]>
Commit | Line | Data |
---|---|---|
9ff72da4 | 1 | /* POSIX spawn interface. Linux version. |
2b778ceb | 2 | Copyright (C) 2016-2021 Free Software Foundation, Inc. |
9ff72da4 AZ |
3 | This file is part of the GNU C Library. |
4 | ||
5 | The GNU C Library is free software; you can redistribute it and/or | |
6 | modify it under the terms of the GNU Lesser General Public | |
7 | License as published by the Free Software Foundation; either | |
8 | version 2.1 of the License, or (at your option) any later version. | |
9 | ||
10 | The GNU C Library is distributed in the hope that it will be useful, | |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
13 | Lesser General Public License for more details. | |
14 | ||
15 | You should have received a copy of the GNU Lesser General Public | |
16 | License along with the GNU C Library; if not, see | |
5a82c748 | 17 | <https://www.gnu.org/licenses/>. */ |
9ff72da4 AZ |
18 | |
19 | #include <spawn.h> | |
20 | #include <fcntl.h> | |
21 | #include <paths.h> | |
22 | #include <string.h> | |
23 | #include <sys/resource.h> | |
24 | #include <sys/wait.h> | |
25 | #include <sys/param.h> | |
26 | #include <sys/mman.h> | |
27 | #include <not-cancel.h> | |
28 | #include <local-setxid.h> | |
29 | #include <shlib-compat.h> | |
30 | #include <nptl/pthreadP.h> | |
31 | #include <dl-sysdep.h> | |
9090848d | 32 | #include <libc-pointer-arith.h> |
9ff72da4 | 33 | #include <ldsodefs.h> |
9ff72da4 AZ |
34 | #include "spawn_int.h" |
35 | ||
36 | /* The Linux implementation of posix_spawn{p} uses the clone syscall directly | |
37 | with CLONE_VM and CLONE_VFORK flags and an allocated stack. The new stack | |
38 | and start function solves most the vfork limitation (possible parent | |
39 | clobber due stack spilling). The remaining issue are: | |
40 | ||
41 | 1. That no signal handlers must run in child context, to avoid corrupting | |
42 | parent's state. | |
43 | 2. The parent must ensure child's stack freeing. | |
44 | 3. Child must synchronize with parent to enforce 2. and to possible | |
45 | return execv issues. | |
46 | ||
4b4d4056 RV |
47 | The first issue is solved by blocking all signals in child, even |
48 | the NPTL-internal ones (SIGCANCEL and SIGSETXID). The second and | |
49 | third issue is done by a stack allocation in parent, and by using a | |
50 | field in struct spawn_args where the child can write an error | |
51 | code. CLONE_VFORK ensures that the parent does not run until the | |
52 | child has either exec'ed successfully or exited. */ | |
9ff72da4 AZ |
53 | |
54 | ||
55 | /* The Unix standard contains a long explanation of the way to signal | |
56 | an error after the fork() was successful. Since no new wait status | |
57 | was wanted there is no way to signal an error using one of the | |
58 | available methods. The committee chose to signal an error by a | |
59 | normal program exit with the exit code 127. */ | |
60 | #define SPAWN_ERROR 127 | |
61 | ||
9ff72da4 | 62 | #ifdef __ia64__ |
ddc3fb33 MF |
63 | # define CLONE(__fn, __stackbase, __stacksize, __flags, __args) \ |
64 | __clone2 (__fn, __stackbase, __stacksize, __flags, __args, 0, 0, 0) | |
9ff72da4 AZ |
65 | #else |
66 | # define CLONE(__fn, __stack, __stacksize, __flags, __args) \ | |
67 | __clone (__fn, __stack, __flags, __args) | |
68 | #endif | |
69 | ||
ddc3fb33 MF |
70 | /* Since ia64 wants the stackbase w/clone2, re-use the grows-up macro. */ |
71 | #if _STACK_GROWS_UP || defined (__ia64__) | |
9ff72da4 | 72 | # define STACK(__stack, __stack_size) (__stack) |
ddc3fb33 MF |
73 | #elif _STACK_GROWS_DOWN |
74 | # define STACK(__stack, __stack_size) (__stack + __stack_size) | |
9ff72da4 AZ |
75 | #endif |
76 | ||
77 | ||
78 | struct posix_spawn_args | |
