kernel/umh.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * umh - the kernel usermode helper
   4  */
   5 #include <linux/module.h>
   6 #include <linux/sched.h>
   7 #include <linux/sched/task.h>
   8 #include <linux/binfmts.h>
   9 #include <linux/syscalls.h>
  10 #include <linux/unistd.h>
  11 #include <linux/kmod.h>
  12 #include <linux/slab.h>
  13 #include <linux/completion.h>
  14 #include <linux/cred.h>
  15 #include <linux/file.h>
  16 #include <linux/fdtable.h>
  17 #include <linux/fs_struct.h>
  18 #include <linux/workqueue.h>
  19 #include <linux/security.h>
  20 #include <linux/mount.h>
  21 #include <linux/kernel.h>
  22 #include <linux/init.h>
  23 #include <linux/resource.h>
  24 #include <linux/notifier.h>
  25 #include <linux/suspend.h>
  26 #include <linux/rwsem.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/async.h>
  29 #include <linux/uaccess.h>
  30 #include <linux/initrd.h>
  31
  32 #include <trace/events/module.h>
  33
  34 #define CAP_BSET        (void *)1
  35 #define CAP_PI          (void *)2
  36
  37 static kernel_cap_t usermodehelper_bset = CAP_FULL_SET;
  38 static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET;
  39 static DEFINE_SPINLOCK(umh_sysctl_lock);
  40 static DECLARE_RWSEM(umhelper_sem);
  41
  42 static void call_usermodehelper_freeinfo(struct subprocess_info *info)
  43 {
  44         if (info->cleanup)
  45                 (*info->cleanup)(info);
  46         kfree(info);
  47 }
  48
  49 static void umh_complete(struct subprocess_info *sub_info)
  50 {
  51         struct completion *comp = xchg(&sub_info->complete, NULL);
  52         /*
  53          * See call_usermodehelper_exec(). If xchg() returns NULL
  54          * we own sub_info, the UMH_KILLABLE caller has gone away
  55          * or the caller used UMH_NO_WAIT.
  56          */
  57         if (comp)
  58                 complete(comp);
  59         else
  60                 call_usermodehelper_freeinfo(sub_info);
  61 }
  62
  63 /*
  64  * This is the task which runs the usermode application
  65  */
  66 static int call_usermodehelper_exec_async(void *data)
  67 {
  68         struct subprocess_info *sub_info = data;
  69         struct cred *new;
  70         int retval;
  71
  72         spin_lock_irq(&current->sighand->siglock);
  73         flush_signal_handlers(current, 1);
  74         spin_unlock_irq(&current->sighand->siglock);
  75
  76         /*
  77          * Initial kernel threads share ther FS with init, in order to
  78          * get the init root directory. But we've now created a new
  79          * thread that is going to execve a user process and has its own
  80          * 'struct fs_struct'. Reset umask to the default.
  81          */
  82         current->fs->umask = 0022;
  83
  84         /*
  85          * Our parent (unbound workqueue) runs with elevated scheduling
  86          * priority. Avoid propagating that into the userspace child.
  87          */
  88         set_user_nice(current, 0);
  89
  90         retval = -ENOMEM;
  91         new = prepare_kernel_cred(current);
  92         if (!new)
  93                 goto out;
  94
  95         spin_lock(&umh_sysctl_lock);
  96         new->cap_bset = cap_intersect(usermodehelper_bset, new->cap_bset);
  97         new->cap_inheritable = cap_intersect(usermodehelper_inheritable,
  98                                              new->cap_inheritable);
  99         spin_unlock(&umh_sysctl_lock);
 100
 101         if (sub_info->init) {
 102                 retval = sub_info->init(sub_info, new);
 103                 if (retval) {
 104                         abort_creds(new);
 105                         goto out;
 106                 }
 107         }
 108
 109         commit_creds(new);
 110
 111         wait_for_initramfs();
 112         retval = kernel_execve(sub_info->path,
 113                                (const char *const *)sub_info->argv,
 114                                (const char *const *)sub_info->envp);
 115 out:
 116         sub_info->retval = retval;
 117         /*
 118          * call_usermodehelper_exec_sync() will call umh_complete
 119          * if UHM_WAIT_PROC.
