src/timeout.c

   1 /* timeout -- run a command with bounded time
   2    Copyright (C) 2008-2011 Free Software Foundation, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  16
  17
  18 /* timeout - Start a command, and kill it if the specified timeout expires
  19
  20    We try to behave like a shell starting a single (foreground) job,
  21    and will kill the job if we receive the alarm signal we setup.
  22    The exit status of the job is returned, or one of these errors:
  23      EXIT_TIMEDOUT      124      job timed out
  24      EXIT_CANCELED      125      internal error
  25      EXIT_CANNOT_INVOKE 126      error executing job
  26      EXIT_ENOENT        127      couldn't find job to exec
  27
  28    Caveats:
  29      If user specifies the KILL (9) signal is to be sent on timeout,
  30      the monitor is killed and so exits with 128+9 rather than 124.
  31
  32      If you start a command in the background, which reads from the tty
  33      and so is immediately sent SIGTTIN to stop, then the timeout
  34      process will ignore this so it can timeout the command as expected.
  35      This can be seen with `timeout 10 dd&` for example.
  36      However if one brings this group to the foreground with the `fg`
  37      command before the timer expires, the command will remain
  38      in the stop state as the shell doesn't send a SIGCONT
  39      because the timeout process (group leader) is already running.
  40      To get the command running again one can Ctrl-Z, and do fg again.
  41      Note one can Ctrl-C the whole job when in this state.
  42      I think this could be fixed but I'm not sure the extra
  43      complication is justified for this scenario.
  44
  45    Written by Pádraig Brady.  */
  46
  47 #include <config.h>
  48 #include <getopt.h>
  49 #include <stdio.h>
  50 #include <sys/types.h>
  51 #include <signal.h>
  52 #include <sys/wait.h>
  53
  54 #include "system.h"
  55 #include "c-strtod.h"
  56 #include "xstrtod.h"
  57 #include "sig2str.h"
  58 #include "operand2sig.h"
  59 #include "error.h"
  60 #include "quote.h"
  61
  62 #if HAVE_SETRLIMIT
  63 /* FreeBSD 5.0 at least needs <sys/types.h> and <sys/time.h> included
  64    before <sys/resource.h>.  Currently "system.h" includes <sys/time.h>.  */
  65 # include <sys/resource.h>
  66 #endif
  67
  68 /* NonStop circa 2011 lacks both SA_RESTART and siginterrupt.  */
  69 #ifndef SA_RESTART
  70 # define SA_RESTART 0
  71 #endif
  72
  73 #define PROGRAM_NAME "timeout"
  74
  75 #define AUTHORS proper_name_utf8 ("Padraig Brady", "P\303\241draig Brady")
  76
  77 static int timed_out;
  78 static int term_signal = SIGTERM;  /* same default as kill command.  */
  79 static int monitored_pid;
  80 static int sigs_to_ignore[NSIG];   /* so monitor can ignore sigs it resends.  */
  81 static double kill_after;
  82 static bool foreground;            /* whether to use another program group.  */
  83
  84 /* for long options with no corresponding short option, use enum */
  85 enum
  86 {
  87       FOREGROUND_OPTION = CHAR_MAX + 1
  88 };
  89
  90 static struct option const long_options[] =
  91 {
  92   {"kill-after", required_argument, NULL, 'k'},
  93   {"signal", required_argument, NULL, 's'},
  94   {"foreground", no_argument, NULL, FOREGROUND_OPTION},
  95   {GETOPT_HELP_OPTION_DECL},
  96   {GETOPT_VERSION_OPTION_DECL},
  97   {NULL, 0, NULL, 0}
  98 };
  99
 100 /* Start the timeout after which we'll receive a SIGALRM.
 101    Round DURATION up to the next representable value.
 102    Treat out-of-range values as if they were maximal,
 103    as that's more useful in practice than reporting an error.
 104    '0' means don't timeout.  */
 105 static void
 106 settimeout (double duration)
 107 {
 108 /* timer_settime() provides potentially nanosecond resolution.
