215 lines
5.3 KiB
C
215 lines
5.3 KiB
C
#define _GNU_SOURCE
|
|
#include <spawn.h>
|
|
#include <sched.h>
|
|
#include <unistd.h>
|
|
#include <signal.h>
|
|
#include <fcntl.h>
|
|
#include <sys/wait.h>
|
|
#include "syscall.h"
|
|
#include "lock.h"
|
|
#include "pthread_impl.h"
|
|
#include "fdop.h"
|
|
|
|
struct args {
|
|
int p[2];
|
|
sigset_t oldmask;
|
|
const char *path;
|
|
const posix_spawn_file_actions_t *fa;
|
|
const posix_spawnattr_t *restrict attr;
|
|
char *const *argv, *const *envp;
|
|
};
|
|
|
|
static int __sys_dup2(int old, int new)
|
|
{
|
|
#ifdef SYS_dup2
|
|
return __syscall(SYS_dup2, old, new);
|
|
#else
|
|
return __syscall(SYS_dup3, old, new, 0);
|
|
#endif
|
|
}
|
|
|
|
static int child(void *args_vp)
|
|
{
|
|
int i, ret;
|
|
struct sigaction sa = {0};
|
|
struct args *args = args_vp;
|
|
int p = args->p[1];
|
|
const posix_spawn_file_actions_t *fa = args->fa;
|
|
const posix_spawnattr_t *restrict attr = args->attr;
|
|
sigset_t hset;
|
|
|
|
close(args->p[0]);
|
|
|
|
/* All signal dispositions must be either SIG_DFL or SIG_IGN
|
|
* before signals are unblocked. Otherwise a signal handler
|
|
* from the parent might get run in the child while sharing
|
|
* memory, with unpredictable and dangerous results. To
|
|
* reduce overhead, sigaction has tracked for us which signals
|
|
* potentially have a signal handler. */
|
|
__get_handler_set(&hset);
|
|
for (i=1; i<_NSIG; i++) {
|
|
if ((attr->__flags & POSIX_SPAWN_SETSIGDEF)
|
|
&& sigismember(&attr->__def, i)) {
|
|
sa.sa_handler = SIG_DFL;
|
|
} else if (sigismember(&hset, i)) {
|
|
if (i-32<3U) {
|
|
sa.sa_handler = SIG_IGN;
|
|
} else {
|
|
__libc_sigaction(i, 0, &sa);
|
|
if (sa.sa_handler==SIG_IGN) continue;
|
|
sa.sa_handler = SIG_DFL;
|
|
}
|
|
} else {
|
|
continue;
|
|
}
|
|
__libc_sigaction(i, &sa, 0);
|
|
}
|
|
|
|
if (attr->__flags & POSIX_SPAWN_SETSID)
|
|
if ((ret=__syscall(SYS_setsid)) < 0)
|
|
goto fail;
|
|
|
|
if (attr->__flags & POSIX_SPAWN_SETPGROUP)
|
|
if ((ret=__syscall(SYS_setpgid, 0, attr->__pgrp)))
|
|
goto fail;
|
|
|
|
/* Use syscalls directly because the library functions attempt
|
|
* to do a multi-threaded synchronized id-change, which would
|
|
* trash the parent's state. */
|
|
if (attr->__flags & POSIX_SPAWN_RESETIDS)
|
|
if ((ret=__syscall(SYS_setgid, __syscall(SYS_getgid))) ||
|
|
(ret=__syscall(SYS_setuid, __syscall(SYS_getuid))) )
|
|
goto fail;
|
|
|
|
if (fa && fa->__actions) {
|
|
struct fdop *op;
|
|
int fd;
|
|
for (op = fa->__actions; op->next; op = op->next);
|
|
for (; op; op = op->prev) {
|
|
/* It's possible that a file operation would clobber
|
|
* the pipe fd used for synchronizing with the
|
|
* parent. To avoid that, we dup the pipe onto
|
|
* an unoccupied fd. */
|
|
if (op->fd == p) {
|
|
ret = __syscall(SYS_dup, p);
|
|
if (ret < 0) goto fail;
|
|
__syscall(SYS_close, p);
|
|
p = ret;
|
|
}
|
|
switch(op->cmd) {
|
|
case FDOP_CLOSE:
|
|
__syscall(SYS_close, op->fd);
|
|
break;
