diff options
author | Ondřej Surý <ondrej@sury.org> | 2011-09-13 13:11:55 +0200 |
---|---|---|
committer | Ondřej Surý <ondrej@sury.org> | 2011-09-13 13:11:55 +0200 |
commit | 80f18fc933cf3f3e829c5455a1023d69f7b86e52 (patch) | |
tree | 4b825dc642cb6eb9a060e54bf8d69288fbee4904 /src/pkg/syscall/exec_unix.go | |
parent | 28592ee1ea1f5cdffcf85472f9de0285d928cf12 (diff) | |
download | golang-80f18fc933cf3f3e829c5455a1023d69f7b86e52.tar.gz |
Imported Upstream version 60
Diffstat (limited to 'src/pkg/syscall/exec_unix.go')
-rw-r--r-- | src/pkg/syscall/exec_unix.go | 426 |
1 files changed, 0 insertions, 426 deletions
diff --git a/src/pkg/syscall/exec_unix.go b/src/pkg/syscall/exec_unix.go deleted file mode 100644 index 46f05efef..000000000 --- a/src/pkg/syscall/exec_unix.go +++ /dev/null @@ -1,426 +0,0 @@ -// Copyright 2009 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// Fork, exec, wait, etc. - -package syscall - -import ( - "sync" - "unsafe" -) - -// Lock synchronizing creation of new file descriptors with fork. -// -// We want the child in a fork/exec sequence to inherit only the -// file descriptors we intend. To do that, we mark all file -// descriptors close-on-exec and then, in the child, explicitly -// unmark the ones we want the exec'ed program to keep. -// Unix doesn't make this easy: there is, in general, no way to -// allocate a new file descriptor close-on-exec. Instead you -// have to allocate the descriptor and then mark it close-on-exec. -// If a fork happens between those two events, the child's exec -// will inherit an unwanted file descriptor. -// -// This lock solves that race: the create new fd/mark close-on-exec -// operation is done holding ForkLock for reading, and the fork itself -// is done holding ForkLock for writing. At least, that's the idea. -// There are some complications. -// -// Some system calls that create new file descriptors can block -// for arbitrarily long times: open on a hung NFS server or named -// pipe, accept on a socket, and so on. We can't reasonably grab -// the lock across those operations. -// -// It is worse to inherit some file descriptors than others. -// If a non-malicious child accidentally inherits an open ordinary file, -// that's not a big deal. On the other hand, if a long-lived child -// accidentally inherits the write end of a pipe, then the reader -// of that pipe will not see EOF until that child exits, potentially -// causing the parent program to hang. This is a common problem -// in threaded C programs that use popen. -// -// Luckily, the file descriptors that are most important not to -// inherit are not the ones that can take an arbitrarily long time -// to create: pipe returns instantly, and the net package uses -// non-blocking I/O to accept on a listening socket. -// The rules for which file descriptor-creating operations use the -// ForkLock are as follows: -// -// 1) Pipe. Does not block. Use the ForkLock. -// 2) Socket. Does not block. Use the ForkLock. -// 3) Accept. If using non-blocking mode, use the ForkLock. -// Otherwise, live with the race. -// 4) Open. Can block. Use O_CLOEXEC if available (Linux). -// Otherwise, live with the race. -// 5) Dup. Does not block. Use the ForkLock. -// On Linux, could use fcntl F_DUPFD_CLOEXEC -// instead of the ForkLock, but only for dup(fd, -1). - -var ForkLock sync.RWMutex - -// Convert array of string to array -// of NUL-terminated byte pointer. -func StringSlicePtr(ss []string) []*byte { - bb := make([]*byte, len(ss)+1) - for i := 0; i < len(ss); i++ { - bb[i] = StringBytePtr(ss[i]) - } - bb[len(ss)] = nil - return bb -} - -func CloseOnExec(fd int) { fcntl(fd, F_SETFD, FD_CLOEXEC) } - -func SetNonblock(fd int, nonblocking bool) (errno int) { - flag, err := fcntl(fd, F_GETFL, 0) - if err != 0 { - return err - } - if nonblocking { - flag |= O_NONBLOCK - } else { - flag &= ^O_NONBLOCK - } - _, err = fcntl(fd, F_SETFL, flag) - return err -} - - -// Fork, dup fd onto 0..len(fd), and exec(argv0, argvv, envv) in child. -// If a dup or exec fails, write the errno int to pipe. -// (Pipe is close-on-exec so if exec succeeds, it