 120          */
 121         if (!(sub_info->wait & UMH_WAIT_PROC))
 122                 umh_complete(sub_info);
 123         if (!retval)
 124                 return 0;
 125         do_exit(0);
 126 }
 127
 128 /* Handles UMH_WAIT_PROC.  */
 129 static void call_usermodehelper_exec_sync(struct subprocess_info *sub_info)
 130 {
 131         pid_t pid;
 132
 133         /* If SIGCLD is ignored do_wait won't populate the status. */
 134         kernel_sigaction(SIGCHLD, SIG_DFL);
 135         pid = user_mode_thread(call_usermodehelper_exec_async, sub_info, SIGCHLD);
 136         if (pid < 0)
 137                 sub_info->retval = pid;
 138         else
 139                 kernel_wait(pid, &sub_info->retval);
 140
 141         /* Restore default kernel sig handler */
 142         kernel_sigaction(SIGCHLD, SIG_IGN);
 143         umh_complete(sub_info);
 144 }
 145
 146 /*
 147  * We need to create the usermodehelper kernel thread from a task that is affine
 148  * to an optimized set of CPUs (or nohz housekeeping ones) such that they
 149  * inherit a widest affinity irrespective of call_usermodehelper() callers with
 150  * possibly reduced affinity (eg: per-cpu workqueues). We don't want
 151  * usermodehelper targets to contend a busy CPU.
 152  *
 153  * Unbound workqueues provide such wide affinity and allow to block on
 154  * UMH_WAIT_PROC requests without blocking pending request (up to some limit).
 155  *
 156  * Besides, workqueues provide the privilege level that caller might not have
 157  * to perform the usermodehelper request.
 158  *
 159  */
 160 static void call_usermodehelper_exec_work(struct work_struct *work)
 161 {
 162         struct subprocess_info *sub_info =
 163                 container_of(work, struct subprocess_info, work);
 164
 165         if (sub_info->wait & UMH_WAIT_PROC) {
 166                 call_usermodehelper_exec_sync(sub_info);
 167         } else {
 168                 pid_t pid;
 169                 /*
 170                  * Use CLONE_PARENT to reparent it to kthreadd; we do not
 171                  * want to pollute current->children, and we need a parent
 172                  * that always ignores SIGCHLD to ensure auto-reaping.
 173                  */
 174                 pid = user_mode_thread(call_usermodehelper_exec_async, sub_info,
 175                                        CLONE_PARENT | SIGCHLD);
 176                 if (pid < 0) {
 177                         sub_info->retval = pid;
 178                         umh_complete(sub_info);
 179                 }
 180         }
 181 }
 182
 183 /*
 184  * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY
 185  * (used for preventing user land processes from being created after the user
 186  * land has been frozen during a system-wide hibernation or suspend operation).
 187  * Should always be manipulated under umhelper_sem acquired for write.
 188  */
 189 static enum umh_disable_depth usermodehelper_disabled = UMH_DISABLED;
 190
 191 /* Number of helpers running */
 192 static atomic_t running_helpers = ATOMIC_INIT(0);
 193
 194 /*
 195  * Wait queue head used by usermodehelper_disable() to wait for all running
 196  * helpers to finish.
 197  */
 198 static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq);
 199
 200 /*
 201  * Used by usermodehelper_read_lock_wait() to wait for usermodehelper_disabled
 202  * to become 'false'.
