projects/linux·blob v4.11 · refs

722 lines · 19.6 KiB

1/*
2 kmod, the new module loader (replaces kerneld)
3 Kirk Petersen
4
5 Reorganized not to be a daemon by Adam Richter, with guidance
6 from Greg Zornetzer.
7
8 Modified to avoid chroot and file sharing problems.
9 Mikael Pettersson
10
11 Limit the concurrent number of kmod modprobes to catch loops from
12 "modprobe needs a service that is in a module".
13 Keith Owens <[email protected]> December 1999
14
15 Unblock all signals when we exec a usermode process.
16 Shuu Yamaguchi <[email protected]> December 2000
17
18 call_usermodehelper wait flag, and remove exec_usermodehelper.
19 Rusty Russell <[email protected]> Jan 2003
20*/
21#include <linux/module.h>
22#include <linux/sched.h>
23#include <linux/sched/task.h>
24#include <linux/binfmts.h>
25#include <linux/syscalls.h>
26#include <linux/unistd.h>
27#include <linux/kmod.h>
28#include <linux/slab.h>
29#include <linux/completion.h>
30#include <linux/cred.h>
31#include <linux/file.h>
32#include <linux/fdtable.h>
33#include <linux/workqueue.h>
34#include <linux/security.h>
35#include <linux/mount.h>
36#include <linux/kernel.h>
37#include <linux/init.h>
38#include <linux/resource.h>
39#include <linux/notifier.h>
40#include <linux/suspend.h>
41#include <linux/rwsem.h>
42#include <linux/ptrace.h>
43#include <linux/async.h>
44#include <linux/uaccess.h>
45
46#include <trace/events/module.h>
47
48extern int max_threads;
49
50#define CAP_BSET (void *)1
51#define CAP_PI (void *)2
52
53static kernel_cap_t usermodehelper_bset = CAP_FULL_SET;
54static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET;
55static DEFINE_SPINLOCK(umh_sysctl_lock);
56static DECLARE_RWSEM(umhelper_sem);
57
58#ifdef CONFIG_MODULES
59
60/*
61 modprobe_path is set via /proc/sys.
62*/
63char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
64
65static void free_modprobe_argv(struct subprocess_info *info)
66{
67 kfree(info->argv[3]); /* check call_modprobe() */
68 kfree(info->argv);
69}
70
71static int call_modprobe(char *module_name, int wait)
72{
73 struct subprocess_info *info;
74 static char *envp[] = {
75 "HOME=/",
76 "TERM=linux",
77 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
78 NULL
79 };
80
81 char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
82 if (!argv)
83 goto out;
84
85 module_name = kstrdup(module_name, GFP_KERNEL);
86 if (!module_name)
87 goto free_argv;
88
89 argv[0] = modprobe_path;
90 argv[1] = "-q";
91 argv[2] = "--";
92 argv[3] = module_name; /* check free_modprobe_argv() */
93 argv[4] = NULL;
94
95 info = call_usermodehelper_setup(modprobe_path, argv, envp, GFP_KERNEL,
96 NULL, free_modprobe_argv, NULL);
97 if (!info)
98 goto free_module_name;
99
100 return call_usermodehelper_exec(info, wait | UMH_KILLABLE);
101
102free_module_name:
103 kfree(module_name);
104free_argv:
105 kfree(argv);
106out:
107 return -ENOMEM;
108}
109
110/**
111 * __request_module - try to load a kernel module
112 * @wait: wait (or not) for the operation to complete
113 * @fmt: printf style format string for the name of the module
114 * @...: arguments as specified in the format string
115 *
116 * Load a module using the user mode module loader. The function returns
117 * zero on success or a negative errno code or positive exit code from
118 * "modprobe" on failure. Note that a successful module load does not mean
119 * the module did not then unload and exit on an error of its own. Callers
120 * must check that the service they requested is now available not blindly
121 * invoke it.
122 *
123 * If module auto-loading support is disabled then this function
124 * becomes a no-operation.
125 */
126int __request_module(bool wait, const char *fmt, ...)
