1 /* Copyright (C) 1991-2022 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <https://www.gnu.org/licenses/>. */
26 #include <hurd/signal.h>
31 /* Overlay TASK, executing FILE with arguments ARGV and environment ENVP.
32 If TASK == mach_task_self (), some ports are dealloc'd by the exec server.
33 ARGV and ENVP are terminated by NULL pointers.
34 Deprecated: use _hurd_exec_paths instead. */
36 _hurd_exec (task_t task
, file_t file
,
37 char *const argv
[], char *const envp
[])
39 return _hurd_exec_paths (task
, file
, NULL
, NULL
, argv
, envp
);
42 link_warning (_hurd_exec
,
43 "_hurd_exec is deprecated, use _hurd_exec_paths instead");
45 /* Overlay TASK, executing FILE with arguments ARGV and environment ENVP.
46 If TASK == mach_task_self (), some ports are dealloc'd by the exec server.
47 ARGV and ENVP are terminated by NULL pointers. PATH is the relative path to
48 FILE and ABSPATH is the absolute path to FILE. Passing NULL, though possible,
49 should be avoided, since then the exec server may not know the path to
50 FILE if FILE is a script, and will then pass /dev/fd/N to the
53 _hurd_exec_paths (task_t task
, file_t file
,
54 const char *path
, const char *abspath
,
55 char *const argv
[], char *const envp
[])
59 size_t argslen
, envlen
;
60 int ints
[INIT_INT_MAX
];
61 mach_port_t ports
[_hurd_nports
];
62 struct hurd_userlink ulink_ports
[_hurd_nports
];
63 inline void free_port (unsigned int i
)
65 _hurd_port_free (&_hurd_ports
[i
], &ulink_ports
[i
], ports
[i
]);
68 unsigned int dtablesize
, i
, j
;
69 struct hurd_port
**dtable_cells
;
70 struct hurd_userlink
*ulink_dtable
;
71 struct hurd_sigstate
*ss
;
72 mach_port_t
*please_dealloc
, *pdp
;
74 mach_port_t
*portnames
= NULL
;
75 mach_msg_type_number_t nportnames
= 0;
76 mach_port_type_t
*porttypes
= NULL
;
77 mach_msg_type_number_t nporttypes
= 0;
79 /* XXX needs to be hurdmalloc XXX */
81 args
= NULL
, argslen
= 0;
82 else if (err
= __argz_create (argv
, &args
, &argslen
))
85 env
= NULL
, envlen
= 0;
86 else if (err
= __argz_create (envp
, &env
, &envlen
))
89 /* Load up the ports to give to the new program. */
90 for (i
= 0; i
< _hurd_nports
; ++i
)
91 if (i
== INIT_PORT_PROC
&& task
!= __mach_task_self ())
93 /* This is another task, so we need to ask the proc server
94 for the right proc server port for it. */
95 if (err
= __USEPORT (PROC
, __proc_task2proc (port
, task
, &ports
[i
])))
103 ports
[i
] = _hurd_port_get (&_hurd_ports
[i
], &ulink_ports
[i
]);
106 /* Load up the ints to give the new program. */
107 for (i
= 0; i
< INIT_INT_MAX
; ++i
)
111 ints
[i
] = _hurd_umask
;
116 case INIT_SIGPENDING
:
117 /* We will set these all below. */
121 ints
[i
] = _hurdsig_traced
;
128 ss
= _hurd_self_sigstate ();
131 assert (! __spin_lock_locked (&ss
->critical_section_lock
));
132 __spin_lock (&ss
->critical_section_lock
);
134 _hurd_sigstate_lock (ss
);
135 struct sigaction
*actions
= _hurd_sigstate_actions (ss
);
136 ints
[INIT_SIGMASK
] = ss
->blocked
;
137 ints
[INIT_SIGPENDING
] = _hurd_sigstate_pending (ss
);
138 ints
[INIT_SIGIGN
] = 0;
139 for (i
= 1; i
< NSIG
; ++i
)
140 if (actions
[i
].sa_handler
== SIG_IGN
)
141 ints
[INIT_SIGIGN
] |= __sigmask (i
);
143 /* We hold the sigstate lock until the exec has failed so that no signal
144 can arrive between when we pack the blocked and ignored signals, and
145 when the exec actually happens. A signal handler could change what
146 signals are blocked and ignored. Either the change will be reflected
147 in the exec, or the signal will never be delivered. Setting the
148 critical section flag avoids anything we call trying to acquire the
151 _hurd_sigstate_unlock (ss
);
153 /* Pack up the descriptor table to give the new program. */
154 __mutex_lock (&_hurd_dtable_lock
);
156 dtablesize
= _hurd_dtable
? _hurd_dtablesize
: _hurd_init_dtablesize
;
158 if (task
== __mach_task_self ())
159 /* Request the exec server to deallocate some ports from us if the exec
160 succeeds. The init ports and descriptor ports will arrive in the
161 new program's exec_startup message. If we failed to deallocate
162 them, the new program would have duplicate user references for them.