79 | { | |
9ff72da4 AZ |
80 | sigset_t oldmask; |
81 | const char *file; | |
82 | int (*exec) (const char *, char *const *, char *const *); | |
83 | const posix_spawn_file_actions_t *fa; | |
84 | const posix_spawnattr_t *restrict attr; | |
85 | char *const *argv; | |
86 | ptrdiff_t argc; | |
87 | char *const *envp; | |
88 | int xflags; | |
4b4d4056 | 89 | int err; |
9ff72da4 AZ |
90 | }; |
91 | ||
92 | /* Older version requires that shell script without shebang definition | |
93 | to be called explicitly using /bin/sh (_PATH_BSHELL). */ | |
94 | static void | |
95 | maybe_script_execute (struct posix_spawn_args *args) | |
96 | { | |
97 | if (SHLIB_COMPAT (libc, GLIBC_2_2, GLIBC_2_15) | |
98 | && (args->xflags & SPAWN_XFLAGS_TRY_SHELL) && errno == ENOEXEC) | |
99 | { | |
100 | char *const *argv = args->argv; | |
101 | ptrdiff_t argc = args->argc; | |
102 | ||
103 | /* Construct an argument list for the shell. */ | |
28669f86 | 104 | char *new_argv[argc + 2]; |
9ff72da4 AZ |
105 | new_argv[0] = (char *) _PATH_BSHELL; |
106 | new_argv[1] = (char *) args->file; | |
107 | if (argc > 1) | |
c4f50205 | 108 | memcpy (new_argv + 2, argv + 1, argc * sizeof (char *)); |
9ff72da4 AZ |
109 | else |
110 | new_argv[2] = NULL; | |
111 | ||
112 | /* Execute the shell. */ | |
113 | args->exec (new_argv[0], new_argv, args->envp); | |
114 | } | |
115 | } | |
116 | ||
117 | /* Function used in the clone call to setup the signals mask, posix_spawn | |
118 | attributes, and file actions. It run on its own stack (provided by the | |
119 | posix_spawn call). */ | |
120 | static int | |
121 | __spawni_child (void *arguments) | |
122 | { | |
123 | struct posix_spawn_args *args = arguments; | |
124 | const posix_spawnattr_t *restrict attr = args->attr; | |
125 | const posix_spawn_file_actions_t *file_actions = args->fa; | |
9ff72da4 | 126 | |
9ff72da4 AZ |
127 | /* The child must ensure that no signal handler are enabled because it shared |
128 | memory with parent, so the signal disposition must be either SIG_DFL or | |
129 | SIG_IGN. It does by iterating over all signals and although it could | |
130 | possibly be more optimized (by tracking which signal potentially have a | |
131 | signal handler), it might requires system specific solutions (since the | |
132 | sigset_t data type can be very different on different architectures). */ | |
133 | struct sigaction sa; | |
134 | memset (&sa, '\0', sizeof (sa)); | |
135 | ||
136 | sigset_t hset; | |
137 | __sigprocmask (SIG_BLOCK, 0, &hset); | |
138 | for (int sig = 1; sig < _NSIG; ++sig) | |
139 | { | |
140 | if ((attr->__flags & POSIX_SPAWN_SETSIGDEF) | |
5fb7fc96 | 141 | && __sigismember (&attr->__sd, sig)) |
9ff72da4 AZ |
142 | { |
143 | sa.sa_handler = SIG_DFL; | |
144 | } | |
5fb7fc96 | 145 | else if (__sigismember (&hset, sig)) |
9ff72da4 | 146 | { |
92aabad9 | 147 | if (__is_internal_signal (sig)) |
9ff72da4 AZ |
148 | sa.sa_handler = SIG_IGN; |
149 | else | |
150 | { | |
151 | __libc_sigaction (sig, 0, &sa); | |
152 | if (sa.sa_handler == SIG_IGN) | |
153 | continue; | |
154 | sa.sa_handler = SIG_DFL; | |
155 | } | |
156 | } | |
157 | else | |
158 | continue; | |
159 | ||
160 | __libc_sigaction (sig, &sa, 0); | |
161 | } | |
162 | ||
163 | #ifdef _POSIX_PRIORITY_SCHEDULING | |
164 | /* Set the scheduling algorithm and parameters. */ | |
165 | if ((attr->__flags & (POSIX_SPAWN_SETSCHEDPARAM | POSIX_SPAWN_SETSCHEDULER)) | |
166 | == POSIX_SPAWN_SETSCHEDPARAM) | |
167 | { | |
249548e4 | 168 | if (__sched_setparam (0, &attr->__sp) == -1) |
9ff72da4 AZ |
169 | goto fail; |
170 | } | |
171 | else if ((attr->__flags & POSIX_SPAWN_SETSCHEDULER) != 0) | |
172 | { | |
249548e4 | 173 | if (__sched_setscheduler (0, attr->__policy, &attr->__sp) == -1) |