127{
128 va_list args;
129 char module_name[MODULE_NAME_LEN];
130 unsigned int max_modprobes;
131 int ret;
132 static atomic_t kmod_concurrent = ATOMIC_INIT(0);
133#define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
134 static int kmod_loop_msg;
135
136 /*
137 * We don't allow synchronous module loading from async. Module
138 * init may invoke async_synchronize_full() which will end up
139 * waiting for this task which already is waiting for the module
140 * loading to complete, leading to a deadlock.
141 */
142 WARN_ON_ONCE(wait && current_is_async());
143
144 if (!modprobe_path[0])
145 return 0;
146
147 va_start(args, fmt);
148 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
149 va_end(args);
150 if (ret >= MODULE_NAME_LEN)
151 return -ENAMETOOLONG;
152
153 ret = security_kernel_module_request(module_name);
154 if (ret)
155 return ret;
156
157 /* If modprobe needs a service that is in a module, we get a recursive
158 * loop. Limit the number of running kmod threads to max_threads/2 or
159 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
160 * would be to run the parents of this process, counting how many times
161 * kmod was invoked. That would mean accessing the internals of the
162 * process tables to get the command line, proc_pid_cmdline is static
163 * and it is not worth changing the proc code just to handle this case.
164 * KAO.
165 *
166 * "trace the ppid" is simple, but will fail if someone's
167 * parent exits. I think this is as good as it gets. --RR
168 */
169 max_modprobes = min(max_threads/2, MAX_KMOD_CONCURRENT);
170 atomic_inc(&kmod_concurrent);
171 if (atomic_read(&kmod_concurrent) > max_modprobes) {
172 /* We may be blaming an innocent here, but unlikely */
173 if (kmod_loop_msg < 5) {
174 printk(KERN_ERR
175 "request_module: runaway loop modprobe %s\n",
176 module_name);
177 kmod_loop_msg++;
178 }
179 atomic_dec(&kmod_concurrent);
180 return -ENOMEM;
181 }
182
183 trace_module_request(module_name, wait, _RET_IP_);
184
185 ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
186
187 atomic_dec(&kmod_concurrent);
188 return ret;
189}
190EXPORT_SYMBOL(__request_module);
191#endif /* CONFIG_MODULES */
192
193static void call_usermodehelper_freeinfo(struct subprocess_info *info)
194{
195 if (info->cleanup)
196 (*info->cleanup)(info);
197 kfree(info);
198}
199
200static void umh_complete(struct subprocess_info *sub_info)
201{
202 struct completion *comp = xchg(&sub_info->complete, NULL);
203 /*
204 * See call_usermodehelper_exec(). If xchg() returns NULL
205 * we own sub_info, the UMH_KILLABLE caller has gone away
206 * or the caller used UMH_NO_WAIT.
207 */
208 if (comp)
209 complete(comp);
210 else
211 call_usermodehelper_freeinfo(sub_info);
212}
213
214/*
215 * This is the task which runs the usermode application
216 */
217static int call_usermodehelper_exec_async(void *data)
218{
219 struct subprocess_info *sub_info = data;
220 struct cred *new;
221 int retval;
222
223 spin_lock_irq(&current->sighand->siglock);
224 flush_signal_handlers(current, 1);
225 spin_unlock_irq(&current->sighand->siglock);
226
227 /*
228 * Our parent (unbound workqueue) runs with elevated scheduling
229 * priority. Avoid propagating that into the userspace child.
230 */
231 set_user_nice(current, 0);
232
233 retval = -ENOMEM;
234 new = prepare_kernel_cred(current);
235 if (!new)
236 goto out;
237
238 spin_lock(&umh_sysctl_lock);
239 new->cap_bset = cap_intersect(usermodehelper_bset, new->cap_bset);
240 new->cap_inheritable = cap_intersect(usermodehelper_inheritable,
241 new->cap_inheritable);
242 spin_unlock(&umh_sysctl_lock);
243
244 if (sub_info->init) {
245 retval = sub_info->init(sub_info, new);
246 if (retval) {
247 abort_creds(new);
248 goto out;
249 }
250 }
251
252 commit_creds(new);
253
254 retval = do_execve(getname_kernel(sub_info->path),
255 (const char __user *const __user *)sub_info->argv,
256 (const char __user *const __user *)sub_info->envp);
257out:
258 sub_info->retval = retval;
259 /*
260 * call_usermodehelper_exec_sync() will call umh_complete
261 * if UHM_WAIT_PROC.
