* No fallback to /bin/sh in execvp
@ 2018-03-09 12:23 Siebenborn, Axel
2018-03-09 17:01 ` Rich Felker
0 siblings, 1 reply; 3+ messages in thread
From: Siebenborn, Axel @ 2018-03-09 12:23 UTC (permalink / raw)
To: musl
Hi,
I encountered a problem with execvp with musl.
Trying to execute shell scripts without #! fails with ENOEXEC.
However, according to the standard, execvp should fallback to execute the file using /bin/sh.
A simple test:
Create a script file 'prog' without '!#' with the following content and make it executable:
/bin/echo "$@"
Compile and run the following c-program:
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
int main (){
int ret;
char *cmd[] = { "./prog","Hello", "World", (char *)0 };
ret = execvp ("./prog", cmd);
int errorNumber = errno;
printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber));
}
With musl the execution results in the following error:
Error code: 8. Error message: Exec format error
With glibs 'Hello world' is printed.
Is this a bug, that will be fixed someday or intended behavior for security reasons.
I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this
and compatibility wins over sanity,
Kind regards,
Axel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: No fallback to /bin/sh in execvp
2018-03-09 12:23 No fallback to /bin/sh in execvp Siebenborn, Axel
@ 2018-03-09 17:01 ` Rich Felker
2018-03-11 13:47 ` [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp Quentin Rameau
0 siblings, 1 reply; 3+ messages in thread
From: Rich Felker @ 2018-03-09 17:01 UTC (permalink / raw)
To: musl
On Fri, Mar 09, 2018 at 12:23:06PM +0000, Siebenborn, Axel wrote:
> Hi,
>
> I encountered a problem with execvp with musl.
> Trying to execute shell scripts without #! fails with ENOEXEC.
> However, according to the standard, execvp should fallback to execute the file using /bin/sh.
>
> A simple test:
>
> Create a script file 'prog' without '!#' with the following content and make it executable:
>
> /bin/echo "$@"
>
> Compile and run the following c-program:
>
> #include <unistd.h>
> #include <stdio.h>
> #include <string.h>
> #include <errno.h>
>
> int main (){
> int ret;
> char *cmd[] = { "./prog","Hello", "World", (char *)0 };
> ret = execvp ("./prog", cmd);
> int errorNumber = errno;
> printf("Error code: %d. Error message: %s\n", errorNumber, strerror(errorNumber));
> }
>
> With musl the execution results in the following error:
>
> Error code: 8. Error message: Exec format error
>
> With glibs 'Hello world' is printed.
>
> Is this a bug, that will be fixed someday or intended behavior for security reasons.
>
> I think it's a quiet a strange way to execute shell commands. However, some ancient code might rely on this
> and compatibility wins over sanity,
It's a bug, but one that was considered low priority since real-world
usage is for scripts to start with #!, in which case the kernel
handles invocation. Actually doing what the standard requires here
seems hard since we'd need to allocate storage for the new argv...
Rich
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp
2018-03-09 17:01 ` Rich Felker
@ 2018-03-11 13:47 ` Quentin Rameau
0 siblings, 0 replies; 3+ messages in thread
From: Quentin Rameau @ 2018-03-11 13:47 UTC (permalink / raw)
To: musl
As Rick stated, this isn't a clean solution because argv can be
arbirtary long and overflow the stack.
I post it here in case you'd find it useful anyway.
---8<---
---
src/process/execlp.c | 10 +++++++++-
src/process/execsh.c | 18 ++++++++++++++++++
src/process/execvp.c | 8 +++++++-
3 files changed, 34 insertions(+), 2 deletions(-)
create mode 100644 src/process/execsh.c
diff --git a/src/process/execlp.c b/src/process/execlp.c
index 5eed886e..f6da398b 100644
--- a/src/process/execlp.c
+++ b/src/process/execlp.c
@@ -1,6 +1,9 @@
#include <unistd.h>
+#include <errno.h>
#include <stdarg.h>
+extern int __execsh(const char *, char *const []);
+
int execlp(const char *file, const char *argv0, ...)
{
int argc;
@@ -17,6 +20,11 @@ int execlp(const char *file, const char *argv0, ...)
argv[i] = va_arg(ap, char *);
argv[i] = NULL;
va_end(ap);
- return execvp(file, argv);
+ execvp(file, argv);
+ if (errno == ENOEXEC) {
+ errno = 0;
+ return __execsh(file, argv);
+ }
+ return -1;
}
}
diff --git a/src/process/execsh.c b/src/process/execsh.c
new file mode 100644
index 00000000..180bb2aa
--- /dev/null
+++ b/src/process/execsh.c
@@ -0,0 +1,18 @@
+#include <unistd.h>
+#include <errno.h>
+#include "libc.h"
+
+int
+__execsh(const char *file, char *const argv[])
+{
+ int i, argc;
+ char **p;
+
+ for (argc=1, p=(char **)argv; *p; ++argc, ++p);
+
+ char *nargv[argc+1];
+ nargv[0] = (char *)file;
+ for (i=0; i<argc; ++i)
+ nargv[i+1] = argv[i];
+ return execv("/bin/sh", nargv);
+}
diff --git a/src/process/execvp.c b/src/process/execvp.c
index 2dddeddb..fdd0ca48 100644
--- a/src/process/execvp.c
+++ b/src/process/execvp.c
@@ -6,6 +6,7 @@
#include "libc.h"
extern char **__environ;
+extern int __execsh(const char *, char *const []);
int __execvpe(const char *file, char *const argv[], char *const envp[])
{
@@ -56,7 +57,12 @@ int __execvpe(const char *file, char *const argv[], char *const envp[])
int execvp(const char *file, char *const argv[])
{
- return __execvpe(file, argv, __environ);
+ __execvpe(file, argv, __environ);
+ if (errno == ENOEXEC) {
+ errno = 0;
+ return __execsh(file, argv);
+ }
+ return -1;
}
weak_alias(__execvpe, execvpe);
--
2.16.2
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-03-11 13:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-09 12:23 No fallback to /bin/sh in execvp Siebenborn, Axel
2018-03-09 17:01 ` Rich Felker
2018-03-11 13:47 ` [PATCH] Continue trying execution with "/bin/sh" for execlp and execvp Quentin Rameau
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).