path: root/src/spawn-posix.c

/* exechelp.c - Fork and exec helpers for POSIX
 * Copyright (C) 2004, 2007-2009, 2010 Free Software Foundation, Inc.
 * Copyright (C) 2004, 2006-2012, 2014-2017 g10 Code GmbH
 *
 * This file is part of Libgpg-error.
 *
 * Libgpg-error is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * Libgpg-error is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this program; if not, see <https://www.gnu.org/licenses/>.
 * SPDX-License-Identifier: LGPL-2.1+
 *
 * This file was originally a part of GnuPG.
 */

#include <config.h>

#if defined(HAVE_W32_SYSTEM) || defined (HAVE_W32CE_SYSTEM)
#error This code is only used on POSIX
#endif

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <errno.h>
#include <assert.h>
#ifdef HAVE_SIGNAL_H
# include <signal.h>
#endif
#include <unistd.h>
#include <fcntl.h>

#include <sys/wait.h>

#ifdef HAVE_GETRLIMIT
#include <sys/time.h>
#include <sys/resource.h>
#endif /*HAVE_GETRLIMIT*/

#ifdef HAVE_STAT
# include <sys/stat.h>
#endif

#if __linux__
# include <sys/types.h>
# include <dirent.h>
#endif /*__linux__ */

#include "gpgrt-int.h"


static void
out_of_core (int line)
{
  _gpgrt_log_fatal ("malloc failed at line %d: %s\n",
                    line, _gpg_strerror (_gpg_err_code_from_syserror ()));
  /*NOTREACHED*/
}


/* Return the maximum number of currently allowed open file
 * descriptors.  Only useful on POSIX systems but returns a value on
 * other systems too.  */
static int
get_max_fds (void)
{
  int max_fds = -1;
#ifdef HAVE_GETRLIMIT
  struct rlimit rl;

  /* Under Linux we can figure out the highest used file descriptor by
   * reading /proc/PID/fd.  This is in the common cases much fast than
   * for example doing 4096 close calls where almost all of them will
   * fail.  On a system with a limit of 4096 files and only 8 files
   * open with the highest number being 10, we speedup close_all_fds
   * from 125ms to 0.4ms including readdir.
   *
   * Another option would be to close the file descriptors as returned
   * from reading that directory - however then we need to snapshot
   * that list before starting to close them.  */
#ifdef __linux__
  {
    DIR *dir = NULL;
    struct dirent *dir_entry;
    const char *s;
    int x;

    /* FIXME: Check gpgme on how to do this right on Linux.  */
    dir = opendir ("/proc/self/fd");
    if (dir)
      {
        while ((dir_entry = readdir (dir)))
          {
            s = dir_entry->d_name;
            if ( *s < '0' || *s > '9')
              continue;
            x = atoi (s);
            if (x > max_fds)
              max_fds = x;
          }
        closedir (dir);
      }
    if (max_fds != -1)
      return max_fds + 1;
    }
#endif /* __linux__ */


# ifdef RLIMIT_NOFILE
  if (!getrlimit (RLIMIT_NOFILE, &rl))
    max_fds = rl.rlim_max;
# endif

# ifdef RLIMIT_OFILE
  if (max_fds == -1 && !getrlimit (RLIMIT_OFILE, &rl))
    max_fds = rl.rlim_max;

# endif
#endif /*HAVE_GETRLIMIT*/

#ifdef _SC_OPEN_MAX
  if (max_fds == -1)
    {
      long int scres = sysconf (_SC_OPEN_MAX);
      if (scres >= 0)
        max_fds = scres;
    }
#endif

#ifdef _POSIX_OPEN_MAX
  if (max_fds == -1)
    max_fds = _POSIX_OPEN_MAX;
#endif