262 */
263 if (!(sub_info->wait & UMH_WAIT_PROC))
264 umh_complete(sub_info);
265 if (!retval)
266 return 0;
267 do_exit(0);
268}
269
270/* Handles UMH_WAIT_PROC. */
271static void call_usermodehelper_exec_sync(struct subprocess_info *sub_info)
272{
273 pid_t pid;
274
275 /* If SIGCLD is ignored sys_wait4 won't populate the status. */
276 kernel_sigaction(SIGCHLD, SIG_DFL);
277 pid = kernel_thread(call_usermodehelper_exec_async, sub_info, SIGCHLD);
278 if (pid < 0) {
279 sub_info->retval = pid;
280 } else {
281 int ret = -ECHILD;
282 /*
283 * Normally it is bogus to call wait4() from in-kernel because
284 * wait4() wants to write the exit code to a userspace address.
285 * But call_usermodehelper_exec_sync() always runs as kernel
286 * thread (workqueue) and put_user() to a kernel address works
287 * OK for kernel threads, due to their having an mm_segment_t
288 * which spans the entire address space.
289 *
290 * Thus the __user pointer cast is valid here.
291 */
292 sys_wait4(pid, (int __user *)&ret, 0, NULL);
293
294 /*
295 * If ret is 0, either call_usermodehelper_exec_async failed and
296 * the real error code is already in sub_info->retval or
297 * sub_info->retval is 0 anyway, so don't mess with it then.
298 */
299 if (ret)
300 sub_info->retval = ret;
301 }
302
303 /* Restore default kernel sig handler */
304 kernel_sigaction(SIGCHLD, SIG_IGN);
305
306 umh_complete(sub_info);
307}
308
309/*
310 * We need to create the usermodehelper kernel thread from a task that is affine
311 * to an optimized set of CPUs (or nohz housekeeping ones) such that they
312 * inherit a widest affinity irrespective of call_usermodehelper() callers with
313 * possibly reduced affinity (eg: per-cpu workqueues). We don't want
314 * usermodehelper targets to contend a busy CPU.
315 *
316 * Unbound workqueues provide such wide affinity and allow to block on
317 * UMH_WAIT_PROC requests without blocking pending request (up to some limit).
318 *
319 * Besides, workqueues provide the privilege level that caller might not have
320 * to perform the usermodehelper request.
321 *
322 */
323static void call_usermodehelper_exec_work(struct work_struct *work)
324{
325 struct subprocess_info *sub_info =
326 container_of(work, struct subprocess_info, work);
327
328 if (sub_info->wait & UMH_WAIT_PROC) {
329 call_usermodehelper_exec_sync(sub_info);
330 } else {
331 pid_t pid;
332 /*
333 * Use CLONE_PARENT to reparent it to kthreadd; we do not
334 * want to pollute current->children, and we need a parent
335 * that always ignores SIGCHLD to ensure auto-reaping.
336 */
337 pid = kernel_thread(call_usermodehelper_exec_async, sub_info,
338 CLONE_PARENT | SIGCHLD);
339 if (pid < 0) {
340 sub_info->retval = pid;
341 umh_complete(sub_info);
342 }
343 }
344}
345
346/*
347 * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY
348 * (used for preventing user land processes from being created after the user
349 * land has been frozen during a system-wide hibernation or suspend operation).
350 * Should always be manipulated under umhelper_sem acquired for write.