9ff72da4 AZ |
174 | goto fail; |
175 | } | |
176 | #endif | |
177 | ||
daeb1fa2 AZ |
178 | if ((attr->__flags & POSIX_SPAWN_SETSID) != 0 |
179 | && __setsid () < 0) | |
180 | goto fail; | |
181 | ||
9ff72da4 AZ |
182 | /* Set the process group ID. */ |
183 | if ((attr->__flags & POSIX_SPAWN_SETPGROUP) != 0 | |
249548e4 | 184 | && __setpgid (0, attr->__pgrp) != 0) |
9ff72da4 AZ |
185 | goto fail; |
186 | ||
187 | /* Set the effective user and group IDs. */ | |
188 | if ((attr->__flags & POSIX_SPAWN_RESETIDS) != 0 | |
249548e4 AZ |
189 | && (local_seteuid (__getuid ()) != 0 |
190 | || local_setegid (__getgid ()) != 0)) | |
9ff72da4 AZ |
191 | goto fail; |
192 | ||
193 | /* Execute the file actions. */ | |
194 | if (file_actions != 0) | |
195 | { | |
196 | int cnt; | |
197 | struct rlimit64 fdlimit; | |
198 | bool have_fdlimit = false; | |
199 | ||
200 | for (cnt = 0; cnt < file_actions->__used; ++cnt) | |
201 | { | |
202 | struct __spawn_action *action = &file_actions->__actions[cnt]; | |
203 | ||
9ff72da4 AZ |
204 | switch (action->tag) |
205 | { | |
206 | case spawn_do_close: | |
c181840c | 207 | if (__close_nocancel (action->action.close_action.fd) != 0) |
9ff72da4 AZ |
208 | { |
209 | if (!have_fdlimit) | |
210 | { | |
211 | __getrlimit64 (RLIMIT_NOFILE, &fdlimit); | |
212 | have_fdlimit = true; | |
213 | } | |
214 | ||
215 | /* Signal errors only for file descriptors out of range. */ | |
216 | if (action->action.close_action.fd < 0 | |
217 | || action->action.close_action.fd >= fdlimit.rlim_cur) | |
218 | goto fail; | |
219 | } | |
220 | break; | |
221 | ||
222 | case spawn_do_open: | |
223 | { | |
e83be730 AZ |
224 | /* POSIX states that if fildes was already an open file descriptor, |
225 | it shall be closed before the new file is opened. This avoid | |
226 | pontential issues when posix_spawn plus addopen action is called | |
227 | with the process already at maximum number of file descriptor | |
228 | opened and also for multiple actions on single-open special | |
229 | paths (like /dev/watchdog). */ | |
c181840c | 230 | __close_nocancel (action->action.open_action.fd); |
e83be730 | 231 | |
c2284574 | 232 | int ret = __open_nocancel (action->action.open_action.path, |
249548e4 AZ |
233 | action->action. |
234 | open_action.oflag | O_LARGEFILE, | |
235 | action->action.open_action.mode); | |
9ff72da4 AZ |
236 | |
237 | if (ret == -1) | |
238 | goto fail; | |
239 | ||
240 | int new_fd = ret; | |
241 | ||
242 | /* Make sure the desired file descriptor is used. */ | |
243 | if (ret != action->action.open_action.fd) | |
244 | { | |
249548e4 | 245 | if (__dup2 (new_fd, action->action.open_action.fd) |
9ff72da4 AZ |
246 | != action->action.open_action.fd) |
247 | goto fail; | |
248 | ||
c181840c | 249 | if (__close_nocancel (new_fd) != 0) |
9ff72da4 AZ |
250 | goto fail; |
251 | } | |
252 | } | |
253 | break; | |
254 | ||
255 | case spawn_do_dup2: | |
805334b2 AZ |
256 | /* Austin Group issue #411 requires adddup2 action with source |
257 | and destination being equal to remove close-on-exec flag. */ | |
258 | if (action->action.dup2_action.fd | |
259 | == action->action.dup2_action.newfd) | |
260 | { | |
261 | int fd = action->action.dup2_action.newfd; | |
262 | int flags = __fcntl (fd, F_GETFD, 0); | |
263 | if (flags == -1) | |
264 | goto fail; | |
265 | if (__fcntl (fd, F_SETFD, flags & ~FD_CLOEXEC) == -1) | |
266 | goto fail; | |
267 | } | |
268 | else if (__dup2 (action->action.dup2_action.fd, | |
269 | action->action.dup2_action.newfd) | |
270 | != action->action.dup2_action.newfd) | |
9ff72da4 AZ |
271 | goto fail; |
272 | break; | |
4a938cb2 FW |
273 | |
274 | case spawn_do_chdir: | |