#ifdef OPEN_MAX
  if (max_fds == -1)
    max_fds = OPEN_MAX;
#endif

  if (max_fds == -1)
    max_fds = 256;  /* Arbitrary limit.  */

  /* AIX returns INT32_MAX instead of a proper value.  We assume that
     this is always an error and use an arbitrary limit.  */
#ifdef INT32_MAX
  if (max_fds == INT32_MAX)
    max_fds = 256;
#endif

  return max_fds;
}


/* Close all file descriptors starting with descriptor FIRST.  If
 * EXCEPT is not NULL, it is expected to be a list of file descriptors
 * which shall not be closed.  This list shall be sorted in ascending
 * order with the end marked by -1.  */
static void
close_all_fds (int first, int *except)
{
  int max_fd = get_max_fds ();
  int fd, i, except_start;

  if (except)
    {
      except_start = 0;
      for (fd=first; fd < max_fd; fd++)
        {
          for (i=except_start; except[i] != -1; i++)
            {
              if (except[i] == fd)
                {
                  /* If we found the descriptor in the exception list
                     we can start the next compare run at the next
                     index because the exception list is ordered.  */
                except_start = i + 1;
                break;
                }
            }
          if (except[i] == -1)
            close (fd);
        }
    }
  else
    {
      for (fd=first; fd < max_fd; fd++)
        close (fd);
    }

  _gpg_err_set_errno (0);
}


/* Returns an array with all currently open file descriptors.  The end
 * of the array is marked by -1.  The caller needs to release this
 * array using the *standard free* and not with xfree.  This allow the
 * use of this function right at startup even before libgcrypt has
 * been initialized.  Returns NULL on error and sets ERRNO
 * accordingly.
 *
 * FIXME: Needs to be adjusted for use here.
 */
#if 0
int *
get_all_open_fds (void)
{
  int *array;
  size_t narray;
  int fd, max_fd, idx;
#ifndef HAVE_STAT
  array = calloc (1, sizeof *array);
  if (array)
    array[0] = -1;
#else /*HAVE_STAT*/
  struct stat statbuf;

  max_fd = get_max_fds ();
  narray = 32;  /* If you change this change also t-exechelp.c.  */
  array = calloc (narray, sizeof *array);
  if (!array)
    return NULL;

  /* Note:  The list we return is ordered.  */
  for (idx=0, fd=0; fd < max_fd; fd++)
    if (!(fstat (fd, &statbuf) == -1 && errno == EBADF))
      {
        if (idx+1 >= narray)
          {
            int *tmp;

            narray += (narray < 256)? 32:256;
            tmp = realloc (array, narray * sizeof *array);
            if (!tmp)
              {
                free (array);
                return NULL;
              }
            array = tmp;
          }
        array[idx++] = fd;
      }
  array[idx] = -1;
#endif /*HAVE_STAT*/
  return array;
}
#endif /*0*/


/* The exec core used right after the fork.  This will never return.  */
static void
do_exec (const char *pgmname, const char *argv[],
         int fd_in, int fd_out, int fd_err,
         int *except, void (*preexec)(void) )
{
  char **arg_list;
  int i, j;
  int fds[3];

  fds[0] = fd_in;
  fds[1] = fd_out;
  fds[2] = fd_err;

  /* Create the command line argument array.  */
  i = 0;
  if (argv)
    while (argv[i])
      i++;
  arg_list = xtrycalloc (i+2, sizeof *arg_list);
  if (!arg_list)
    out_of_core (__LINE__);
  arg_list[0] = strrchr (pgmname, '/');
  if (arg_list[0])
    arg_list[0]++;
  else
    {
      arg_list[0] = xtrystrdup (pgmname);
      if (!arg_list[0])
        out_of_core (__LINE__);
    }
  if (argv)
    for (i=0,j=1; argv[i]; i++, j++)
      arg_list[j] = (char*)argv[i];

  /* Assign /dev/null to unused FDs. */
  for (i=0; i <= 2; i++)
    {
      if (fds[i] == -1 )
        {
          fds[i] = open ("/dev/null", i? O_WRONLY : O_RDONLY);
          if (fds[i] == -1)
            _gpgrt_log_fatal ("failed to open '%s': %s\n",
                              "/dev/null", strerror (errno));
        }
    }