163 But we cannot deallocate them ourselves, because we must still have
164 them after a failed exec call. */
165 please_dealloc
= __alloca ((_hurd_nports
+ 3 + (3 * dtablesize
))
166 * sizeof (mach_port_t
));
168 please_dealloc
= NULL
;
169 pdp
= please_dealloc
;
171 if (_hurd_dtable
!= NULL
)
173 dtable
= __alloca (dtablesize
* sizeof (dtable
[0]));
174 ulink_dtable
= __alloca (dtablesize
* sizeof (ulink_dtable
[0]));
175 dtable_cells
= __alloca (dtablesize
* sizeof (dtable_cells
[0]));
176 for (i
= 0; i
< dtablesize
; ++i
)
178 struct hurd_fd
*const d
= _hurd_dtable
[i
];
181 dtable
[i
] = MACH_PORT_NULL
;
184 __spin_lock (&d
->port
.lock
);
185 if (d
->flags
& FD_CLOEXEC
)
187 /* This descriptor is marked to be closed on exec.
188 So don't pass it to the new program. */
189 dtable
[i
] = MACH_PORT_NULL
;
190 if (pdp
&& d
->port
.port
!= MACH_PORT_NULL
)
192 /* We still need to deallocate the ports. */
193 *pdp
++ = d
->port
.port
;
194 if (d
->ctty
.port
!= MACH_PORT_NULL
)
195 *pdp
++ = d
->ctty
.port
;
197 __spin_unlock (&d
->port
.lock
);
201 if (pdp
&& d
->ctty
.port
!= MACH_PORT_NULL
)
202 /* All the elements of DTABLE are added to PLEASE_DEALLOC
203 below, so we needn't add the port itself.
204 But we must deallocate the ctty port as well as
205 the normal port that got installed in DTABLE[I]. */
206 *pdp
++ = d
->ctty
.port
;
207 dtable
[i
] = _hurd_port_locked_get (&d
->port
, &ulink_dtable
[i
]);
208 dtable_cells
[i
] = &d
->port
;
214 dtable
= _hurd_init_dtable
;
219 /* Prune trailing null ports from the descriptor table. */
220 while (dtablesize
> 0 && dtable
[dtablesize
- 1] == MACH_PORT_NULL
)
223 /* See if we need to diddle the auth port of the new program.