275 | if (__chdir (action->action.chdir_action.path) != 0) | |
276 | goto fail; | |
277 | break; | |
3a3fb755 FW |
278 | |
279 | case spawn_do_fchdir: | |
280 | if (__fchdir (action->action.fchdir_action.fd) != 0) | |
281 | goto fail; | |
282 | break; | |
9ff72da4 AZ |
283 | } |
284 | } | |
285 | } | |
286 | ||
287 | /* Set the initial signal mask of the child if POSIX_SPAWN_SETSIGMASK | |
288 | is set, otherwise restore the previous one. */ | |
289 | __sigprocmask (SIG_SETMASK, (attr->__flags & POSIX_SPAWN_SETSIGMASK) | |
290 | ? &attr->__ss : &args->oldmask, 0); | |
291 | ||
292 | args->exec (args->file, args->argv, args->envp); | |
293 | ||
294 | /* This is compatibility function required to enable posix_spawn run | |
295 | script without shebang definition for older posix_spawn versions | |
296 | (2.15). */ | |
297 | maybe_script_execute (args); | |
298 | ||
9ff72da4 | 299 | fail: |
4b4d4056 RV |
300 | /* errno should have an appropriate non-zero value; otherwise, |
301 | there's a bug in glibc or the kernel. For lack of an error code | |
302 | (EINTERNALBUG) describing that, use ECHILD. Another option would | |
303 | be to set args->err to some negative sentinel and have the parent | |
304 | abort(), but that seems needlessly harsh. */ | |
305 | args->err = errno ? : ECHILD; | |
3e040a2d | 306 | _exit (SPAWN_ERROR); |
9ff72da4 AZ |
307 | } |
308 | ||
309 | /* Spawn a new process executing PATH with the attributes describes in *ATTRP. | |
310 | Before running the process perform the actions described in FILE-ACTIONS. */ | |
311 | static int | |
312 | __spawnix (pid_t * pid, const char *file, | |
313 | const posix_spawn_file_actions_t * file_actions, | |
314 | const posix_spawnattr_t * attrp, char *const argv[], | |
315 | char *const envp[], int xflags, | |
316 | int (*exec) (const char *, char *const *, char *const *)) | |
317 | { | |
318 | pid_t new_pid; | |
319 | struct posix_spawn_args args; | |
320 | int ec; | |
321 | ||
9ff72da4 AZ |
322 | /* To avoid imposing hard limits on posix_spawn{p} the total number of |
323 | arguments is first calculated to allocate a mmap to hold all possible | |
324 | values. */ | |
325 | ptrdiff_t argc = 0; | |
326 | /* Linux allows at most max (0x7FFFFFFF, 1/4 stack size) arguments | |
327 | to be used in a execve call. We limit to INT_MAX minus one due the | |
328 | compatiblity code that may execute a shell script (maybe_script_execute) | |
329 | where it will construct another argument list with an additional | |
330 | argument. */ | |
331 | ptrdiff_t limit = INT_MAX - 1; | |
332 | while (argv[argc++] != NULL) | |
333 | if (argc == limit) | |
334 | { | |
335 | errno = E2BIG; | |
336 | return errno; | |
337 | } | |
338 | ||
339 | int prot = (PROT_READ | PROT_WRITE | |
340 | | ((GL (dl_stack_flags) & PF_X) ? PROT_EXEC : 0)); | |
341 | ||
342 | /* Add a slack area for child's stack. */ | |
343 | size_t argv_size = (argc * sizeof (void *)) + 512; | |
21f042c8 MF |
344 | /* We need at least a few pages in case the compiler's stack checking is |
345 | enabled. In some configs, it is known to use at least 24KiB. We use | |
346 | 32KiB to be "safe" from anything the compiler might do. Besides, the | |
347 | extra pages won't actually be allocated unless they get used. */ | |
348 | argv_size += (32 * 1024); | |
9ff72da4 AZ |
349 | size_t stack_size = ALIGN_UP (argv_size, GLRO(dl_pagesize)); |
350 | void *stack = __mmap (NULL, stack_size, prot, | |
351 | MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0); | |
352 | if (__glibc_unlikely (stack == MAP_FAILED)) | |
4b4d4056 | 353 | return errno; |
9ff72da4 AZ |
354 | |
355 | /* Disable asynchronous cancellation. */ | |
706e6749 AZ |
356 | int state; |
357 | __libc_ptf_call (__pthread_setcancelstate, | |