351 */
352static enum umh_disable_depth usermodehelper_disabled = UMH_DISABLED;
353
354/* Number of helpers running */
355static atomic_t running_helpers = ATOMIC_INIT(0);
356
357/*
358 * Wait queue head used by usermodehelper_disable() to wait for all running
359 * helpers to finish.
360 */
361static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq);
362
363/*
364 * Used by usermodehelper_read_lock_wait() to wait for usermodehelper_disabled
365 * to become 'false'.
366 */
367static DECLARE_WAIT_QUEUE_HEAD(usermodehelper_disabled_waitq);
368
369/*
370 * Time to wait for running_helpers to become zero before the setting of
371 * usermodehelper_disabled in usermodehelper_disable() fails
372 */
373#define RUNNING_HELPERS_TIMEOUT (5 * HZ)
374
375int usermodehelper_read_trylock(void)
376{
377 DEFINE_WAIT(wait);
378 int ret = 0;
379
380 down_read(&umhelper_sem);
381 for (;;) {
382 prepare_to_wait(&usermodehelper_disabled_waitq, &wait,
383 TASK_INTERRUPTIBLE);
384 if (!usermodehelper_disabled)
385 break;
386
387 if (usermodehelper_disabled == UMH_DISABLED)
388 ret = -EAGAIN;
389
390 up_read(&umhelper_sem);
391
392 if (ret)
393 break;
394
395 schedule();
396 try_to_freeze();
397
398 down_read(&umhelper_sem);
399 }
400 finish_wait(&usermodehelper_disabled_waitq, &wait);
401 return ret;
402}
403EXPORT_SYMBOL_GPL(usermodehelper_read_trylock);
404
405long usermodehelper_read_lock_wait(long timeout)
406{
407 DEFINE_WAIT(wait);
408
409 if (timeout < 0)
410 return -EINVAL;
411
412 down_read(&umhelper_sem);
413 for (;;) {
414 prepare_to_wait(&usermodehelper_disabled_waitq, &wait,
415 TASK_UNINTERRUPTIBLE);
416 if (!usermodehelper_disabled)
417 break;
418
419 up_read(&umhelper_sem);
420
421 timeout = schedule_timeout(timeout);
422 if (!timeout)
423 break;
424
425 down_read(&umhelper_sem);
426 }
427 finish_wait(&usermodehelper_disabled_waitq, &wait);
428 return timeout;
429}
430EXPORT_SYMBOL_GPL(usermodehelper_read_lock_wait);
431
432void usermodehelper_read_unlock(void)
433{
434 up_read(&umhelper_sem);
435}
436EXPORT_SYMBOL_GPL(usermodehelper_read_unlock);
437
438/**
439 * __usermodehelper_set_disable_depth - Modify usermodehelper_disabled.
440 * @depth: New value to assign to usermodehelper_disabled.
441 *
442 * Change the value of usermodehelper_disabled (under umhelper_sem locked for
443 * writing) and wakeup tasks waiting for it to change.
444 */
445void __usermodehelper_set_disable_depth(enum umh_disable_depth depth)
446{
447 down_write(&umhelper_sem);
448 usermodehelper_disabled = depth;
449 wake_up(&usermodehelper_disabled_waitq);
450 up_write(&umhelper_sem);
451}
452
453/**
454 * __usermodehelper_disable - Prevent new helpers from being started.
455 * @depth: New value to assign to usermodehelper_disabled.
456 *
457 * Set usermodehelper_disabled to @depth and wait for running helpers to exit.
458 */
459int __usermodehelper_disable(enum umh_disable_depth depth)
460{
461 long retval;
462
463 if (!depth)
464 return -EINVAL;
465
466 down_write(&umhelper_sem);
467 usermodehelper_disabled = depth;
468 up_write(&umhelper_sem);
469
470 /*
471 * From now on call_usermodehelper_exec() won't start any new
472 * helpers, so it is sufficient if running_helpers turns out to
473 * be zero at one point (it may be increased later, but that
474 * doesn't matter).
