* No fallback to /bin/sh in execvp @ 2018-03-09 12:23 Siebenborn, Axel 2018-03-09 17:01 ` Rich Felker 0 siblings, 1 reply; 3+ messages in thread From: Siebenborn, Axel @ 2018-03-09 12:23 UTC (permalink / raw) To: musl Hi, I encountered a problem with execvp with musl. Trying to execute shell scripts without #! fails with ENOEXEC. However, according to the standard, execvp should fallback to execute the file using /bin/sh. A simple test: Create a script file 'prog' without '!#' with the following content and make it executable: /bin/echo "$@" Compile and run the following c-program: #include <unistd.h> #include <stdio.h> #include <string.h> #include <errno.h> int main (){ int ret; char *cmd[] = { "./prog","Hello", "World", (char *)0 }; ret = execvp ("./prog", cmd); int errorNumber = errno; printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber)); } With musl the execution results in the following error: Error code: 8. Error message: Exec format error With glibs 'Hello world' is printed. Is this a bug, that will be fixed someday or intended behavior for security reasons. I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this and compatibility wins over sanity, Kind regards, Axel ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: No fallback to /bin/sh in execvp 2018-03-09 12:23 No fallback to /bin/sh in execvp Siebenborn, Axel @ 2018-03-09 17:01 ` Rich Felker 2018-03-11 13:47 ` [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp Quentin Rameau 0 siblings, 1 reply; 3+ messages in thread From: Rich Felker @ 2018-03-09 17:01 UTC (permalink / raw) To: musl On Fri, Mar 09, 2018 at 12:23:06PM +0000, Siebenborn, Axel wrote: > Hi, > > I encountered a problem with execvp with musl. > Trying to execute shell scripts without #! fails with ENOEXEC. > However, according to the standard, execvp should fallback to execute the file using /bin/sh. > > A simple test: > > Create a script file 'prog' without '!#' with the following content and make it executable: > > /bin/echo "$@" > > Compile and run the following c-program: > > #include <unistd.h> > #include <stdio.h> > #include <string.h> > #include <errno.h> > > int main (){ > int ret; > char *cmd[] = { "./prog","Hello", "World", (char *)0 }; > ret = execvp ("./prog", cmd); > int errorNumber = errno; > printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber)); > } > > With musl the execution results in the following error: > > Error code: 8. Error message: Exec format error > > With glibs 'Hello world' is printed. > > Is this a bug, that will be fixed someday or intended behavior for security reasons. > > I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this > and compatibility wins over sanity, It's a bug, but one that was considered low priority since real-world usage is for scripts to start with #!, in which case the kernel handles invocation. Actually doing what the standard requires here seems hard since we'd need to allocate storage for the new argv... Rich ^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp 2018-03-09 17:01 ` Rich Felker @ 2018-03-11 13:47 ` Quentin Rameau 0 siblings, 0 replies; 3+ messages in thread From: Quentin Rameau @ 2018-03-11 13:47 UTC (permalink / raw) To: musl As Rick stated, this isn't a clean solution because argv can be arbirtary long and overflow the stack. I post it here in case you'd find it useful anyway. ---8<--- --- src/process/execlp.c | 10 +++++++++- src/process/execsh.c | 18 ++++++++++++++++++ src/process/execvp.c | 8 +++++++- 3 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 src/process/execsh.c diff --git a/src/process/execlp.c b/src/process/execlp.c index 5eed886e..f6da398b 100644 --- a/src/process/execlp.c +++ b/src/process/execlp.c @@ -1,6 +1,9 @@ #include <unistd.h> +#include <errno.h> #include <stdarg.h> +extern int __execsh(const char *, char *const []); + int execlp(const char *file, const char *argv0, ...) { int argc; @@ -17,6 +20,11 @@ int execlp(const char *file, const char *argv0, ...) argv[i] = va_arg(ap, char *); argv[i] = NULL; va_end(ap); - return execvp(file, argv); + execvp(file, argv); + if (errno == ENOEXEC) { + errno = 0; + return __execsh(file, argv); + } + return -1; } } diff --git a/src/process/execsh.c b/src/process/execsh.c new file mode 100644 index 00000000..180bb2aa --- /dev/null +++ b/src/process/execsh.c @@ -0,0 +1,18 @@ +#include <unistd.h> +#include <errno.h> +#include "libc.h" + +int +__execsh(const char *file, char *const argv[]) +{ + int i, argc; + char **p; + + for (argc=1, p=(char **)argv; *p; ++argc, ++p); + + char *nargv[argc+1]; + nargv[0] = (char *)file; + for (i=0; i<argc; ++i) + nargv[i+1] = argv[i]; + return execv("/bin/sh", nargv); +} diff --git a/src/process/execvp.c b/src/process/execvp.c index 2dddeddb..fdd0ca48 100644 --- a/src/process/execvp.c +++ b/src/process/execvp.c @@ -6,6 +6,7 @@ #include "libc.h" extern char **__environ; +extern int __execsh(const char *, char *const []); int __execvpe(const char *file, char *const argv[], char *const envp[]) { @@ -56,7 +57,12 @@ int __execvpe(const char *file, char *const argv[], char *const envp[]) int execvp(const char *file, char *const argv[]) { - return __execvpe(file, argv, __environ); + __execvpe(file, argv, __environ); + if (errno == ENOEXEC) { + errno = 0; + return __execsh(file, argv); + } + return -1; } weak_alias(__execvpe, execvpe); -- 2.16.2 ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-03-11 13:47 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-03-09 12:23 No fallback to /bin/sh in execvp Siebenborn, Axel 2018-03-09 17:01 ` Rich Felker 2018-03-11 13:47 ` [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp Quentin Rameau
Code repositories for project(s) associated with this public inbox https://git.vuxu.org/mirror/musl/ This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).