will be closed.) -// In the child, this function must not acquire any locks, because -// they might have been locked at the time of the fork. This means -// no rescheduling, no malloc calls, and no new stack segments. -// The calls to RawSyscall are okay because they are assembly -// functions that do not grow the stack. -func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err int) { - // Declare all variables at top in case any - // declarations require heap allocation (e.g., err1). - var r1, r2, err1 uintptr - var nextfd int - var i int - - // guard against side effects of shuffling fds below. - fd := append([]int(nil), attr.Files...) - - darwin := OS == "darwin" - - // About to call fork. - // No more allocation or calls of non-assembly functions. - r1, r2, err1 = RawSyscall(SYS_FORK, 0, 0, 0) - if err1 != 0 { - return 0, int(err1) - } - - // On Darwin: - // r1 = child pid in both parent and child. - // r2 = 0 in parent, 1 in child. - // Convert to normal Unix r1 = 0 in child. - if darwin && r2 == 1 { - r1 = 0 - } - - if r1 != 0 { - // parent; return PID - return int(r1), 0 - } - - // Fork succeeded, now in child. - - // Enable tracing if requested. - if sys.Ptrace { - _, _, err1 = RawSyscall(SYS_PTRACE, uintptr(PTRACE_TRACEME), 0, 0) - if err1 != 0 { - goto childerror - } - } - - // Session ID - if sys.Setsid { - _, _, err1 = RawSyscall(SYS_SETSID, 0, 0, 0) - if err1 != 0 { - goto childerror - } - } - - // Set process group - if sys.Setpgid { - _, _, err1 = RawSyscall(SYS_SETPGID, 0, 0, 0) - if err1 != 0 { - goto childerror - } - } - - // Chroot - if chroot != nil { - _, _, err1 = RawSyscall(SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0) - if err1 != 0 { - goto childerror - } - } - - // User and groups - if cred := sys.Credential; cred != nil { - ngroups := uintptr(len(cred.Groups)) - groups := uintptr(0) - if ngroups > 0 { - groups = uintptr(unsafe.Pointer(&cred.Groups[0])) - } - _, _, err1 = RawSyscall(SYS_SETGROUPS, ngroups, groups, 0) - if err1 != 0 { - goto childerror - } - _, _, err1 = RawSyscall(SYS_SETGID, uintptr(cred.Gid), 0, 0) - if err1 != 0 { - goto childerror - } - _, _, err1 = RawSyscall(SYS_SETUID, uintptr(cred.Uid), 0, 0) - if err1 != 0 { - goto childerror - } - } - - // Chdir - if dir != nil { - _, _, err1 = RawSyscall(SYS_CHDIR, uintptr(unsafe.Pointer(dir)), 0, 0) - if err1 != 0 { - goto childerror - } - } - - // Pass 1: look for fd[i] < i and move those up above len(fd) - // so that pass 2 won't stomp on an fd it needs later. - nextfd = int(len(fd)) - if pipe < nextfd { - _, _, err1 = RawSyscall(SYS_DUP2, uintptr(pipe), uintptr(nextfd), 0) - if err1 != 0 { - goto childerror - } - RawSyscall(SYS_FCNTL, uintptr(nextfd), F_SETFD, FD_CLOEXEC) - pipe = nextfd - nextfd++ - } - for i = 0; i < len(fd); i++ { - if fd[i] >= 0 && fd[i] < int(i) { - _, _, err1 = RawSyscall(SYS_DUP2, uintptr(fd[i]), uintptr(nextfd), 0) - if err1 != 0 { - goto childerror - } - RawSyscall(SYS_FCNTL, uintptr(nextfd), F_SETFD, FD_CLOEXEC) - fd[i] = nextfd - nextfd++ - if nextfd == pipe { // don't stomp on pipe - nextfd++ - } - } - } - - // Pass 2: dup fd[i] down onto i. - for i = 0; i < len(fd); i++ { - if fd[i] == -1 { - RawSyscall(SYS_CLOSE, uintptr(i), 0, 0) - continue - } - if fd[i] == int(i) { - // dup2(i, i) won't clear close-on-exec flag on Linux, - // probably not elsewhere either. - _, _, err1 = RawSyscall(SYS_FCNTL, uintptr(fd[i]), F_SETFD, 0) - if err1 != 0 { - goto childerror - } - continue - } - // The new fd is created NOT close-on-exec, - // which is exactly what we want. - _, _, err1 = RawSyscall(SYS_DUP2, uintptr(fd[i]), uintptr(i), 0) - if err1 != 0 { - goto childerror - } - } - - // By convention, we don't close-on-exec the fds we are - // started with, so if len(fd) < 3, close 0, 1, 2 as needed. - // Programs that know they inherit fds >= 3 will need - // to set them close-on-exec. - for i = len(fd); i < 3; i++ { - RawSyscall(SYS_CLOSE, uintptr(i), 0, 0) - } - - // Detach fd 0 from tty - if sys.Noctty { - _, _, err1 = RawSyscall(SYS_IOCTL, 0, uintptr(TIOCNOTTY), 0) - if err1 != 0 { - goto childerror - } - } - - // Make