From nobody Fri Jun 19 20:22:54 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ghptk4w4pz6gm9L for ; Fri, 19 Jun 2026 20:22:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ghptk2krbz419x for ; Fri, 19 Jun 2026 20:22:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781900574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=buZBGD3V9C7nAUqvlevYccd5LULwri2D0EIkP60EULI=; b=ar9KDd9d2sGM/bkY7TjXyFs/WS3LXBpmHnRbFc3UkH9SeEpA1km+Xwra09wMxO7C67wK/m WKv++Ac2EniLu3nRubL8hzzwSeypqCkHrcGrlPECeSyhKS81U5U1x+IyW8pwAxaVz9HuF4 ZLe7dqihICEmQNJUe8oRNgEEWwc5YFBJtX+agOuXNKAwM6C+xwRaP7IlrHtTS6tdWFQe11 GC0G26vOoMYcfl/7+LFMZW1H74bWmF/e9zxKDo6jI0ypI20UFXOEJbFYT8++SYVSkka51f wxxoFKEm0LgQVx/MgkyFERuSvVtW2jXINNR64Gtzqfw+JZxz61eK680G9ieTwQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781900574; a=rsa-sha256; cv=none; b=CwTHt6WdXeBvCG2e0nnvpVQJH/vJ1oSgGQpzQrMgyJn7zdL1FCnHi8jSiCO3CZ6u6ZDimC COcVU7VpOlGXGdZ0JgV3WmtJSwrrdA6dVpi/3y2Jku0K47b0LpH2bi64Exx2F2lUjic82S CYeDYDmtFoBqY9ByyTaKS3TNcQKWg3zBIqfZlvEn1ILiWJqAmMvQPVNpXQfU4EnWmlXkNy sEmaVyeZuzivwV+ukaRXnYaEUW4yPtM+gnS12FLr3q/URFDGBZQGMQ7KICEF+U9+aTty67 xZ+RiqzQ9P3Ydo0BkcyQooSluqThlasuvhXIwla57jqISeB5+4IDLEK6+p8z6A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781900574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=buZBGD3V9C7nAUqvlevYccd5LULwri2D0EIkP60EULI=; b=B71aqQswcSRU6MzfZvvO2i4BwM9/DgnTeINLgHuGxNGYZGwa5JXARoQvk70VeeJU9SF0FO Gjxve6eWBcwSYL8WIvl0Z45Qsgfu+r1ETFkcbArUCfJu5gTzsVtr0CZNeJ7IyPOPR1Coej fvZedSw5D3AHT55RETbo1eGyLR37g5JuFduMZNdcKQtJN8bgbnhIGt9DidcICPEEDIWjw7 b4RQX0KFkfLCiifEuOZyG58gpOE1RBFLJDFpijDSigxGDTU/6NQobjOZiwnAKHW5K8Gcf8 yZbCI7mdiFmsy612nA3vYaQQSBs3FqHAyJ/74K/bgvvZh1VR97IlkwMVhD9jDQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4ghptk1DTjz116V for ; Fri, 19 Jun 2026 20:22:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a726 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 19 Jun 2026 20:22:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Simon J. Gerraty Subject: git: 389c124fecb0 - main - imgact_elf.c indicate that interpreter is an interpreter List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: sjg X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 389c124fecb04cf6ae2b0f8ab1047c19badec40c Auto-Submitted: auto-generated Date: Fri, 19 Jun 2026 20:22:54 +0000 Message-Id: <6a35a51e.3a726.5c6d84ad@gitrepo.freebsd.org> The branch main has been updated by sjg: URL: https://cgit.FreeBSD.org/src/commit/?id=389c124fecb04cf6ae2b0f8ab1047c19badec40c commit 389c124fecb04cf6ae2b0f8ab1047c19badec40c Author: Simon J. Gerraty AuthorDate: 2026-06-19 20:21:46 +0000 Commit: Simon J. Gerraty CommitDate: 2026-06-19 20:21:46 +0000 imgact_elf.c indicate that interpreter is an interpreter Use a value that do_execve will ignore since there's nothing there to do. With this we can set the 'indirect' flag on rtld, to prevent direct execution being used to bypass the 'indirect' flag on python3: root@vuefi:~ # /libexec/ld-elf32.so.1 /usr/bin/python3 -c 'print("pwned")' pwned root@vuefi:~ # veriexec -z enforce root@vuefi:~ # /libexec/ld-elf32.so.1 /usr/bin/python3 -c 'print("pwned")' /libexec/ld-elf32.so.1: Operation not permitted. root@vuefi:~ # load_file seems missnamed since it is only used by load_interp so rename it to load_interp_file. Reviewed by: imp Sponsored by: Hewlett Packard Enterprise Development LP Differential Revision: https://reviews.freebsd.org/D57649 --- sys/kern/imgact_elf.c | 11 ++++++----- sys/kern/kern_exec.c | 3 ++- sys/sys/imgact.h | 1 + 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index 65e0e6089dca..a0dc96e74ed6 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -94,7 +94,7 @@ static int __elfN(check_header)(const Elf_Ehdr *hdr); static const Elf_Brandinfo *__elfN(get_brandinfo)(struct image_params *imgp, const Elf_Phdr *phdr, const char *interp, int32_t *osrel, uint32_t *fctl0); -static int __elfN(load_file)(struct thread *td, const char *file, u_long *addr, +static int __elfN(load_interp_file)(struct thread *td, const char *file, u_long *addr, u_long *entry); static int __elfN(load_section)(const struct image_params *imgp, vm_ooffset_t offset, caddr_t vmaddr, size_t memsz, size_t filsz, @@ -785,7 +785,7 @@ __elfN(load_sections)(const struct image_params *imgp, const Elf_Ehdr *hdr, * the entry point for the loaded file. */ static int -__elfN(load_file)(struct thread *td, const char *file, u_long *addr, +__elfN(load_interp_file)(struct thread *td, const char *file, u_long *addr, u_long *entry) { struct { @@ -823,7 +823,8 @@ __elfN(load_file)(struct thread *td, const char *file, u_long *addr, imgp->td = td; imgp->proc = td->td_proc; imgp->attr = attr; - + imgp->interpreted = IMGACT_INTERP_IGNORE; /* ignored by do_execve */ + NDINIT(nd, LOOKUP, ISOPEN | FOLLOW | LOCKSHARED | LOCKLEAF, UIO_SYSSPACE, file); if ((error = namei(nd)) != 0) { @@ -1092,13 +1093,13 @@ __elfN(load_interp)(struct image_params *imgp, const Elf_Brandinfo *brand_info, if (brand_info->interp_newpath != NULL && (brand_info->interp_path == NULL || strcmp(interp, brand_info->interp_path) == 0)) { - error = __elfN(load_file)(imgp->td, + error = __elfN(load_interp_file)(imgp->td, brand_info->interp_newpath, addr, entry); if (error == 0) return (0); } - error = __elfN(load_file)(imgp->td, interp, addr, entry); + error = __elfN(load_interp_file)(imgp->td, interp, addr, entry); if (error == 0) return (0); diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 8ea00543989e..de6d8b08cec3 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -678,7 +678,8 @@ interpret: * Special interpreter operation, cleanup and loop up to try to * activate the interpreter. */ - if (imgp->interpreted) { + if (imgp->interpreted != 0 && + imgp->interpreted != IMGACT_INTERP_IGNORE) { exec_unmap_first_page(imgp); /* * The text reference needs to be removed for scripts. diff --git a/sys/sys/imgact.h b/sys/sys/imgact.h index 51cda4406cad..f99b1273ee02 100644 --- a/sys/sys/imgact.h +++ b/sys/sys/imgact.h @@ -86,6 +86,7 @@ struct image_params { struct ucred *newcred; /* new credentials if changing */ #define IMGACT_SHELL 0x1 #define IMGACT_BINMISC 0x2 +#define IMGACT_INTERP_IGNORE 0x3 unsigned char interpreted; /* mask of interpreters that have run */ bool credential_setid; /* true if becoming setid */ bool vmspace_destroyed; /* we've blown away original vm space */