 109    setitimer() is more portable (to Darwin for example),
 110    but only provides microsecond resolution and thus is
 111    a little more awkward to use with timespecs, as well as being
 112    deprecated by POSIX.  Instead we fallback to single second
 113    resolution provided by alarm().  */
 114
 115 #if HAVE_TIMER_SETTIME
 116   struct timespec ts = dtotimespec (duration);
 117   struct itimerspec its = { {0, 0}, ts };
 118   timer_t timerid;
 119   int timer_ret = timer_create (CLOCK_REALTIME, NULL, &timerid);
 120   if (timer_ret == 0)
 121     {
 122       if (timer_settime (timerid, 0, &its, NULL) == 0)
 123         return;
 124       else
 125         {
 126           error (0, errno, _("warning: timer_settime"));
 127           timer_delete (timerid);
 128         }
 129     }
 130   else if (timer_ret != ENOSYS)
 131     error (0, errno, _("warning: timer_create"));
 132 #endif
 133
 134   unsigned int timeint;
 135   if (UINT_MAX <= duration)
 136     timeint = UINT_MAX;
 137   else
 138     {
 139       unsigned int duration_floor = duration;
 140       timeint = duration_floor + (duration_floor < duration);
 141     }
 142   alarm (timeint);
 143 }
 144
 145 /* send sig to group but not ourselves.
 146  * FIXME: Is there a better way to achieve this?  */
 147 static int
 148 send_sig (int where, int sig)
 149 {
 150   sigs_to_ignore[sig] = 1;
 151   return kill (where, sig);
 152 }
 153
 154 static void
 155 cleanup (int sig)
 156 {
 157   if (sig == SIGALRM)
 158     {
 159       timed_out = 1;
 160       sig = term_signal;
 161     }
 162   if (monitored_pid)
 163     {
 164       if (sigs_to_ignore[sig])
 165         {
 166           sigs_to_ignore[sig] = 0;
 167           return;
 168         }
 169       if (kill_after)
 170         {
 171           /* Start a new timeout after which we'll send SIGKILL.  */
 172           term_signal = SIGKILL;
 173           settimeout (kill_after);
 174           kill_after = 0; /* Don't let later signals reset kill alarm.  */
 175         }
 176
 177       /* Send the signal directly to the monitored child,
 178          in case it has itself become group leader,
 179          or is not running in a separate group.  */
 180       send_sig (monitored_pid, sig);
 181       /* The normal case is the job has remained in our
 182          newly created process group, so send to all processes in that.  */
 183       if (!foreground)
 184         send_sig (0, sig);
 185       if (sig != SIGKILL && sig != SIGCONT)
 186         {
 187           send_sig (monitored_pid, SIGCONT);
 188           if (!foreground)
 189             send_sig (0, SIGCONT);
 190         }
 191     }
 192   else /* we're the child or the child is not exec'd yet.  */
 193     _exit (128 + sig);
 194 }
 195
 196 void
 197 usage (int status)
 198 {
 199   if (status != EXIT_SUCCESS)
 200     fprintf (stderr, _("Try `%s --help' for more information.\n"),
 201              program_name);
 202   else
 203     {
 204       printf (_("\
 205 Usage: %s [OPTION] DURATION COMMAND [ARG]...\n\
 206   or:  %s [OPTION]\n"), program_name, program_name);
 207
 208       fputs (_("\
 209 Start COMMAND, and kill it if still running after DURATION.\n\
 210 \n\
 211 Mandatory arguments to long options are mandatory for short options too.\n\
 212 "), stdout);
 213       fputs (_("\
 214       --foreground\n\
 215                  When not running timeout directly from a shell prompt,\n\
 216                  allow COMMAND to read from the TTY and receive TTY signals.\n\
 217                  In this mode, children of COMMAND will not be timed out.\n\
 218   -k, --kill-after=DURATION\n\
 219                  also send a KILL signal if COMMAND is still running\n\
 220                  this long after the initial signal was sent.\n\
 221   -s, --signal=SIGNAL\n\
 222                  specify the signal to be sent on timeout.\n\
 223                  SIGNAL may be a name like `HUP' or a number.\n\
 224                  See `kill -l` for a list of signals\n"), stdout);
 225
 226       fputs (HELP_OPTION_DESCRIPTION, stdout);
 227       fputs (VERSION_OPTION_DESCRIPTION, stdout);
 228
 229       fputs (_("\n\
 230 DURATION is a floating point number with an optional suffix:\n\
 231 `s' for seconds (the default), `m' for minutes, `h' for hours \