|
|
case FDOP_DUP2:
|
|
fd = op->srcfd;
|
|
if (fd == p) {
|
|
ret = -EBADF;
|
|
goto fail;
|
|
}
|
|
if (fd != op->fd) {
|
|
if ((ret=__sys_dup2(fd, op->fd))<0)
|
|
goto fail;
|
|
} else {
|
|
ret = __syscall(SYS_fcntl, fd, F_GETFD);
|
|
ret = __syscall(SYS_fcntl, fd, F_SETFD,
|
|
ret & ~FD_CLOEXEC);
|
|
if (ret<0)
|
|
goto fail;
|
|
}
|
|
break;
|
|
case FDOP_OPEN:
|
|
fd = __sys_open(op->path, op->oflag, op->mode);
|
|
if ((ret=fd) < 0) goto fail;
|
|
if (fd != op->fd) {
|
|
if ((ret=__sys_dup2(fd, op->fd))<0)
|
|
goto fail;
|
|
__syscall(SYS_close, fd);
|
|
}
|
|
break;
|
|
case FDOP_CHDIR:
|
|
ret = __syscall(SYS_chdir, op->path);
|
|
if (ret<0) goto fail;
|
|
break;
|
|
case FDOP_FCHDIR:
|
|
ret = __syscall(SYS_fchdir, op->fd);
|
|
if (ret<0) goto fail;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Close-on-exec flag may have been lost if we moved the pipe
|
|
* to a different fd. We don't use F_DUPFD_CLOEXEC above because
|
|
* it would fail on older kernels and atomicity is not needed --
|
|
* in this process there are no threads or signal handlers. */
|
|
__syscall(SYS_fcntl, p, F_SETFD, FD_CLOEXEC);
|
|
|
|
pthread_sigmask(SIG_SETMASK, (attr->__flags & POSIX_SPAWN_SETSIGMASK)
|
|
? &attr->__mask : &args->oldmask, 0);
|
|
|
|
int (*exec)(const char *, char *const *, char *const *) =
|
|
attr->__fn ? (int (*)())attr->__fn : execve;
|
|
|
|
exec(args->path, args->argv, args->envp);
|
|
ret = -errno;
|
|
|
|
fail:
|
|
/* Since sizeof errno < PIPE_BUF, the write is atomic. */
|
|
ret = -ret;
|
|
if (ret) while (__syscall(SYS_write, p, &ret, sizeof ret) < 0);
|
|
_exit(127);
|
|
}
|
|
|
|
|
|
int posix_spawn(pid_t *restrict res, const char *restrict path,
|
|
const posix_spawn_file_actions_t *fa,
|
|
const posix_spawnattr_t *restrict attr,
|
|
char *const argv[restrict], char *const envp[restrict])
|
|
{
|
|
pid_t pid;
|
|
char stack[1024+PATH_MAX];
|
|
int ec=0, cs;
|
|
struct args args;
|
|
|
|
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
|
|
|
|
args.path = path;
|
|
args.fa = fa;
|
|
args.attr = attr ? attr : &(const posix_spawnattr_t){0};
|
|
args.argv = argv;
|
|
args.envp = envp;
|
|
pthread_sigmask(SIG_BLOCK, SIGALL_SET, &args.oldmask);
|
|
|
|
/* The lock guards both against seeing a SIGABRT disposition change
|
|
* by abort and against leaking the pipe fd to fork-without-exec. */
|
|
LOCK(__abort_lock);
|
|
|
|
if (pipe2(args.p, O_CLOEXEC)) {
|
|
UNLOCK(__abort_lock);
|
|
ec = errno;
|
|
goto fail;
|
|
}
|
|
|
|
pid = __clone(child, stack+sizeof stack,
|
|
CLONE_VM|CLONE_VFORK|SIGCHLD, &args);
|
|
close(args.p[1]);
|
|
UNLOCK(__abort_lock);
|
|
|
|
if (pid > 0) {
|
|
if (read(args.p[0], &ec, sizeof ec) != sizeof ec) ec = 0;
|
|
else waitpid(pid, &(int){0}, 0);
|
|
} else {
|
|
ec = -pid;
|
|
}
|
|
|
|
close(args.p[0]);
|
|
|
|
if (!ec && res) *res = pid;
|
|
|
|
fail:
|
|
pthread_sigmask(SIG_SETMASK, &args.oldmask, 0);
|
|
pthread_setcancelstate(cs, 0);
|
|
|
|
return ec;
|
|
}
|