 203  */
 204 static DECLARE_WAIT_QUEUE_HEAD(usermodehelper_disabled_waitq);
 205
 206 /*
 207  * Time to wait for running_helpers to become zero before the setting of
 208  * usermodehelper_disabled in usermodehelper_disable() fails
 209  */
 210 #define RUNNING_HELPERS_TIMEOUT (5 * HZ)
 211
 212 int usermodehelper_read_trylock(void)
 213 {
 214         DEFINE_WAIT(wait);
 215         int ret = 0;
 216
 217         down_read(&umhelper_sem);
 218         for (;;) {
 219                 prepare_to_wait(&usermodehelper_disabled_waitq, &wait,
 220                                 TASK_INTERRUPTIBLE);
 221                 if (!usermodehelper_disabled)
 222                         break;
 223
 224                 if (usermodehelper_disabled == UMH_DISABLED)
 225                         ret = -EAGAIN;
 226
 227                 up_read(&umhelper_sem);
 228
 229                 if (ret)
 230                         break;
 231
 232                 schedule();
 233                 try_to_freeze();
 234
 235                 down_read(&umhelper_sem);
 236         }
 237         finish_wait(&usermodehelper_disabled_waitq, &wait);
 238         return ret;
 239 }
 240 EXPORT_SYMBOL_GPL(usermodehelper_read_trylock);
 241
 242 long usermodehelper_read_lock_wait(long timeout)
 243 {
 244         DEFINE_WAIT(wait);
 245
 246         if (timeout < 0)
 247                 return -EINVAL;
 248
 249         down_read(&umhelper_sem);
 250         for (;;) {
 251                 prepare_to_wait(&usermodehelper_disabled_waitq, &wait,
 252                                 TASK_UNINTERRUPTIBLE);
 253                 if (!usermodehelper_disabled)
 254                         break;
 255
 256                 up_read(&umhelper_sem);
 257
 258                 timeout = schedule_timeout(timeout);
 259                 if (!timeout)
 260                         break;
 261
 262                 down_read(&umhelper_sem);
 263         }
 264         finish_wait(&usermodehelper_disabled_waitq, &wait);
 265         return timeout;
 266 }
 267 EXPORT_SYMBOL_GPL(usermodehelper_read_lock_wait);
 268
 269 void usermodehelper_read_unlock(void)
 270 {
 271         up_read(&umhelper_sem);
 272 }
 273 EXPORT_SYMBOL_GPL(usermodehelper_read_unlock);
 274
 275 /**
 276  * __usermodehelper_set_disable_depth - Modify usermodehelper_disabled.
 277  * @depth: New value to assign to usermodehelper_disabled.
 278  *
 279  * Change the value of usermodehelper_disabled (under umhelper_sem locked for
 280  * writing) and wakeup tasks waiting for it to change.
 281  */
 282 void __usermodehelper_set_disable_depth(enum umh_disable_depth depth)
 283 {
 284         down_write(&umhelper_sem);
 285         usermodehelper_disabled = depth;
 286         wake_up(&usermodehelper_disabled_waitq);
 287         up_write(&umhelper_sem);
 288 }
 289
 290 /**
 291  * __usermodehelper_disable - Prevent new helpers from being started.
 292  * @depth: New value to assign to usermodehelper_disabled.
 293  *
 294  * Set usermodehelper_disabled to @depth and wait for running helpers to exit.
 295  */
 296 int __usermodehelper_disable(enum umh_disable_depth depth)
 297 {
 298         long retval;
 299
 300         if (!depth)
 301                 return -EINVAL;
 302
 303         down_write(&umhelper_sem);
 304         usermodehelper_disabled = depth;
 305         up_write(&umhelper_sem);
 306
 307         /*
 308          * From now on call_usermodehelper_exec() won't start any new
 309          * helpers, so it is sufficient if running_helpers turns out to
 310          * be zero at one point (it may be increased later, but that
 311          * doesn't matter).
 312          */
 313         retval = wait_event_timeout(running_helpers_waitq,
 314                                         atomic_read(&running_helpers) == 0,
 315                                         RUNNING_HELPERS_TIMEOUT);
 316         if (retval)
 317                 return 0;
 318
 319         __usermodehelper_set_disable_depth(UMH_ENABLED);
 320         return -EAGAIN;
 321 }
 322
 323 static void helper_lock(void)
 324 {
 325         atomic_inc(&running_helpers);
 326         smp_mb__after_atomic();
 327 }
 328
 329 static void helper_unlock(void)
 330 {
 331         if (atomic_dec_and_test(&running_helpers))
 332                 wake_up(&running_helpers_waitq);
 333 }
 334
 335 /**
 336  * call_usermodehelper_setup - prepare to call a usermode helper
 337  * @path: path to usermode executable
 338  * @argv: arg vector for process
 339  * @envp: environment for process
 340  * @gfp_mask: gfp mask for memory allocation
 341  * @init: an init function
 342  * @cleanup: a cleanup function
 343  * @data: arbitrary context sensitive data
 344  *
 345  * Returns either %NULL on allocation failure, or a subprocess_info
 346  * structure.  This should be passed to call_usermodehelper_exec to
 347  * exec the process and free the structure.