224 The purpose of this is to get the effect setting the saved-set UID and
225 GID to the respective effective IDs after the exec, as POSIX.1 requires.
226 Note that we don't reauthenticate with the proc server; that would be a
227 no-op since it only keeps track of the effective UIDs, and if it did
228 keep track of the available IDs we would have the problem that we'd be
229 changing the IDs before the exec and have to change them back after a
230 failure. Arguably we could skip all the reauthentications because the
231 available IDs have no bearing on any filesystem. But the conservative
232 approach is to reauthenticate all the io ports so that no state anywhere
233 reflects that our whole ID set differs from what we've set it to. */
234 __mutex_lock (&_hurd_id
.lock
);
235 err
= _hurd_check_ids ();
237 /* Avoid leaking the rid_auth port reference to the new progam */
238 if (_hurd_id
.rid_auth
!= MACH_PORT_NULL
)
240 __mach_port_deallocate (__mach_task_self (), _hurd_id
.rid_auth
);
241 _hurd_id
.rid_auth
= MACH_PORT_NULL
;
244 if (err
== 0 && ((_hurd_id
.aux
.nuids
>= 2 && _hurd_id
.gen
.nuids
>= 1
245 && _hurd_id
.aux
.uids
[1] != _hurd_id
.gen
.uids
[0])
246 || (_hurd_id
.aux
.ngids
>= 2 && _hurd_id
.gen
.ngids
>= 1
247 && _hurd_id
.aux
.gids
[1] != _hurd_id
.gen
.gids
[0])))
249 /* We have euid != svuid or egid != svgid. POSIX.1 says that exec
250 sets svuid = euid and svgid = egid. So we must get a new auth
251 port and reauthenticate everything with it. We'll pass the new
252 ports in file_exec_paths instead of our own ports. */
256 _hurd_id
.aux
.uids
[1] = _hurd_id
.gen
.uids
[0];
257 _hurd_id
.aux
.gids
[1] = _hurd_id
.gen
.gids
[0];
260 err
= __auth_makeauth (ports
[INIT_PORT_AUTH
],
261 NULL
, MACH_MSG_TYPE_COPY_SEND
, 0,
262 _hurd_id
.gen
.uids
, _hurd_id
.gen
.nuids
,
263 _hurd_id
.aux
.uids
, _hurd_id
.aux
.nuids
,
264 _hurd_id
.gen
.gids
, _hurd_id
.gen
.ngids
,
265 _hurd_id
.aux
.gids
, _hurd_id
.aux
.ngids
,
269 /* Now we have to reauthenticate the ports with this new ID.
272 inline error_t
reauth_io (io_t port
, io_t
*newport
)
274 mach_port_t ref
= __mach_reply_port ();
275 *newport
= MACH_PORT_NULL
;
276 error_t err
= __io_reauthenticate (port
,
277 ref
, MACH_MSG_TYPE_MAKE_SEND
);
279 err
= __auth_user_authenticate (newauth
,
280 ref
, MACH_MSG_TYPE_MAKE_SEND
,
282 __mach_port_destroy (__mach_task_self (), ref
);
285 inline void reauth_port (unsigned int idx
)
288 err
= reauth_io (ports
[idx
], &newport
) ?: err
;
290 *pdp
++ = ports
[idx
]; /* XXX presumed still in _hurd_ports */
292 ports
[idx
] = newport
;
296 *pdp
++ = ports
[INIT_PORT_AUTH
];
297 free_port (INIT_PORT_AUTH
);
298 ports
[INIT_PORT_AUTH
] = newauth
;
300 reauth_port (INIT_PORT_CRDIR
);
301 reauth_port (INIT_PORT_CWDIR
);
305 /* Now we'll reauthenticate each file descriptor. */
306 if (ulink_dtable
== NULL
)
308 assert (dtable
== _hurd_init_dtable
);
309 dtable
= __alloca (dtablesize
* sizeof (dtable
[0]));
310 for (i
= 0; i
< dtablesize
; ++i
)
311 if (_hurd_init_dtable
[i
] != MACH_PORT_NULL
)
314 *pdp
++ = _hurd_init_dtable
[i
];
315 err
= reauth_io (_hurd_init_dtable
[i
], &dtable
[i
]);
318 while (++i
< dtablesize
)
319 dtable
[i
] = MACH_PORT_NULL
;
324 dtable
[i
] = MACH_PORT_NULL
;
330 /* Ask to deallocate all the old fd ports,
331 since we will have new ones in DTABLE. */
332 memcpy (pdp
, dtable
, dtablesize
* sizeof pdp
[0]);
335 for (i
= 0; i
< dtablesize
; ++i
)
336 if (dtable
[i
] != MACH_PORT_NULL
)
339 err
= reauth_io (dtable
[i
