Commit Graph

13 Commits

Author SHA1 Message Date
4862864fc1 fix unsigned comparison bug in posix_spawn
read should never return anything but 0 or sizeof ec here, but if it
does, we want to treat any other return as "success". then the caller
will get back the pid and is responsible for waiting on it when it
immediately exits.
2013-02-03 17:09:47 -05:00
fb6b159d9e overhaul posix_spawn to use CLONE_VM instead of vfork
the proposed change was described in detail in detail previously on
the mailing list. in short, vfork is unsafe because:

1. the compiler could make optimizations that cause the child to
clobber the parent's local vars.

2. strace is buggy and allows the vforking parent to run before the
child execs when run under strace.

the new design uses a close-on-exec pipe instead of vfork semantics to
synchronize the parent and child so that the parent does not return
before the child has finished using its arguments (and now, also its
stack). this also allows reporting exec failures to the caller instead
of giving the caller a child that mysteriously exits with status 127
on exec error.

basic testing has been performed on both the success and failure code
paths. further testing should be done.
2013-02-03 16:42:40 -05:00
599f973603 fix usage of locks with vfork
__release_ptc() is only valid in the parent; if it's performed in the
child, the lock will be unlocked early then double-unlocked later,
corrupting the lock state.
2012-10-19 15:02:37 -04:00
97c8bdd88a fix parent-memory-clobber in posix_spawn (environ) 2012-10-18 16:41:27 -04:00
44eb4d8b9b overhaul system() and popen() to use vfork; fix various related bugs
since we target systems without overcommit, special care should be
taken that system() and popen(), like posix_spawn(), do not fail in
processes whose commit charges are too high to allow ordinary forking.

this in turn requires special precautions to ensure that the parent
process's signal handlers do not end up running in the shared-memory
child, where they could corrupt the state of the parent process.

popen has also been updated to use pipe2, so it does not have a
fd-leak race in multi-threaded programs. since pipe2 is missing on
older kernels, (non-atomic) emulation has been added.

some silly bugs in the old code should be gone too.
2012-10-18 15:58:23 -04:00
d5304147b9 block uid/gid changes during posix_spawn
usage of vfork creates a situation where a process of lower privilege
may momentarily have write access to the memory of a process of higher
privilege.

consider the case of a multi-threaded suid program which is calling
posix_spawn in one thread while another thread drops the elevated
privileges then runs untrusted (relative to the elevated privilege)
code as the original invoking user. this untrusted code can then
potentially modify the data the child process will use before calling
exec, for example changing the pathname or arguments that will be
passed to exec.

note that if vfork is implemented as fork, the lock will not be held
until the child execs, but since memory is not shared it does not
matter.
2012-10-15 11:42:46 -04:00
d62f4e9888 use vfork if possible in posix_spawn
vfork is implemented as the fork syscall (with no atfork handlers run)
on archs where it is not available, so this change does not introduce
any change in behavior or regression for such archs.
2012-09-14 15:32:51 -04:00
400c5e5c83 use restrict everywhere it's required by c99 and/or posix 2008
to deal with the fact that the public headers may be used with pre-c99
compilers, __restrict is used in place of restrict, and defined
appropriately for any supported compiler. we also avoid the form
[restrict] since older versions of gcc rejected it due to a bug in the
original c99 standard, and instead use the form *restrict.
2012-09-06 22:44:55 -04:00
13cd969552 fix various errors in function signatures/prototypes found by nsz 2011-09-13 21:09:35 -04:00
f48832ee15 fix backwards posix_spawn file action order 2011-05-29 12:58:02 -04:00
a0ae0b0936 add file actions support to posix_spawn 2011-05-28 23:30:47 -04:00
d6c0c97846 posix_spawn: honor POSIX_SPAWN_SETSIGDEF flag 2011-05-28 18:39:43 -04:00
c97f0d998c initial implementation of posix_spawn
file actions are not yet implemented, but everything else should be
mostly complete and roughly correct.
2011-05-28 18:36:30 -04:00