 232 or `d' for days.\n"), stdout);
 233
 234       fputs (_("\n\
 235 If the command times out, then exit with status 124.  Otherwise, exit\n\
 236 with the status of COMMAND.  If no signal is specified, send the TERM\n\
 237 signal upon timeout.  The TERM signal kills any process that does not\n\
 238 block or catch that signal.  For other processes, it may be necessary to\n\
 239 use the KILL (9) signal, since this signal cannot be caught.\n"), stdout);
 240       emit_ancillary_info ();
 241     }
 242   exit (status);
 243 }
 244
 245 /* Given a floating point value *X, and a suffix character, SUFFIX_CHAR,
 246    scale *X by the multiplier implied by SUFFIX_CHAR.  SUFFIX_CHAR may
 247    be the NUL byte or `s' to denote seconds, `m' for minutes, `h' for
 248    hours, or `d' for days.  If SUFFIX_CHAR is invalid, don't modify *X
 249    and return false.  Otherwise return true.  */
 250
 251 static bool
 252 apply_time_suffix (double *x, char suffix_char)
 253 {
 254   int multiplier;
 255
 256   switch (suffix_char)
 257     {
 258     case 0:
 259     case 's':
 260       multiplier = 1;
 261       break;
 262     case 'm':
 263       multiplier = 60;
 264       break;
 265     case 'h':
 266       multiplier = 60 * 60;
 267       break;
 268     case 'd':
 269       multiplier = 60 * 60 * 24;
 270       break;
 271     default:
 272       return false;
 273     }
 274
 275   *x *= multiplier;
 276
 277   return true;
 278 }
 279
 280 static double
 281 parse_duration (const char* str)
 282 {
 283   double duration;
 284   const char *ep;
 285
 286   if (!xstrtod (str, &ep, &duration, c_strtod)
 287       /* Nonnegative interval.  */
 288       || ! (0 <= duration)
 289       /* No extra chars after the number and an optional s,m,h,d char.  */
 290       || (*ep && *(ep + 1))
 291       /* Check any suffix char and update timeout based on the suffix.  */
 292       || !apply_time_suffix (&duration, *ep))
 293     {
 294       error (0, 0, _("invalid time interval %s"), quote (str));
 295       usage (EXIT_CANCELED);
 296     }
 297
 298   return duration;
 299 }
 300
 301 static void
 302 install_signal_handlers (int sigterm)
 303 {
 304   struct sigaction sa;
 305   sigemptyset (&sa.sa_mask);  /* Allow concurrent calls to handler */
 306   sa.sa_handler = cleanup;
 307   sa.sa_flags = SA_RESTART;   /* Restart syscalls if possible, as that's
 308                                  more likely to work cleanly.  */
 309
 310   sigaction (SIGALRM, &sa, NULL); /* our timeout.  */
 311   sigaction (SIGINT, &sa, NULL);  /* Ctrl-C at terminal for example.  */
 312   sigaction (SIGQUIT, &sa, NULL); /* Ctrl-\ at terminal for example.  */
 313   sigaction (SIGHUP, &sa, NULL);  /* terminal closed for example.  */
 314   sigaction (SIGTERM, &sa, NULL); /* if we're killed, stop monitored proc.  */
 315   sigaction (sigterm, &sa, NULL); /* user specified termination signal.  */
 316 }
 317
 318 int
 319 main (int argc, char **argv)
 320 {
 321   double timeout;
 322   char signame[SIG2STR_MAX];
 323   int c;
 324
 325   initialize_main (&argc, &argv);
 326   set_program_name (argv[0]);
 327   setlocale (LC_ALL, "");
 328   bindtextdomain (PACKAGE, LOCALEDIR);
 329   textdomain (PACKAGE);
 330
 331   initialize_exit_failure (EXIT_CANCELED);
 332   atexit (close_stdout);
 333
 334   while ((c = getopt_long (argc, argv, "+k:s:", long_options, NULL)) != -1)
 335     {
 336       switch (c)
 337         {
 338         case 'k':
 339           kill_after = parse_duration (optarg);
 340           break;
 341
 342         case 's':
 343           term_signal = operand2sig (optarg, signame);
 344           if (term_signal == -1)
 345             usage (EXIT_CANCELED);
 346           break;
 347
 348         case FOREGROUND_OPTION:
 349           foreground = true;
 350           break;
 351
 352         case_GETOPT_HELP_CHAR;
 353
 354         case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
 355
 356         default:
 357           usage (EXIT_CANCELED);
 358           break;
 359         }
 360     }
 361
 362   if (argc - optind < 2)
 363     usage (EXIT_CANCELED);
 364
 365   timeout = parse_duration (argv[optind++]);
 366
 367   argv += optind;
 368
 369   /* Ensure we're in our own group so all subprocesses can be killed.