], &newport
);
340 _hurd_port_free (dtable_cells
[i
], &ulink_dtable
[i
],
345 while (++i
< dtablesize
)
346 _hurd_port_free (dtable_cells
[i
],
347 &ulink_dtable
[i
], dtable
[i
]);
359 __mutex_unlock (&_hurd_id
.lock
);
361 /* The information is all set up now. Try to exec the file. */
368 /* Get all ports that we may not know about and we should thus destroy. */
369 /* XXX need to disable other threads to be safe. */
370 if (err
= __mach_port_names (__mach_task_self (),
371 &portnames
, &nportnames
,
372 &porttypes
, &nporttypes
))
374 if (nportnames
!= nporttypes
)
377 /* Request the exec server to deallocate some ports from us if
378 the exec succeeds. The init ports and descriptor ports will
379 arrive in the new program's exec_startup message. If we
380 failed to deallocate them, the new program would have
381 duplicate user references for them. But we cannot deallocate
382 them ourselves, because we must still have them after a failed
385 for (i
= 0; i
< _hurd_nports
; ++i
)
386 if (ports
[i
] != MACH_PORT_NULL
)
389 for (j
= 0; j
< nportnames
; j
++)
390 if (portnames
[j
] == ports
[i
])
391 portnames
[j
] = MACH_PORT_NULL
;
393 for (i
= 0; i
< dtablesize
; ++i
)
394 if (dtable
[i
] != MACH_PORT_NULL
)
397 for (j
= 0; j
< nportnames
; j
++)
398 if (portnames
[j
] == dtable
[i
])
399 portnames
[j
] = MACH_PORT_NULL
;
402 /* Pack ports to be destroyed together. */
403 for (i
= 0, j
= 0; i
< nportnames
; i
++)
405 if (portnames
[i
] == MACH_PORT_NULL
)
408 portnames
[j
] = portnames
[i
];
416 /* PTRACE_TRACEME sets all bits in _hurdsig_traced, which is
417 propagated through exec by INIT_TRACEMASK, so this checks if
418 PTRACE_TRACEME has been called in this process in any of its
419 current or prior lives. */
420 if (__sigismember (&_hurdsig_traced
, SIGKILL
))
421 flags
|= EXEC_SIGTRAP
;
423 err
= __file_exec_paths (file
, task
, flags
,
425 abspath
? abspath
: "",
426 args
, argslen
, env
, envlen
,
427 dtable
, MACH_MSG_TYPE_COPY_SEND
, dtablesize
,
428 ports
, MACH_MSG_TYPE_COPY_SEND
,
431 please_dealloc
, pdp
- please_dealloc
,
432 portnames
, nportnames
);
433 /* Fall back for backwards compatibility. This can just be removed
434 when __file_exec goes away. */
435 if (err
== MIG_BAD_ID
)
436 err
= __file_exec (file
, task
, flags
,
437 args
, argslen
, env
, envlen
,
438 dtable
, MACH_MSG_TYPE_COPY_SEND
, dtablesize
,
439 ports
, MACH_MSG_TYPE_COPY_SEND
, _hurd_nports
,
441 please_dealloc
, pdp
- please_dealloc
,
442 portnames
, nportnames
);
445 /* Release references to the standard ports. */
446 for (i
= 0; i
< _hurd_nports
; ++i
)
447 if ((i
== INIT_PORT_PROC
&& task
!= __mach_task_self ())
448 || (reauth
&& (i
== INIT_PORT_AUTH
449 || i
== INIT_PORT_CRDIR
|| i
== INIT_PORT_CWDIR
)))
450 __mach_port_deallocate (__mach_task_self (), ports
[i
]);
454 /* Release references to the file descriptor ports. */
455 if (ulink_dtable
!= NULL
)
457 for (i
= 0; i
< dtablesize
; ++i
)
458 if (dtable
[i
] != MACH_PORT_NULL
)
459 _hurd_port_free (dtable_cells
[i
], &ulink_dtable
[i
], dtable
[i
]);
461 else if (dtable
&& dtable
!= _hurd_init_dtable
)
462 for (i
= 0; i
< dtablesize
; ++i
)
463 __mach_port_deallocate (__mach_task_self (), dtable
[i
]);
465 /* Release lock on the file descriptor table. */
466 __mutex_unlock (&_hurd_dtable_lock
);
468 /* Safe to let signals happen now. */
469 _hurd_critical_section_unlock (ss
);
471 /* Got a signal while inside an RPC of the critical section, retry again */
480 libc_hidden_def (_hurd_exec_paths
)