 348  *
 349  * The init function is used to customize the helper process prior to
 350  * exec.  A non-zero return code causes the process to error out, exit,
 351  * and return the failure to the calling process
 352  *
 353  * The cleanup function is just before the subprocess_info is about to
 354  * be freed.  This can be used for freeing the argv and envp.  The
 355  * Function must be runnable in either a process context or the
 356  * context in which call_usermodehelper_exec is called.
 357  */
 358 struct subprocess_info *call_usermodehelper_setup(const char *path, char **argv,
 359                 char **envp, gfp_t gfp_mask,
 360                 int (*init)(struct subprocess_info *info, struct cred *new),
 361                 void (*cleanup)(struct subprocess_info *info),
 362                 void *data)
 363 {
 364         struct subprocess_info *sub_info;
 365         sub_info = kzalloc(sizeof(struct subprocess_info), gfp_mask);
 366         if (!sub_info)
 367                 goto out;
 368
 369         INIT_WORK(&sub_info->work, call_usermodehelper_exec_work);
 370
 371 #ifdef CONFIG_STATIC_USERMODEHELPER
 372         sub_info->path = CONFIG_STATIC_USERMODEHELPER_PATH;
 373 #else
 374         sub_info->path = path;
 375 #endif
 376         sub_info->argv = argv;
 377         sub_info->envp = envp;
 378
 379         sub_info->cleanup = cleanup;
 380         sub_info->init = init;
 381         sub_info->data = data;
 382   out:
 383         return sub_info;
 384 }
 385 EXPORT_SYMBOL(call_usermodehelper_setup);
 386
 387 /**
 388  * call_usermodehelper_exec - start a usermode application
 389  * @sub_info: information about the subprocess
 390  * @wait: wait for the application to finish and return status.
 391  *        when UMH_NO_WAIT don't wait at all, but you get no useful error back
 392  *        when the program couldn't be exec'ed. This makes it safe to call
 393  *        from interrupt context.
 394  *
 395  * Runs a user-space application.  The application is started
 396  * asynchronously if wait is not set, and runs as a child of system workqueues.
 397  * (ie. it runs with full root capabilities and optimized affinity).
 398  *
 399  * Note: successful return value does not guarantee the helper was called at
 400  * all. You can't rely on sub_info->{init,cleanup} being called even for
 401  * UMH_WAIT_* wait modes as STATIC_USERMODEHELPER_PATH="" turns all helpers
 402  * into a successful no-op.
 403  */
 404 int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
 405 {
 406         DECLARE_COMPLETION_ONSTACK(done);
 407         int retval = 0;
 408
 409         if (!sub_info->path) {
 410                 call_usermodehelper_freeinfo(sub_info);
 411                 return -EINVAL;
 412         }
 413         helper_lock();
 414         if (usermodehelper_disabled) {
 415                 retval = -EBUSY;
 416                 goto out;
 417         }
 418
 419         /*
 420          * If there is no binary for us to call, then just return and get out of
 421          * here.  This allows us to set STATIC_USERMODEHELPER_PATH to "" and
 422          * disable all call_usermodehelper() calls.
 423          */
 424         if (strlen(sub_info->path) == 0)
 425                 goto out;
 426
 427         /*
 428          * Set the completion pointer only if there is a waiter.
 429          * This makes it possible to use umh_complete to free
 430          * the data structure in case of UMH_NO_WAIT.
 431          */
 432         sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done;
 433         sub_info->wait = wait;
 434
 435         queue_work(system_unbound_wq, &sub_info->work);
 436         if (wait == UMH_NO_WAIT)        /* task has freed sub_info */
 437                 goto unlock;
 438
 439         if (wait & UMH_KILLABLE) {
 440                 retval = wait_for_completion_killable(&done);
 441                 if (!retval)
 442                         goto wait_done;
 443
 444                 /* umh_complete() will see NULL and free sub_info */
 445                 if (xchg(&sub_info->complete, NULL))
 446                         goto unlock;
 447                 /* fallthrough, umh_complete() was already called */
 448         }
 449
 450         wait_for_completion(&done);
 451 wait_done:
 452         retval = sub_info->retval;
 453 out:
 454         call_usermodehelper_freeinfo(sub_info);
 455 unlock:
 456         helper_unlock();
 457         return retval;
 458 }
 459 EXPORT_SYMBOL(call_usermodehelper_exec);
 460
 461 /**
 462  * call_usermodehelper() - prepare and start a usermode application
 463  * @path: path to usermode executable
 464  * @argv: arg vector for process
 465  * @envp: environment for process
 466  * @wait: wait for the application to finish and return status.