475 */
476 retval = wait_event_timeout(running_helpers_waitq,
477 atomic_read(&running_helpers) == 0,
478 RUNNING_HELPERS_TIMEOUT);
479 if (retval)
480 return 0;
481
482 __usermodehelper_set_disable_depth(UMH_ENABLED);
483 return -EAGAIN;
484}
485
486static void helper_lock(void)
487{
488 atomic_inc(&running_helpers);
489 smp_mb__after_atomic();
490}
491
492static void helper_unlock(void)
493{
494 if (atomic_dec_and_test(&running_helpers))
495 wake_up(&running_helpers_waitq);
496}
497
498/**
499 * call_usermodehelper_setup - prepare to call a usermode helper
500 * @path: path to usermode executable
501 * @argv: arg vector for process
502 * @envp: environment for process
503 * @gfp_mask: gfp mask for memory allocation
504 * @cleanup: a cleanup function
505 * @init: an init function
506 * @data: arbitrary context sensitive data
507 *
508 * Returns either %NULL on allocation failure, or a subprocess_info
509 * structure. This should be passed to call_usermodehelper_exec to
510 * exec the process and free the structure.
511 *
512 * The init function is used to customize the helper process prior to
513 * exec. A non-zero return code causes the process to error out, exit,
514 * and return the failure to the calling process
515 *
516 * The cleanup function is just before ethe subprocess_info is about to
517 * be freed. This can be used for freeing the argv and envp. The
518 * Function must be runnable in either a process context or the
519 * context in which call_usermodehelper_exec is called.
520 */
521struct subprocess_info *call_usermodehelper_setup(const char *path, char **argv,
522 char **envp, gfp_t gfp_mask,
523 int (*init)(struct subprocess_info *info, struct cred *new),
524 void (*cleanup)(struct subprocess_info *info),
525 void *data)
526{
527 struct subprocess_info *sub_info;
528 sub_info = kzalloc(sizeof(struct subprocess_info), gfp_mask);
529 if (!sub_info)
530 goto out;
531
532 INIT_WORK(&sub_info->work, call_usermodehelper_exec_work);
533
534#ifdef CONFIG_STATIC_USERMODEHELPER
535 sub_info->path = CONFIG_STATIC_USERMODEHELPER_PATH;
536#else
537 sub_info->path = path;
538#endif
539 sub_info->argv = argv;
540 sub_info->envp = envp;
541
542 sub_info->cleanup = cleanup;
543 sub_info->init = init;
544 sub_info->data = data;
545 out:
546 return sub_info;
547}
548EXPORT_SYMBOL(call_usermodehelper_setup);
549
550/**
551 * call_usermodehelper_exec - start a usermode application
552 * @sub_info: information about the subprocessa
553 * @wait: wait for the application to finish and return status.
554 * when UMH_NO_WAIT don't wait at all, but you get no useful error back
555 * when the program couldn't be exec'ed. This makes it safe to call
556 * from interrupt context.
557 *
558 * Runs a user-space application. The application is started
559 * asynchronously if wait is not set, and runs as a child of system workqueues.
560 * (ie. it runs with full root capabilities and optimized affinity).
561 */
562int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
563{
564 DECLARE_COMPLETION_ONSTACK(done);
565 int retval = 0;
566
567 if (!sub_info->path) {
568 call_usermodehelper_freeinfo(sub_info);
569 return -EINVAL;
570 }
571 helper_lock();
572 if (usermodehelper_disabled) {
573 retval = -EBUSY;
574 goto out;
575 }
576
577 /*
578 * If there is no binary for us to call, then just return and get out of
579 * here. This allows us to set STATIC_USERMODEHELPER_PATH to "" and
580 * disable all call_usermodehelper() calls.
581 */
582 if (strlen(sub_info->path) == 0)
583 goto out;
584
585 /*
586 * Set the completion pointer only if there is a waiter.
587 * This makes it possible to use umh_complete to free
588 * the data structure in case of UMH_NO_WAIT.