358 | (PTHREAD_CANCEL_DISABLE, &state), 0); | |
9ff72da4 | 359 | |
4b4d4056 RV |
360 | /* Child must set args.err to something non-negative - we rely on |
361 | the parent and child sharing VM. */ | |
fe05e1cb | 362 | args.err = 0; |
9ff72da4 AZ |
363 | args.file = file; |
364 | args.exec = exec; | |
365 | args.fa = file_actions; | |
366 | args.attr = attrp ? attrp : &(const posix_spawnattr_t) { 0 }; | |
367 | args.argv = argv; | |
368 | args.argc = argc; | |
369 | args.envp = envp; | |
370 | args.xflags = xflags; | |
371 | ||
802c1c5a | 372 | __libc_signal_block_all (&args.oldmask); |
9ff72da4 AZ |
373 | |
374 | /* The clone flags used will create a new child that will run in the same | |
375 | memory space (CLONE_VM) and the execution of calling thread will be | |
4b4d4056 RV |
376 | suspend until the child calls execve or _exit. |
377 | ||
9ff72da4 AZ |
378 | Also since the calling thread execution will be suspend, there is not |
379 | need for CLONE_SETTLS. Although parent and child share the same TLS | |
380 | namespace, there will be no concurrent access for TLS variables (errno | |
381 | for instance). */ | |
382 | new_pid = CLONE (__spawni_child, STACK (stack, stack_size), stack_size, | |
383 | CLONE_VM | CLONE_VFORK | SIGCHLD, &args); | |
384 | ||
fe05e1cb AZ |
385 | /* It needs to collect the case where the auxiliary process was created |
386 | but failed to execute the file (due either any preparation step or | |
387 | for execve itself). */ | |
9ff72da4 AZ |
388 | if (new_pid > 0) |
389 | { | |
fe05e1cb AZ |
390 | /* Also, it handles the unlikely case where the auxiliary process was |
391 | terminated before calling execve as if it was successfully. The | |
392 | args.err is set to 0 as default and changed to a positive value | |
393 | only in case of failure, so in case of premature termination | |
394 | due a signal args.err will remain zeroed and it will be up to | |
395 | caller to actually collect it. */ | |
4b4d4056 | 396 | ec = args.err; |
fe05e1cb AZ |
397 | if (ec > 0) |
398 | /* There still an unlikely case where the child is cancelled after | |
aa95a241 | 399 | setting args.err, due to a positive error value. Also there is |
fe05e1cb | 400 | possible pid reuse race (where the kernel allocated the same pid |
aa95a241 AZ |
401 | to an unrelated process). Unfortunately due synchronization |
402 | issues where the kernel might not have the process collected | |
403 | the waitpid below can not use WNOHANG. */ | |
404 | __waitpid (new_pid, NULL, 0); | |
9ff72da4 AZ |
405 | } |
406 | else | |
407 | ec = -new_pid; | |
408 | ||
409 | __munmap (stack, stack_size); | |
410 | ||
67b23376 | 411 | if ((ec == 0) && (pid != NULL)) |
9ff72da4 AZ |
412 | *pid = new_pid; |
413 | ||
802c1c5a | 414 | __libc_signal_restore_set (&args.oldmask); |
9ff72da4 | 415 | |
706e6749 | 416 | __libc_ptf_call (__pthread_setcancelstate, (state, NULL), 0); |
9ff72da4 AZ |
417 | |
418 | return ec; | |
419 | } | |
420 | ||
421 | /* Spawn a new process executing PATH with the attributes describes in *ATTRP. | |
422 | Before running the process perform the actions described in FILE-ACTIONS. */ | |
423 | int | |
424 | __spawni (pid_t * pid, const char *file, | |
425 | const posix_spawn_file_actions_t * acts, | |
426 | const posix_spawnattr_t * attrp, char *const argv[], | |
427 | char *const envp[], int xflags) | |
428 | { | |
283d9851 AZ |
429 | /* It uses __execvpex to avoid run ENOEXEC in non compatibility mode (it |
430 | will be handled by maybe_script_execute). */ | |
9ff72da4 | 431 | return __spawnix (pid, file, acts, attrp, argv, envp, xflags, |
283d9851 | 432 | xflags & SPAWN_XFLAGS_USE_PATH ? __execvpex :__execve); |
9ff72da4 | 433 | } |