linux-kernel - Re: [PATCH v2] execve.2: execve also returns E2BIG if a string is too long

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZSbD59Y5y3zNGC1h@debian>
Date:   Wed, 11 Oct 2023 17:48:55 +0200
From:   Alejandro Colomar <alx@...nel.org>
To:     Rik van Riel <riel@...riel.com>
Cc:     linux-man@...r.kernel.org, kernel-team@...a.com,
        LKML <linux-kernel@...r.kernel.org>,
        Eric Biederman <ebiederm@...ssion.com>,
        Matthew House <mattlloydhouse@...il.com>
Subject: Re: [PATCH v2] execve.2: execve also returns E2BIG if a string is
 too long

Hi Rik,

On Wed, Oct 11, 2023 at 10:11:34AM -0400, Rik van Riel wrote:
> The execve syscall returns -E2BIG in 3 cases:
> - The total length of the command line arguments and environment is too large.
> - An argument or environment string is longer than MAX_ARG_STRLEN.

Please mention that this includes the terminating NUL, as Matthew
confirmed.  Otherwise, to user-space programmers, this would usually be
interpreted as `strlen(p) > MAX_ARG_STRLEN`.

An example program that demonstrates the limit would be very interesting
here.

Thanks,
Alex

> - The full path to the executable exceeds MAX_ARG_STRLEN.
> 
> Spell out all 3 cases in the -E2BIG section.
> 
> Discovered by moving a too large commandline parameter to an environment
> variable, and finding that things still did not work. Examined the code
> in fs/exec.c to get the details.
> 
> Signed-off-by: Rik van Riel <riel@...riel.com>
> Suggested-by: Matthew House <mattlloydhouse@...il.com>
> ---
>  man2/execve.2 | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/man2/execve.2 b/man2/execve.2
> index 0d9582492ad1..85c6ec15df3c 100644
> --- a/man2/execve.2
> +++ b/man2/execve.2
> @@ -449,7 +449,8 @@ The total number of bytes in the environment
>  .RI ( envp )
>  and argument list
>  .RI ( argv )
> -is too large.
> +is too large, an argument or environment string is too long, or
> +the full path name to the executable is too long.
>  .TP
>  .B EACCES
>  Search permission is denied on a component of the path prefix of
> -- 
> 2.41.0
> 
> 

-- 
<https://www.alejandro-colomar.es/>

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)