From ebe7715d3a6fa1b5d5631640dabd8877bfca7b86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Marczewski?= <pawel@invisiblethingslab.com>
Date: Thu, 5 Nov 2020 14:44:51 +0100
Subject: [PATCH] [LibOS] Fix execve() corner cases

- Return EACCES if the file has no execute permission
- Return ENOEXEC if the file is not recognized as either ELF or
  shebang script
---
 LibOS/shim/src/sys/shim_exec.c | 33 +++++++++++++++++++++------------
 LibOS/shim/test/ltp/ltp.cfg    |  8 --------
 2 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/LibOS/shim/src/sys/shim_exec.c b/LibOS/shim/src/sys/shim_exec.c
index c81e0536..36df8439 100644
--- a/LibOS/shim/src/sys/shim_exec.c
+++ b/LibOS/shim/src/sys/shim_exec.c
@@ -251,6 +251,11 @@ reopen:
         __kernel_mode_t mode;
         if ((ret = fs->d_ops->mode(dent, &mode)) < 0)
             goto err;
+        /* Check if the file is executable. Currently just looks at the user bit. */
+        if (!(mode & S_IXUSR)) {
+            ret = -EACCES;
+            goto err;
+        }
     }
 
     struct shim_handle* exec = NULL;
@@ -331,20 +336,24 @@ reopen:
             }
         } while (!ended);
 
-        if (started) {
-            if (next) {
-                INIT_LIST_HEAD(next, list);
-                LISTP_ADD_TAIL(next, &new_shargs, list);
-            }
-
-            struct sharg* first = LISTP_FIRST_ENTRY(&new_shargs, struct sharg, list);
-            assert(first);
-            debug("detected as script: run by %s\n", first->arg);
-            file = first->arg;
-            LISTP_SPLICE(&new_shargs, &shargs, list, sharg);
+        if (!started) {
+            debug("file not recognized as ELF or shebang");
             put_handle(exec);
-            goto reopen;
+            return -ENOEXEC;
         }
+
+        if (next) {
+            INIT_LIST_HEAD(next, list);
+            LISTP_ADD_TAIL(next, &new_shargs, list);
+        }
+
+        struct sharg* first = LISTP_FIRST_ENTRY(&new_shargs, struct sharg, list);
+        assert(first);
+        debug("detected as script: run by %s\n", first->arg);
+        file = first->arg;
+        LISTP_SPLICE(&new_shargs, &shargs, list, sharg);
+        put_handle(exec);
+        goto reopen;
     }
 
     /* If `execve` is invoked concurrently by multiple threads, let only one succeed. */
diff --git a/LibOS/shim/test/ltp/ltp.cfg b/LibOS/shim/test/ltp/ltp.cfg
index e5c692a2..edd8310a 100644
--- a/LibOS/shim/test/ltp/ltp.cfg
+++ b/LibOS/shim/test/ltp/ltp.cfg
@@ -265,14 +265,6 @@ skip = yes
 [execve02]
 skip = yes
 
-# 5. exec on a "fake" file with no execute permission, Graphene tries to execute it anyway
-[execve03]
-must-pass =
-    1
-    2
-    3
-    4
-
 # copy child
 [execve04]
 skip = yes