fd 0 the tty - if sys.Setctty { - _, _, err1 = RawSyscall(SYS_IOCTL, 0, uintptr(TIOCSCTTY), 0) - if err1 != 0 { - goto childerror - } - } - - // Time to exec. - _, _, err1 = RawSyscall(SYS_EXECVE, - uintptr(unsafe.Pointer(argv0)), - uintptr(unsafe.Pointer(&argv[0])), - uintptr(unsafe.Pointer(&envv[0]))) - -childerror: - // send error code on pipe - RawSyscall(SYS_WRITE, uintptr(pipe), uintptr(unsafe.Pointer(&err1)), unsafe.Sizeof(err1)) - for { - RawSyscall(SYS_EXIT, 253, 0, 0) - } - - // Calling panic is not actually safe, - // but the for loop above won't break - // and this shuts up the compiler. - panic("unreached") -} - -// Credential holds user and group identities to be assumed -// by a child process started by StartProcess. -type Credential struct { - Uid uint32 // User ID. - Gid uint32 // Group ID. - Groups []uint32 // Supplementary group IDs. -} - -// ProcAttr holds attributes that will be applied to a new process started -// by StartProcess. -type ProcAttr struct { - Dir string // Current working directory. - Env []string // Environment. - Files []int // File descriptors. - Sys *SysProcAttr -} - -type SysProcAttr struct { - Chroot string // Chroot. - Credential *Credential // Credential. - Ptrace bool // Enable tracing. - Setsid bool // Create session. - Setpgid bool // Set process group ID to new pid (SYSV setpgrp) - Setctty bool // Set controlling terminal to fd 0 - Noctty bool // Detach fd 0 from controlling terminal -} - -var zeroProcAttr ProcAttr -var zeroSysProcAttr SysProcAttr - -func forkExec(argv0 string, argv []string, attr *ProcAttr) (pid int, err int) { - var p [2]int - var n int - var err1 uintptr - var wstatus WaitStatus - - if attr == nil { - attr = &zeroProcAttr - } - sys := attr.Sys - if sys == nil { - sys = &zeroSysProcAttr - } - - p[0] = -1 - p[1] = -1 - - // Convert args to C form. - argv0p := StringBytePtr(argv0) - argvp := StringSlicePtr(argv) - envvp := StringSlicePtr(attr.Env) - - if OS == "freebsd" && len(argv[0]) > len(argv0) { - argvp[0] = argv0p - } - - var chroot *byte - if sys.Chroot != "" { - chroot = StringBytePtr(sys.Chroot) - } - var dir *byte - if attr.Dir != "" { - dir = StringBytePtr(attr.Dir) - } - - // Acquire the fork lock so that no other threads - // create new fds that are not yet close-on-exec - // before we fork. - ForkLock.Lock() - - // Allocate child status pipe close on exec. - if err = Pipe(p[0:]); err != 0 { - goto error - } - if _, err = fcntl(p[0], F_SETFD, FD_CLOEXEC); err != 0 { - goto error - } - if _, err = fcntl(p[1], F_SETFD, FD_CLOEXEC); err != 0 { - goto error - } - - // Kick off child. - pid, err = forkAndExecInChild(argv0p, argvp, envvp, chroot, dir, attr, sys, p[1]) - if err != 0 { - goto error - } - ForkLock.Unlock() - - // Read child error status from pipe. - Close(p[1]) - n, err = read(p[0], (*byte)(unsafe.Pointer(&err1)), int(unsafe.Sizeof(err1))) - Close(p[0]) - if err != 0 || n != 0 { - if n == int(unsafe.Sizeof(err1)) { - err = int(err1) - } - if err == 0 { - err = EPIPE - } - - // Child failed; wait for it to exit, to make sure - // the zombies don't accumulate. - _, err1 := Wait4(pid, &wstatus, 0, nil) - for err1 == EINTR { - _, err1 = Wait4(pid, &wstatus, 0, nil) - } - return 0, err - } - - // Read got EOF, so pipe closed on exec, so exec succeeded. - return pid, 0 - -error: - if p[0] >= 0 { - Close(p[0]) - Close(p[1]) - } - ForkLock.Unlock() - return 0, err -} - -// Combination of fork and exec, careful to be thread safe. -func ForkExec(argv0 string, argv []string, attr *ProcAttr) (pid int, err int) { - return forkExec(argv0, argv, attr) -} - -// StartProcess wraps ForkExec for package os. -func StartProcess(argv0 string, argv []string, attr *ProcAttr) (pid, handle int, err int) { - pid, err = forkExec(argv0, argv, attr) - return pid, 0, err -} - -// Ordinary exec. -func Exec(argv0 string, argv []string, envv []string) (err int) { - _, _, err1 := RawSyscall(SYS_EXECVE, - uintptr(unsafe.Pointer(StringBytePtr(argv0))), - uintptr(unsafe.Pointer(&StringSlicePtr(argv)[0])), - uintptr(unsafe.Pointer(&StringSlicePtr(envv)[0]))) - return int(err1) -} |