1 #define _GNU_SOURCE
2 #include <spawn.h>
3 #include <sched.h>
4 #include <unistd.h>
5 #include <signal.h>
6 #include <fcntl.h>
7 #include <sys/wait.h>
8 #include <unsupported_api.h>
9 #include "syscall.h"
10 #include "lock.h"
11 #include "pthread_impl.h"
12 #include "fdop.h"
13
14 struct args {
15 int p[2];
16 sigset_t oldmask;
17 const char *path;
18 const posix_spawn_file_actions_t *fa;
19 const posix_spawnattr_t *restrict attr;
20 char *const *argv, *const *envp;
21 };
22
__sys_dup2(int old,int new)23 static int __sys_dup2(int old, int new)
24 {
25 #ifdef SYS_dup2
26 return __syscall(SYS_dup2, old, new);
27 #else
28 return __syscall(SYS_dup3, old, new, 0);
29 #endif
30 }
31
child(void * args_vp)32 static int child(void *args_vp)
33 {
34 int i, ret;
35 struct sigaction sa = {0};
36 struct args *args = args_vp;
37 int p = args->p[1];
38 const posix_spawn_file_actions_t *fa = args->fa;
39 const posix_spawnattr_t *restrict attr = args->attr;
40 sigset_t hset;
41
42 close(args->p[0]);
43
44 /* All signal dispositions must be either SIG_DFL or SIG_IGN
45 * before signals are unblocked. Otherwise a signal handler
46 * from the parent might get run in the child while sharing
47 * memory, with unpredictable and dangerous results. To
48 * reduce overhead, sigaction has tracked for us which signals
49 * potentially have a signal handler. */
50 __get_handler_set(&hset);
51 for (i=1; i<_NSIG; i++) {
52 if ((attr->__flags & POSIX_SPAWN_SETSIGDEF)
53 && sigismember(&attr->__def, i)) {
54 sa.sa_handler = SIG_DFL;
55 } else if (sigismember(&hset, i)) {
56 if (i-32<3U) {
57 sa.sa_handler = SIG_IGN;
58 } else {
59 __libc_sigaction(i, 0, &sa);
60 if (sa.sa_handler==SIG_IGN) continue;
61 sa.sa_handler = SIG_DFL;
62 }
63 } else {
64 continue;
65 }
66 __libc_sigaction(i, &sa, 0);
67 }
68
69 if (attr->__flags & POSIX_SPAWN_SETSID)
70 if ((ret=__syscall(SYS_setsid)) < 0)
71 goto fail;
72
73 if (attr->__flags & POSIX_SPAWN_SETPGROUP)
74 if ((ret=__syscall(SYS_setpgid, 0, attr->__pgrp)))
75 goto fail;
76
77 /* Use syscalls directly because the library functions attempt
78 * to do a multi-threaded synchronized id-change, which would
79 * trash the parent's state. */
80 if (attr->__flags & POSIX_SPAWN_RESETIDS)
81 if ((ret=__syscall(SYS_setgid, __syscall(SYS_getgid))) ||
82 (ret=__syscall(SYS_setuid, __syscall(SYS_getuid))) )
83 goto fail;
84
85 if (fa && fa->__actions) {
86 struct fdop *op;
87 int fd;
88 for (op = fa->__actions; op->next; op = op->next);
89 for (; op; op = op->prev) {
90 /* It's possible that a file operation would clobber
91 * the pipe fd used for synchronizing with the
92 * parent. To avoid that, we dup the pipe onto
93 * an unoccupied fd. */
94 if (op->fd == p) {
95 ret = __syscall(SYS_dup, p);
96 if (ret < 0) goto fail;
97 __syscall(SYS_close, p);
98 p = ret;
99 }
100 switch(op->cmd) {
101 case FDOP_CLOSE:
102 __syscall(SYS_close, op->fd);
103 break;
104 case FDOP_DUP2:
105 fd = op->srcfd;
106 if (fd == p) {
107 ret = -EBADF;
108 goto fail;
109 }
110 if (fd != op->fd) {
