/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2023 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include <linux/file.h>
#include <linux/namei.h>

#include "ertp.h"
#include "ertp_event_check.h"
#include "ertp_ftrace_utils.h"
#include "ertp_handlers_execve.h"
#include "ertp_logs.h"

#ifdef ERTP_KERNEL_USES_SYSCALL_WRAPPER

sys_regs_t ertp_original_native_64_execve;
sys_regs_t ertp_original_native_32_execve;
sys_regs_t ertp_original_compat_32_execve;

#ifdef ERTP_EXECVEAT_DEFINED
sys_regs_t ertp_original_native_64_execveat;
sys_regs_t ertp_original_native_32_execveat;
sys_regs_t ertp_original_compat_32_execveat;
#endif

#else
sys_execve_t ertp_original_native_64_execve;
sys_execve_t ertp_original_compat_32_execve;

#ifdef ERTP_EXECVEAT_DEFINED
sys_execveat_t ertp_original_native_64_execveat;
sys_execveat_t ertp_original_compat_32_execveat;
#endif

#endif

static long check_execve(int dirfd, const char __user *filename, int flags) {
  struct file *file;
  struct path path;
  int err;

#ifdef ERTP_DEBUG
  char *name = ertp_debug_getname(filename);
#endif

  if (!filename) {
    ertp_pr_log(ERTP_LOG_ERRORS, "exec event skipped: no filename");
    return 0;
  }

  err = user_path_at(dirfd, filename,
                     (flags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : LOOKUP_FOLLOW,
                     &path);
  if (err < 0) {
    ertp_pr_log(ERTP_LOG_EXEC,
                "exec event skipped: user_path_at(\"%s\") returned error %d",
                name, err);
    goto allow_event;
  }

  ertp_pr_log(ERTP_LOG_EXEC, "handling exec event of %s", name);
  file = ertp_dentry_open(&path, O_RDONLY);
  path_put(&path);

  if (IS_ERR(file)) {
    ertp_pr_log(ERTP_LOG_EXEC,
                "exec event skipped: dentry_open(\"%s\") returned error %ld",
                name, PTR_ERR(file));
    goto allow_event;
  }

  if (ertp_check_exec(file) != ERTP_CONTINUE) {
    ertp_pr_log(ERTP_LOG_EXEC, "execve(\"%s\") denied by scanner", name);
    fput(file);
    return -EPERM;
  }

  fput(file);

  if (ertp_check_all_open_files(ertp_check_open) != ERTP_CONTINUE)
    return -EPERM;

allow_event:

#ifdef ERTP_DEBUG
  ertp_debug_putname(name);
#endif

  return 0;
}

#ifdef ERTP_KERNEL_USES_SYSCALL_WRAPPER
asmlinkage long notrace ertp_handler_native_64_execve(struct pt_regs *regs) {
  const char __user *filename = ERTP_SYSCALL64_ARG0(const char __user *, regs);

  long ret = check_execve(AT_FDCWD, filename, 0);
  if (ret == 0) {
    ret = ertp_original_native_64_execve(regs);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_native_32_execve(struct pt_regs *regs) {
  const char __user *filename = ERTP_SYSCALL32_ARG0(const char __user *, regs);

  long ret = check_execve(AT_FDCWD, filename, 0);
  if (ret == 0) {
    ret = ertp_original_native_32_execve(regs);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_compat_32_execve(struct pt_regs *regs) {
  const char __user *filename = ERTP_SYSCALL32_ARG0(const char __user *, regs);

  long ret = check_execve(AT_FDCWD, filename, 0);
  if (ret == 0) {
    ret = ertp_original_compat_32_execve(regs);
  }

  ertp_handler_end();
  return ret;
}

#else

asmlinkage long notrace ertp_handler_native_64_execve(
    const char __user *filename, long argv, long envp) {
  long ret = check_execve(AT_FDCWD, filename, 0);
  if (ret == 0) {
    ret = ertp_original_native_64_execve(filename, argv, envp);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_compat_32_execve(
    const char __user *filename, long argv, long envp) {
  long ret = check_execve(AT_FDCWD, filename, 0);
  if (ret == 0) {
    ret = ertp_original_compat_32_execve(filename, argv, envp);
  }

  ertp_handler_end();
  return ret;
}

#endif

#ifdef ERTP_EXECVEAT_DEFINED

#ifdef ERTP_KERNEL_USES_SYSCALL_WRAPPER

asmlinkage long notrace ertp_handler_native_64_execveat(struct pt_regs *regs) {
  int dirfd = ERTP_SYSCALL64_ARG0(int, regs);
  const char __user *filename = ERTP_SYSCALL64_ARG1(const char __user *, regs);
  int flags = ERTP_SYSCALL64_ARG4(int, regs);

  long ret = check_execve(dirfd, filename, flags);
  if (ret == 0) {
    ret = ertp_original_native_64_execveat(regs);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_native_32_execveat(struct pt_regs *regs) {
  int dirfd = ERTP_SYSCALL32_ARG0(int, regs);
  const char __user *filename = ERTP_SYSCALL32_ARG1(const char __user *, regs);
  int flags = ERTP_SYSCALL32_ARG4(int, regs);

  long ret = check_execve(dirfd, filename, flags);
  if (ret == 0) {
    ret = ertp_original_native_32_execveat(regs);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_compat_32_execveat(struct pt_regs *regs) {
  int dirfd = ERTP_SYSCALL32_ARG0(int, regs);
  const char __user *filename = ERTP_SYSCALL32_ARG1(const char __user *, regs);
  int flags = ERTP_SYSCALL32_ARG4(int, regs);

  long ret = check_execve(dirfd, filename, flags);
  if (ret == 0) {
    ret = ertp_original_compat_32_execveat(regs);
  }

  ertp_handler_end();
  return ret;
}

#else

asmlinkage long notrace ertp_handler_native_64_execveat(
    int dirfd, const char __user *filename, long argv, long envp, int flags) {
  long ret = check_execve(dirfd, filename, flags);
  if (ret == 0) {
    ret = ertp_original_native_64_execveat(dirfd, filename, argv, envp, flags);
  }

  ertp_handler_end();
  return ret;
}

asmlinkage long notrace ertp_handler_compat_32_execveat(
    int dirfd, const char __user *filename, long argv, long envp, int flags) {
  long ret = check_execve(dirfd, filename, flags);
  if (ret == 0) {
    ret = ertp_original_compat_32_execveat(dirfd, filename, argv, envp, flags);
  }

  ertp_handler_end();
  return ret;
}

#endif
#endif