589 */
590 sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done;
591 sub_info->wait = wait;
592
593 queue_work(system_unbound_wq, &sub_info->work);
594 if (wait == UMH_NO_WAIT) /* task has freed sub_info */
595 goto unlock;
596
597 if (wait & UMH_KILLABLE) {
598 retval = wait_for_completion_killable(&done);
599 if (!retval)
600 goto wait_done;
601
602 /* umh_complete() will see NULL and free sub_info */
603 if (xchg(&sub_info->complete, NULL))
604 goto unlock;
605 /* fallthrough, umh_complete() was already called */
606 }
607
608 wait_for_completion(&done);
609wait_done:
610 retval = sub_info->retval;
611out:
612 call_usermodehelper_freeinfo(sub_info);
613unlock:
614 helper_unlock();
615 return retval;
616}
617EXPORT_SYMBOL(call_usermodehelper_exec);
618
619/**
620 * call_usermodehelper() - prepare and start a usermode application
621 * @path: path to usermode executable
622 * @argv: arg vector for process
623 * @envp: environment for process
624 * @wait: wait for the application to finish and return status.
625 * when UMH_NO_WAIT don't wait at all, but you get no useful error back
626 * when the program couldn't be exec'ed. This makes it safe to call
627 * from interrupt context.
628 *
629 * This function is the equivalent to use call_usermodehelper_setup() and
630 * call_usermodehelper_exec().
631 */
632int call_usermodehelper(const char *path, char **argv, char **envp, int wait)
633{
634 struct subprocess_info *info;
635 gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
636
637 info = call_usermodehelper_setup(path, argv, envp, gfp_mask,
638 NULL, NULL, NULL);
639 if (info == NULL)
640 return -ENOMEM;
641
642 return call_usermodehelper_exec(info, wait);
643}
644EXPORT_SYMBOL(call_usermodehelper);
645
646static int proc_cap_handler(struct ctl_table *table, int write,
647 void __user *buffer, size_t *lenp, loff_t *ppos)
648{
649 struct ctl_table t;
650 unsigned long cap_array[_KERNEL_CAPABILITY_U32S];
651 kernel_cap_t new_cap;
652 int err, i;
653
654 if (write && (!capable(CAP_SETPCAP) ||
655 !capable(CAP_SYS_MODULE)))
656 return -EPERM;
657
658 /*
659 * convert from the global kernel_cap_t to the ulong array to print to
660 * userspace if this is a read.
661 */
662 spin_lock(&umh_sysctl_lock);
663 for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++) {
664 if (table->data == CAP_BSET)
665 cap_array[i] = usermodehelper_bset.cap[i];
666 else if (table->data == CAP_PI)
667 cap_array[i] = usermodehelper_inheritable.cap[i];
668 else
669 BUG();
670 }
671 spin_unlock(&umh_sysctl_lock);
672
673 t = *table;
674 t.data = &cap_array;
675
676 /*
677 * actually read or write and array of ulongs from userspace. Remember
678 * these are least significant 32 bits first
679 */
680 err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos);
681 if (err < 0)
682 return err;
683
684 /*
685 * convert from the sysctl array of ulongs to the kernel_cap_t
686 * internal representation
687 */
688 for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++)
689 new_cap.cap[i] = cap_array[i];
690
691 /*
692 * Drop everything not in the new_cap (but don't add things)
693 */
694 spin_lock(&umh_sysctl_lock);
695 if (write) {
696 if (table->data == CAP_BSET)
697 usermodehelper_bset = cap_intersect(usermodehelper_bset, new_cap);
698 if (table->data == CAP_PI)
699 usermodehelper_inheritable = cap_intersect(usermodehelper_inheritable, new_cap);
700 }
701 spin_unlock(&umh_sysctl_lock);
702
703 return 0;
704}
705
706struct ctl_table usermodehelper_table[] = {
707 {
708 .procname = "bset",
709 .data = CAP_BSET,
710 .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long),
711 .mode = 0600,
712 .proc_handler = proc_cap_handler,
713 },
714 {
715 .procname = "inheritable",
716 .data = CAP_PI,
717 .maxlen = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long),
718 .mode = 0600,
719 .proc_handler = proc_cap_handler,
720 },
721 { }
722};