Re: [PATCH] Linux: Add execveat system call wrapper

[Florian Weimer via Libc-alpha <libc-alpha@sourceware.org>]

So it turns out that openat and execveat have totally different flags
arguments, and translation is needed.

The execveat manual page says this:

       AT_EMPTY_PATH
              If  pathname is an empty string, operate on the file referred to
              by dirfd (which may have been obtained using the open(2)  O_PATH
              flag).

       AT_SYMLINK_NOFOLLOW
              If  the  file  identified  by dirfd and a non-NULL pathname is a
              symbolic link, then the call fails with the error ELOOP.

fs/exec.c in the kernel sources handles flags in the do_open_execat
function:

	if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
		return ERR_PTR(-EINVAL);
	if (flags & AT_SYMLINK_NOFOLLOW)
		open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
	if (flags & AT_EMPTY_PATH)
		open_exec_flags.lookup_flags |= LOOKUP_EMPTY;

	file = do_filp_open(fd, name, &open_exec_flags);

So the manual page is correct and there are only two flags to support.

So I think we have to do this:

* If there are more flags than just the two, fail with EINVAL.

* To handle AT_EMPTY_PATH, do not open a new file descriptor (using
  openat) if AT_EMPTY_PATH is specified *and* the file name is "".

* To handle AT_SYMLINK_NOFOLLOW, openat needs to be called with
  O_NOFOLLOW in that case (in addition to O_CLOEXEC).

The behavior with AT_EMPTY_PATH/"" and AT_SYMLINK_NOFOLLOW at the same
time is not immedately obvious from the kernel code, so I wrote a small
test program (/bin/sh is a symbolic link to /bin/bash on this system):

#include <err.h>
#include <fcntl.h>
#include <sys/syscall.h>
#include <unistd.h>

int
main (void)
{
  int fd = open ("/bin/sh", O_PATH | O_NOFOLLOW);
  if (fd < 0)
    err (1, "open");
  static char *const argv[] = { "sh", "-c", "exit 0", NULL };
  static char *const envp[] = { NULL };
  syscall (SYS_execveat, fd, "", argv, envp,
           AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW);
  err (1, "execveat");
}

This fails:

openat(AT_FDCWD, "/bin/sh", O_RDONLY|O_NOFOLLOW|O_PATH) = 3
execveat(3, "", ["sh", "-c", "exit 0"], 0x402040 /* 0 vars */, AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 ELOOP (Too many levels of symbolic links)
[…]
execveat-opath-symlink: execveat: Too many levels of symbolic links

So I think for the AT_EMPTY_PATH/"" and AT_SYMLINK_NOFOLLOW case, we
need to call fstatat64 with AT_EMPTY_PATH and see if st_mode indicates
that the descriptor refers to a symbolic link.  If it does, the function
needs to fail with ELOOP.

AT_EMPTY_PATH without a "" file name does not need special treatment and
can use the regular openat path (with the conditional setting of
O_NOFOLLOW).

Thanks,
Florian