 370      Note we don't just put the child in a separate group as
 371      then we would need to worry about foreground and background groups
 372      and propagating signals between them.  */
 373   if (!foreground)
 374     setpgid (0, 0);
 375
 376   /* Setup handlers before fork() so that we
 377      handle any signals caused by child, without races.  */
 378   install_signal_handlers (term_signal);
 379   signal (SIGTTIN, SIG_IGN);   /* Don't stop if background child needs tty.  */
 380   signal (SIGTTOU, SIG_IGN);   /* Don't stop if background child needs tty.  */
 381   signal (SIGCHLD, SIG_DFL);   /* Don't inherit CHLD handling from parent.   */
 382
 383   monitored_pid = fork ();
 384   if (monitored_pid == -1)
 385     {
 386       error (0, errno, _("fork system call failed"));
 387       return EXIT_CANCELED;
 388     }
 389   else if (monitored_pid == 0)
 390     {                           /* child */
 391       int exit_status;
 392
 393       /* exec doesn't reset SIG_IGN -> SIG_DFL.  */
 394       signal (SIGTTIN, SIG_DFL);
 395       signal (SIGTTOU, SIG_DFL);
 396
 397       execvp (argv[0], argv);   /* FIXME: should we use "sh -c" ... here?  */
 398
 399       /* exit like sh, env, nohup, ...  */
 400       exit_status = (errno == ENOENT ? EXIT_ENOENT : EXIT_CANNOT_INVOKE);
 401       error (0, errno, _("failed to run command %s"), quote (argv[0]));
 402       return exit_status;
 403     }
 404   else
 405     {
 406       pid_t wait_result;
 407       int status;
 408
 409       settimeout (timeout);
 410
 411       while ((wait_result = waitpid (monitored_pid, &status, 0)) < 0
 412              && errno == EINTR)
 413         continue;
 414
 415       if (wait_result < 0)
 416         {
 417           /* shouldn't happen.  */
 418           error (0, errno, _("error waiting for command"));
 419           status = EXIT_CANCELED;
 420         }
 421       else
 422         {
 423           if (WIFEXITED (status))
 424             status = WEXITSTATUS (status);
 425           else if (WIFSIGNALED (status))
 426             {
 427               int sig = WTERMSIG (status);
 428 /* The following is not used as one cannot disable processing
 429    by a filter in /proc/sys/kernel/core_pattern on Linux.  */
 430 #if 0 && HAVE_SETRLIMIT && defined RLIMIT_CORE
 431               if (!timed_out)
 432                 {
 433                   /* exit with the signal flag set, but avoid core files.  */
 434                   if (setrlimit (RLIMIT_CORE, &(struct rlimit) {0,0}) == 0)
 435                     {
 436                       signal (sig, SIG_DFL);
 437                       raise (sig);
 438                     }
 439                   else
 440                     error (0, errno, _("warning: disabling core dumps failed"));
 441                 }
 442 #endif
 443               status = sig + 128; /* what sh returns for signaled processes.  */
 444             }
 445           else
 446             {
 447               /* shouldn't happen.  */
 448               error (0, 0, _("unknown status from command (0x%X)"), status);
 449               status = EXIT_FAILURE;
 450             }
 451         }
 452
 453       if (timed_out)
 454         return EXIT_TIMEDOUT;
 455       else
 456         return status;
 457     }
 458 }