  /* Connect the standard files.  */
  for (i=0; i <= 2; i++)
    {
      if (fds[i] != i && dup2 (fds[i], i) == -1)
        _gpgrt_log_fatal ("dup2 std%s failed: %s\n",
                          i==0?"in":i==1?"out":"err", strerror (errno));
    }

  /* Close all other files. */
  close_all_fds (3, except);

  if (preexec)
    preexec ();
  execv (pgmname, arg_list);
  /* No way to print anything, as we have may have closed all streams. */
  _exit (127);
}


/* Helper for _gpgrt_make_pipe.  */
static gpg_err_code_t
do_create_pipe (int filedes[2])
{
  gpg_error_t err = 0;

  _gpgrt_pre_syscall ();
  if (pipe (filedes) == -1)
    {
      err = _gpg_err_code_from_syserror ();
      filedes[0] = filedes[1] = -1;
    }
  _gpgrt_post_syscall ();

  return err;
}


/* Helper for _gpgrt_make_pipe.  */
static gpg_err_code_t
do_create_pipe_and_estream (int filedes[2], estream_t *r_fp,
                            int outbound, int nonblock)
{
  gpg_err_code_t err;

  _gpgrt_pre_syscall ();
  if (pipe (filedes) == -1)
    {
      err = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("error creating a pipe: %s\n"), _gpg_strerror (err));
      filedes[0] = filedes[1] = -1;
      *r_fp = NULL;
      return err;
    }
  _gpgrt_post_syscall ();

  if (!outbound)
    *r_fp = _gpgrt_fdopen (filedes[0], nonblock? "r,nonblock" : "r");
  else
    *r_fp = _gpgrt_fdopen (filedes[1], nonblock? "w,nonblock" : "w");
  if (!*r_fp)
    {
      err = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("error creating a stream for a pipe: %s\n"),
                        _gpg_strerror (err));
      close (filedes[0]);
      close (filedes[1]);
      filedes[0] = filedes[1] = -1;
      return err;
    }
  return 0;
}


/* Create a pipe.  The DIRECTION parameter gives the type of the created pipe:
 *   DIRECTION < 0 := Inbound pipe: On Windows the write end is inheritable.
 *   DIRECTION > 0 := Outbound pipe: On Windows the read end is inheritable.
 * If R_FP is NULL a standard pipe and no stream is created, DIRECTION
 * should then be 0.  */
gpg_err_code_t
_gpgrt_make_pipe (int filedes[2], estream_t *r_fp, int direction,
                  int nonblock)
{
  if (r_fp && direction)
    return do_create_pipe_and_estream (filedes, r_fp,
                                       (direction > 0), nonblock);
  else
    return do_create_pipe (filedes);
}


/* Fork and exec the PGMNAME, see gpgrt-int.h for details.  */
gpg_err_code_t
_gpgrt_spawn_process (const char *pgmname, const char *argv[],
                      int *except, void (*preexec)(void), unsigned int flags,
                      estream_t *r_infp,
                      estream_t *r_outfp,
                      estream_t *r_errfp,
                      pid_t *pid)
{
  gpg_error_t err;
  int inpipe[2] = {-1, -1};
  int outpipe[2] = {-1, -1};
  int errpipe[2] = {-1, -1};
  estream_t infp = NULL;
  estream_t outfp = NULL;
  estream_t errfp = NULL;
  int nonblock = !!(flags & GPGRT_SPAWN_NONBLOCK);

  if (r_infp)
    *r_infp = NULL;
  if (r_outfp)
    *r_outfp = NULL;
  if (r_errfp)
    *r_errfp = NULL;
  *pid = (pid_t)(-1); /* Always required.  */

  if (r_infp)
    {
      err = _gpgrt_create_outbound_pipe (inpipe, &infp, nonblock);
      if (err)
        return err;
    }

