2023-12-04 20:45:46 +00:00
|
|
|
/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
|
2023-12-08 03:11:56 +00:00
|
|
|
│ vi: set et ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi │
|
2023-12-04 20:45:46 +00:00
|
|
|
╞══════════════════════════════════════════════════════════════════════════════╡
|
|
|
|
│ Copyright 2023 Justine Alexandra Roberts Tunney │
|
|
|
|
│ │
|
|
|
|
│ Permission to use, copy, modify, and/or distribute this software for │
|
|
|
|
│ any purpose with or without fee is hereby granted, provided that the │
|
|
|
|
│ above copyright notice and this permission notice appear in all copies. │
|
|
|
|
│ │
|
|
|
|
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │
|
|
|
|
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │
|
|
|
|
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │
|
|
|
|
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │
|
|
|
|
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │
|
|
|
|
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │
|
|
|
|
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
|
|
|
|
│ PERFORMANCE OF THIS SOFTWARE. │
|
|
|
|
╚─────────────────────────────────────────────────────────────────────────────*/
|
|
|
|
#include "libc/calls/calls.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/calls/metalfile.internal.h"
|
2024-01-04 16:25:37 +00:00
|
|
|
#include "libc/calls/syscall-nt.internal.h"
|
2024-01-01 15:23:23 +00:00
|
|
|
#include "libc/calls/syscall-sysv.internal.h"
|
2024-01-04 16:25:37 +00:00
|
|
|
#include "libc/calls/syscall_support-sysv.internal.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/dce.h"
|
|
|
|
#include "libc/limits.h"
|
|
|
|
#include "libc/runtime/runtime.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/serialize.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/stdio/stdio.h"
|
|
|
|
#include "libc/str/str.h"
|
2024-01-06 19:42:03 +00:00
|
|
|
#include "libc/sysv/consts/auxv.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/sysv/consts/o.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/sysv/consts/ok.h"
|
2023-12-05 04:01:52 +00:00
|
|
|
#include "libc/testlib/ezbench.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/testlib/subprocess.h"
|
|
|
|
#include "libc/testlib/testlib.h"
|
|
|
|
|
|
|
|
static char *self;
|
2024-01-06 19:42:03 +00:00
|
|
|
static bool loaded, skiptests, skiparg0;
|
2023-12-04 20:45:46 +00:00
|
|
|
|
|
|
|
void SetUpOnce(void) {
|
Loader path security (#1012)
The ape loader now passes the program executable name directly as a
register. `x2` is used on aarch64, `%rdx` on x86_64. This is passed
as the third argument to `cosmo()` (M1) or `Launch` (non-M1) and is
assigned to the global `__program_executable_name`.
`GetProgramExecutableName` now returns this global's value, setting
it if it is initially null. `InitProgramExecutableName` first tries
exotic, secure methods: `KERN_PROC_PATHNAME` on FreeBSD/NetBSD, and
`/proc` on Linux. If those produce a reasonable response (i.e., not
`"/usr/bin/ape"`, which happens with the loader before this change),
that is used. Otherwise, if `issetugid()`, the empty string is used.
Otherwise, the old argv/envp parsing code is run.
The value returned from the loader is always the full absolute path
of the binary to be executed, having passed through `realpath`. For
the non-M1 loader, this necessitated writing `RealPath`, which uses
`readlinkat` of `"/proc/self/fd/[progfd]"` on Linux, `F_GETPATH` on
Xnu, and the `__realpath` syscall on OpenBSD. On FreeBSD/NetBSD, it
punts to `GetProgramExecutableName`, which is secure on those OSes.
With the loader, all platforms now have a secure program executable
name. With no loader or an old loader, everything still works as it
did, but setuid/setgid is not supported if the insecure pathfinding
code would have been needed.
Fixes #991.