111 if ((ret=__sys_dup2(fd, op->fd))<0)
112 goto fail;
113 } else {
114 ret = __syscall(SYS_fcntl, fd, F_GETFD);
115 ret = __syscall(SYS_fcntl, fd, F_SETFD,
116 ret & ~FD_CLOEXEC);
117 if (ret<0)
118 goto fail;
119 }
120 break;
121 case FDOP_OPEN:
122 fd = __sys_open(op->path, op->oflag, op->mode);
123 if ((ret=fd) < 0) goto fail;
124 if (fd != op->fd) {
125 if ((ret=__sys_dup2(fd, op->fd))<0)
126 goto fail;
127 __syscall(SYS_close, fd);
128 }
129 break;
130 case FDOP_CHDIR:
131 ret = __syscall(SYS_chdir, op->path);
132 if (ret<0) goto fail;
133 break;
134 case FDOP_FCHDIR:
135 ret = __syscall(SYS_fchdir, op->fd);
136 if (ret<0) goto fail;
137 break;
138 }
139 }
140 }
141
142 /* Close-on-exec flag may have been lost if we moved the pipe
143 * to a different fd. We don't use F_DUPFD_CLOEXEC above because
144 * it would fail on older kernels and atomicity is not needed --
145 * in this process there are no threads or signal handlers. */
146 __syscall(SYS_fcntl, p, F_SETFD, FD_CLOEXEC);
147
148 pthread_sigmask(SIG_SETMASK, (attr->__flags & POSIX_SPAWN_SETSIGMASK)
149 ? &attr->__mask : &args->oldmask, 0);
150
151 int (*exec)(const char *, char *const *, char *const *) =
152 attr->__fn ? (int (*)())attr->__fn : execve;
153
154 exec(args->path, args->argv, args->envp);
155 ret = -errno;
156
157 fail:
158 /* Since sizeof errno < PIPE_BUF, the write is atomic. */
159 ret = -ret;
160 if (ret) while (__syscall(SYS_write, p, &ret, sizeof ret) < 0);
161 _exit(127);
162 }
163
164
posix_spawn(pid_t * restrict res,const char * restrict path,const posix_spawn_file_actions_t * fa,const posix_spawnattr_t * restrict attr,char * const argv[restrict],char * const envp[restrict])165 int posix_spawn(pid_t *restrict res, const char *restrict path,
166 const posix_spawn_file_actions_t *fa,
167 const posix_spawnattr_t *restrict attr,
168 char *const argv[restrict], char *const envp[restrict])
169 {
170 pid_t pid;
171 char stack[1024+PATH_MAX];
172 int ec=0, cs;
173 struct args args;
174
175 unsupported_api(__FUNCTION__);
176
177 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
178
179 args.path = path;
180 args.fa = fa;
181 args.attr = attr ? attr : &(const posix_spawnattr_t){0};
182 args.argv = argv;
183 args.envp = envp;
184 pthread_sigmask(SIG_BLOCK, SIGALL_SET, &args.oldmask);
185
186 /* The lock guards both against seeing a SIGABRT disposition change
187 * by abort and against leaking the pipe fd to fork-without-exec. */
188 LOCK(__abort_lock);
189
190 if (pipe2(args.p, O_CLOEXEC)) {
191 UNLOCK(__abort_lock);
192 ec = errno;
193 goto fail;
194 }
195
196 pid = __clone(child, stack+sizeof stack,
197 CLONE_VM|CLONE_VFORK|SIGCHLD, &args);
198 close(args.p[1]);
199 UNLOCK(__abort_lock);
200
201 if (pid > 0) {
202 if (read(args.p[0], &ec, sizeof ec) != sizeof ec) ec = 0;
203 else waitpid(pid, &(int){0}, 0);
204 } else {
205 ec = -pid;
206 }
207
208 close(args.p[0]);
209
210 if (!ec && res) *res = pid;
211
212 fail:
213 pthread_sigmask(SIG_SETMASK, &args.oldmask, 0);
214 pthread_setcancelstate(cs, 0);
215
216 return ec;
217 }
218