_ARG_ENVV(args->begin_envv, args->envc, args->endp - args->begin_envv); + + /* Must have at least one argument. */ + if (args->argc == 0) { + exec_free_args(args); + return (EINVAL); + } return (do_execve(td, args, mac_p, oldvmspace)); }