2023-12-15 17:23:58 +00:00
|
|
|
self = GetProgramExecutableName();
|
2023-12-04 20:45:46 +00:00
|
|
|
testlib_enable_tmp_setup_teardown();
|
2023-12-31 19:53:15 +00:00
|
|
|
if (IsMetal()) {
|
|
|
|
skiptests = true;
|
2024-01-06 19:42:03 +00:00
|
|
|
} else if (IsWindows()) {
|
|
|
|
/* do all tests */
|
|
|
|
} else if (!loaded) {
|
2023-12-31 19:53:15 +00:00
|
|
|
ASSERT_STRNE(self, "");
|
|
|
|
ASSERT_SYS(0, 3, open(self, O_RDONLY));
|
|
|
|
char buf[8];
|
|
|
|
ASSERT_SYS(0, 8, pread(3, buf, 8, 0));
|
|
|
|
ASSERT_SYS(0, 0, close(3));
|
|
|
|
if (READ64LE(buf) != READ64LE("MZqFpD='") &&
|
|
|
|
READ64LE(buf) != READ64LE("jartsr='") &&
|
|
|
|
READ64LE(buf) != READ64LE("APEDBG='")) {
|
2024-01-06 19:42:03 +00:00
|
|
|
// GetProgramExecutableName does not work reliably for assimilated
|
|
|
|
// OpenBSD or XNU binaries.
|
|
|
|
skiptests = IsOpenbsd() || (IsXnu() && !IsXnuSilicon());
|
2023-12-31 19:53:15 +00:00
|
|
|
}
|
2024-01-06 19:42:03 +00:00
|
|
|
} else {
|
2024-01-07 15:13:20 +00:00
|
|
|
skiparg0 = !(getauxval(AT_FLAGS) & AT_FLAGS_PRESERVE_ARGV0);
|
2024-01-06 19:42:03 +00:00
|
|
|
}
|
|
|
|
fprintf(stderr, loaded ? "loaded\n" : "not loaded\n");
|
|
|
|
if (skiptests) {
|
|
|
|
fprintf(stderr, "skipping most GetProgramExecutableName tests\n");
|
|
|
|
} else if (skiparg0) {
|
|
|
|
fprintf(stderr, "skipping argv[0] tests\n");
|
2023-12-31 19:53:15 +00:00
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
__attribute__((__constructor__)) static void Child(int argc, char *argv[]) {
|
2024-01-06 19:42:03 +00:00
|
|
|
loaded = !!__program_executable_name;
|
2023-12-04 20:45:46 +00:00
|
|
|
if (argc >= 2 && !strcmp(argv[1], "Child")) {
|
2024-01-04 16:25:37 +00:00
|
|
|
int rc;
|
|
|
|
if (!IsWindows()) {
|
|
|
|
rc = sys_chdir("/");
|
|
|
|
} else {
|
|
|
|
rc = sys_chdir_nt("/");
|
|
|
|
}
|
|
|
|
if (rc) {
|
2024-01-01 15:23:23 +00:00
|
|
|
exit(122);
|
|
|
|
}
|
2023-12-28 12:22:42 +00:00
|
|
|
if (strcmp(argv[2], GetProgramExecutableName())) {
|
|
|
|
exit(123);
|
Loader path security (#1012)
The ape loader now passes the program executable name directly as a
register. `x2` is used on aarch64, `%rdx` on x86_64. This is passed
as the third argument to `cosmo()` (M1) or `Launch` (non-M1) and is
assigned to the global `__program_executable_name`.
`GetProgramExecutableName` now returns this global's value, setting
it if it is initially null. `InitProgramExecutableName` first tries
exotic, secure methods: `KERN_PROC_PATHNAME` on FreeBSD/NetBSD, and
`/proc` on Linux. If those produce a reasonable response (i.e., not
`"/usr/bin/ape"`, which happens with the loader before this change),
that is used. Otherwise, if `issetugid()`, the empty string is used.
Otherwise, the old argv/envp parsing code is run.