 467  *        when UMH_NO_WAIT don't wait at all, but you get no useful error back
 468  *        when the program couldn't be exec'ed. This makes it safe to call
 469  *        from interrupt context.
 470  *
 471  * This function is the equivalent to use call_usermodehelper_setup() and
 472  * call_usermodehelper_exec().
 473  */
 474 int call_usermodehelper(const char *path, char **argv, char **envp, int wait)
 475 {
 476         struct subprocess_info *info;
 477         gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
 478
 479         info = call_usermodehelper_setup(path, argv, envp, gfp_mask,
 480                                          NULL, NULL, NULL);
 481         if (info == NULL)
 482                 return -ENOMEM;
 483
 484         return call_usermodehelper_exec(info, wait);
 485 }
 486 EXPORT_SYMBOL(call_usermodehelper);
 487
 488 static int proc_cap_handler(struct ctl_table *table, int write,
 489                          void *buffer, size_t *lenp, loff_t *ppos)
 490 {
 491         struct ctl_table t;
 492         unsigned long cap_array[_KERNEL_CAPABILITY_U32S];
 493         kernel_cap_t new_cap;
 494         int err, i;
 495
 496         if (write && (!capable(CAP_SETPCAP) ||
 497                       !capable(CAP_SYS_MODULE)))
 498                 return -EPERM;
 499
 500         /*
 501          * convert from the global kernel_cap_t to the ulong array to print to
 502          * userspace if this is a read.
 503          */
 504         spin_lock(&umh_sysctl_lock);
 505         for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++)  {
 506                 if (table->data == CAP_BSET)
 507                         cap_array[i] = usermodehelper_bset.cap[i];
 508                 else if (table->data == CAP_PI)
 509                         cap_array[i] = usermodehelper_inheritable.cap[i];
 510                 else
 511                         BUG();
 512         }
 513         spin_unlock(&umh_sysctl_lock);
 514
 515         t = *table;
 516         t.data = &cap_array;
 517
 518         /*
 519          * actually read or write and array of ulongs from userspace.  Remember
 520          * these are least significant 32 bits first
 521          */
 522         err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos);
 523         if (err < 0)
 524                 return err;
 525
 526         /*
 527          * convert from the sysctl array of ulongs to the kernel_cap_t
 528          * internal representation
 529          */
 530         for (i = 0; i < _KERNEL_CAPABILITY_U32S; i++)
 531                 new_cap.cap[i] = cap_array[i];
 532
 533         /*
 534          * Drop everything not in the new_cap (but don't add things)
 535          */
 536         if (write) {
 537                 spin_lock(&umh_sysctl_lock);
 538                 if (table->data == CAP_BSET)
 539                         usermodehelper_bset = cap_intersect(usermodehelper_bset, new_cap);
 540                 if (table->data == CAP_PI)
 541                         usermodehelper_inheritable = cap_intersect(usermodehelper_inheritable, new_cap);
 542                 spin_unlock(&umh_sysctl_lock);
 543         }
 544
 545         return 0;
 546 }
 547
 548 struct ctl_table usermodehelper_table[] = {
 549         {
 550                 .procname       = "bset",
 551                 .data           = CAP_BSET,
 552                 .maxlen         = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long),
 553                 .mode           = 0600,
 554                 .proc_handler   = proc_cap_handler,
 555         },
 556         {
 557                 .procname       = "inheritable",
 558                 .data           = CAP_PI,
 559                 .maxlen         = _KERNEL_CAPABILITY_U32S * sizeof(unsigned long),
 560                 .mode           = 0600,
 561                 .proc_handler   = proc_cap_handler,
 562         },
 563         { }
 564 };