No fallback to /bin/sh in execvp

No fallback to /bin/sh in execvp

[Siebenborn, Axel]

Hi,

I encountered a problem with execvp with musl.
Trying to execute shell scripts without #! fails with ENOEXEC.
However, according to the standard, execvp should fallback to execute the file using /bin/sh.

A simple test:

Create a  script file 'prog'  without '!#' with the following content and make it executable:

/bin/echo "$@" 

Compile and run the following c-program:

#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

int main (){
  int ret;
  char *cmd[] = { "./prog","Hello", "World", (char *)0 };
  ret = execvp ("./prog", cmd);
  int errorNumber = errno;
  printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber));
}

With musl the execution results in the following error:

Error code: 8. Error message: Exec format error

With glibs 'Hello world' is printed.

Is this a bug, that will be fixed someday or intended behavior for security reasons.

I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this 
and compatibility wins over sanity,

Kind regards,
Axel

Re: No fallback to /bin/sh in execvp

[Rich Felker]

On Fri, Mar 09, 2018 at 12:23:06PM +0000, Siebenborn, Axel wrote:
> Hi,
> 
> I encountered a problem with execvp with musl.
> Trying to execute shell scripts without #! fails with ENOEXEC.
> However, according to the standard, execvp should fallback to execute the file using /bin/sh.
> 
> A simple test:
> 
> Create a  script file 'prog'  without '!#' with the following content and make it executable:
> 
> /bin/echo "$@" 
> 
> Compile and run the following c-program:
> 
> #include <unistd.h>
> #include <stdio.h>
> #include <string.h>
> #include <errno.h>
> 
> int main (){
>   int ret;
>   char *cmd[] = { "./prog","Hello", "World", (char *)0 };
>   ret = execvp ("./prog", cmd);
>   int errorNumber = errno;
>   printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber));
> }
> 
> With musl the execution results in the following error:
> 
> Error code: 8. Error message: Exec format error
> 
> With glibs 'Hello world' is printed.
> 
> Is this a bug, that will be fixed someday or intended behavior for security reasons.
> 
> I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this 
> and compatibility wins over sanity,

It's a bug, but one that was considered low priority since real-world
usage is for scripts to start with #!, in which case the kernel
handles invocation. Actually doing what the standard requires here
seems hard since we'd need to allocate storage for the new argv...

Rich

[PATCH] Continue trying execution with "/bin/sh" for execlp and execvp

[Quentin Rameau]

As Rick stated, this isn't a clean solution because argv can be
arbirtary long and overflow the stack.

I post it here in case you'd find it useful anyway.

---8<---

---
 src/process/execlp.c | 10 +++++++++-
 src/process/execsh.c | 18 ++++++++++++++++++
 src/process/execvp.c |  8 +++++++-
 3 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 src/process/execsh.c

diff --git a/src/process/execlp.c b/src/process/execlp.c
index 5eed886e..f6da398b 100644
--- a/src/process/execlp.c
+++ b/src/process/execlp.c
@@ -1,6 +1,9 @@
 #include <unistd.h>
+#include <errno.h>
 #include <stdarg.h>
 
+extern int __execsh(const char *, char *const []);
+
 int execlp(const char *file, const char *argv0, ...)
 {
 	int argc;
@@ -17,6 +20,11 @@ int execlp(const char *file, const char *argv0, ...)
 			argv[i] = va_arg(ap, char *);
 		argv[i] = NULL;
 		va_end(ap);
-		return execvp(file, argv);
+		execvp(file, argv);
+		if (errno == ENOEXEC) {
+			errno = 0;
+			return __execsh(file, argv);
+		}
+		return -1;
 	}
 }
diff --git a/src/process/execsh.c b/src/process/execsh.c
new file mode 100644
index 00000000..180bb2aa
--- /dev/null
+++ b/src/process/execsh.c
@@ -0,0 +1,18 @@
+#include <unistd.h>
+#include <errno.h>
+#include "libc.h"
+
+int
+__execsh(const char *file, char *const argv[])
+{
+	int i, argc;
+	char **p;
+
+	for (argc=1, p=(char **)argv; *p; ++argc, ++p);
+
+	char *nargv[argc+1];
+	nargv[0] = (char *)file;
+	for (i=0; i<argc; ++i)
+		nargv[i+1] = argv[i];
+	return execv("/bin/sh", nargv);
+}
diff --git a/src/process/execvp.c b/src/process/execvp.c
index 2dddeddb..fdd0ca48 100644
--- a/src/process/execvp.c
+++ b/src/process/execvp.c
@@ -6,6 +6,7 @@
 #include "libc.h"
 
 extern char **__environ;
+extern int __execsh(const char *, char *const []);
 
 int __execvpe(const char *file, char *const argv[], char *const envp[])
 {
@@ -56,7 +57,12 @@ int __execvpe(const char *file, char *const argv[], char *const envp[])
 
 int execvp(const char *file, char *const argv[])
 {
-	return __execvpe(file, argv, __environ);
+	__execvpe(file, argv, __environ);
+	if (errno == ENOEXEC) {
+		errno = 0;
+		return __execsh(file, argv);
+	}
+	return -1;
 }
 
 weak_alias(__execvpe, execvpe);
-- 
2.16.2