The value returned from the loader is always the full absolute path
of the binary to be executed, having passed through `realpath`. For
the non-M1 loader, this necessitated writing `RealPath`, which uses
`readlinkat` of `"/proc/self/fd/[progfd]"` on Linux, `F_GETPATH` on
Xnu, and the `__realpath` syscall on OpenBSD. On FreeBSD/NetBSD, it
punts to `GetProgramExecutableName`, which is secure on those OSes.
With the loader, all platforms now have a secure program executable
name. With no loader or an old loader, everything still works as it
did, but setuid/setgid is not supported if the insecure pathfinding
code would have been needed.
Fixes #991.
2023-12-15 17:23:58 +00:00
|
|
|
}
|
2024-01-06 19:42:03 +00:00
|
|
|
if (argc >= 4) {
|
|
|
|
if (strcmp(argv[3], argv[0])) {
|
|
|
|
exit(124);
|
|
|
|
}
|
2023-12-28 12:22:42 +00:00
|
|
|
}
|
|
|
|
exit(0);
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProgramExecutableName, ofThisFile) {
|
2023-12-31 19:53:15 +00:00
|
|
|
if (IsMetal()) {
|
|
|
|
EXPECT_STREQ(self, APE_COM_NAME);
|
|
|
|
} else {
|
|
|
|
EXPECT_EQ('/', *self);
|
|
|
|
EXPECT_TRUE(!!strstr(self, "getprogramexecutablename_test"));
|
|
|
|
EXPECT_SYS(0, 0, access(self, X_OK));
|
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProgramExecutableName, nullEnv) {
|
2023-12-31 19:53:15 +00:00
|
|
|
if (skiptests) return;
|
2023-12-04 20:45:46 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(self, (char *[]){self, "Child", self, skiparg0 ? 0 : self, 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProramExecutableName, weirdArgv0NullEnv) {
|
2023-12-31 19:53:15 +00:00
|
|
|
if (skiptests) return;
|
2023-12-04 20:45:46 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(self, (char *[]){"hello", "Child", self, skiparg0 ? 0 : "hello", 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
|
|
|
}
|
|
|
|
|
2023-12-05 04:01:52 +00:00
|
|
|
TEST(GetProgramExecutableName, movedSelf) {
|
2023-12-31 19:53:15 +00:00
|
|
|
if (skiptests) return;
|
2024-01-29 23:45:10 +00:00
|
|
|
if (IsAarch64() && IsQemuUser()) {
|
2024-01-04 16:25:37 +00:00
|
|
|
// clang-format off
|
|
|
|
// TODO(mrdomino): fix: make -j8 m=aarch64 o/aarch64/test/libc/calls/getprogramexecutablename_test.com.ok
|
|
|
|
// possibly related to the intersection of binfmt_misc and qemu-aarch64
|
|
|
|
// clang-format on
|
|
|
|
return;
|
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
char buf[BUFSIZ];
|
|
|
|
ASSERT_SYS(0, 3, open(GetProgramExecutableName(), O_RDONLY));
|
|
|
|
ASSERT_SYS(0, 4, creat("test", 0755));
|
|
|
|
ssize_t rc;
|
|
|
|
while ((rc = read(3, buf, BUFSIZ)) > 0) {
|
|
|
|
ASSERT_SYS(0, rc, write(4, buf, rc));
|
|
|
|
}
|
|
|
|
ASSERT_EQ(0, rc);
|
|
|
|
ASSERT_SYS(0, 0, close(4));
|
|
|
|
ASSERT_SYS(0, 0, close(3));
|
|
|
|
ASSERT_NE(NULL, getcwd(buf, BUFSIZ - 5));
|
|
|
|
stpcpy(buf + strlen(buf), "/test");
|
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(buf, (char *[]){"hello", "Child", buf, skiparg0 ? 0 : "hello", 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
2024-01-01 15:23:23 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve("./test", (char *[]){"hello", "Child", buf, skiparg0 ? 0 : "hello", 0},
|
2024-01-01 15:23:23 +00:00
|
|
|
(char *[]){0});
|
|
|
|
abort();
|
|
|
|
EXITS(0);
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|