linux - 为什么 do_execve() 会分两步而不是一步执行可执行验证检查？

Question

Understanding the Linux Kernel 说到 execve() 的实现:

do_execve( ) performs the following operations:

1. Dynamically allocates a linux_binprm data structure, which will be filled with data concerning the new executable file.

2. Invokes path_lookup(), dentry_open(), and path_release() to get the dentry object, the file object, and the inode object associated with the executable file. On failure, it returns the proper error code.

3. Verifies that the file is executable by the current process; also, checks that the file is not being written by looking at the i_writecount field of the inode; stores –1 in that field to forbid further write accesses.

4. In multiprocessor systems, it invokes the sched_exec() function to determine the least loaded CPU that can execute the new program and to migrate the current process to it (see Chapter 7).

5. Invokes init_new_context() to check whether the current process was using a custom Local Descriptor Table (see the section “The Linux LDTs” in Chapter 2); in this case, the function allocates and fills a new LDT to be used by the new program.

6. Invokes the prepare_binprm( ) function to fill the linux_binprm data structure. This function, in turn, performs the following operations:

   a. Checks again whether the file is executable (at least one execute access right is set); if not, returns an error code. (The previous check in step 3 is not sufficient because a process with the CAP_DAC_OVERRIDE capability set always satisfies the check; see the section “Process Credentials and Capabilities” earlier in this chapter).

...

第3步和第6a步是否都进行验证检查是否为进程设置了可执行文件的执行权限位？

它们的区别和联系是什么？

第 3 步是否没有考虑进程的 CAP_DAC_OVERRIDE 容量，而第 6a 步考虑了？这是两个步骤之间的唯一区别吗？

为什么我们需要两步检查，而不是将所有检查集中到步骤 3 或步骤 6a 中的一步检查？

谢谢。

Answer 1

您可以并且应该阅读内核源代码本身(在 fs/exec.c 中)。第 2 步和第 3 步基本上是调用带有特殊 EXEC 标志的通用 open 函数“打开文件并执行”，而第二个检查是一系列检查的一部分“新流程应该有哪些权利”。

所以更具体的位:

• 这是为了防止什么？ => 可能 root 错误地执行了不可执行的二进制文件
• 为什么不在 3 办理登机手续？ => 这是重用一个更通用的操作 - 带有标志的打开 - 如果你有能力，该操作应该会成功
• 为什么不在 6 中完成所有检查？ => 3 做了很多在这里不切实际的额外检查，比如“我们是在一个 noexec 挂载的文件系统上吗？”

总之，你的问题有点太开放了，不知道我的回答是否能让你满意。请转而阅读内核源代码。 :-)