  if (r_outfp)
    {
      err = _gpgrt_create_inbound_pipe (outpipe, &outfp, nonblock);
      if (err)
        {
          if (infp)
            _gpgrt_fclose (infp);
          else if (inpipe[1] != -1)
            close (inpipe[1]);
          if (inpipe[0] != -1)
            close (inpipe[0]);

          return err;
        }
    }

  if (r_errfp)
    {
      err = _gpgrt_create_inbound_pipe (errpipe, &errfp, nonblock);
      if (err)
        {
          if (infp)
            _gpgrt_fclose (infp);
          else if (inpipe[1] != -1)
            close (inpipe[1]);
          if (inpipe[0] != -1)
            close (inpipe[0]);

          if (outfp)
            _gpgrt_fclose (outfp);
          else if (outpipe[0] != -1)
            close (outpipe[0]);
          if (outpipe[1] != -1)
            close (outpipe[1]);

          return err;
        }
    }

  _gpgrt_pre_syscall ();
  *pid = fork ();
  _gpgrt_post_syscall ();
  if (*pid == (pid_t)(-1))
    {
      err = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("error forking process: %s\n"), _gpg_strerror (err));

      if (infp)
        _gpgrt_fclose (infp);
      else if (inpipe[1] != -1)
        close (inpipe[1]);
      if (inpipe[0] != -1)
        close (inpipe[0]);

      if (outfp)
        _gpgrt_fclose (outfp);
      else if (outpipe[0] != -1)
        close (outpipe[0]);
      if (outpipe[1] != -1)
        close (outpipe[1]);

      if (errfp)
        _gpgrt_fclose (errfp);
      else if (errpipe[0] != -1)
        close (errpipe[0]);
      if (errpipe[1] != -1)
        close (errpipe[1]);
      return err;
    }

  if (!*pid)
    {
      /* This is the child. */
      /* FIXME: Needs to be done by preexec:
         gcry_control (GCRYCTL_TERM_SECMEM); */
      _gpgrt_fclose (infp);
      _gpgrt_fclose (outfp);
      _gpgrt_fclose (errfp);
      do_exec (pgmname, argv, inpipe[0], outpipe[1], errpipe[1],
               except, preexec);
      /*NOTREACHED*/
    }

  /* This is the parent. */
  if (inpipe[0] != -1)
    close (inpipe[0]);
  if (outpipe[1] != -1)
    close (outpipe[1]);
  if (errpipe[1] != -1)
    close (errpipe[1]);

  if (r_infp)
    *r_infp = infp;
  if (r_outfp)
    *r_outfp = outfp;
  if (r_errfp)
    *r_errfp = errfp;

  return 0;
}


/* Fork and exec the PGMNAME using FDs, see gpgrt-int.h for details.  */
gpg_err_code_t
_gpgrt_spawn_process_fd (const char *pgmname, const char *argv[],
                         int infd, int outfd, int errfd, pid_t *pid)
{
  gpg_error_t err;

  _gpgrt_pre_syscall ();
  *pid = fork ();
  _gpgrt_post_syscall ();
  if (*pid == (pid_t)(-1))
    {
      err = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("error forking process: %s\n"), _gpg_strerror (err));
      return err;
    }

  if (!*pid)
    {
      /* FIXME: We need to add a preexec so that a
           gcry_control (GCRYCTL_TERM_SECMEM);
         can be done.  */
      /* Run child. */
      do_exec (pgmname, argv, infd, outfd, errfd, NULL, NULL);
      /*NOTREACHED*/
    }

  return 0;
}


/* Waiting for child processes.
 *
 * waitpid(2) may return information about terminated children that we
 * did not yet request, and there is no portable way to wait for a
 * specific set of children.
 *
 * As a workaround, we store the results of children for later use.
 *
 * XXX: This assumes that PIDs are not reused too quickly.
 * FIXME: This is not thread-safe.
 */

struct terminated_child
{
  pid_t pid;
  int exitcode;
  struct terminated_child *next;
};

static struct terminated_child *terminated_children;


static gpg_err_code_t
store_result (pid_t pid, int exitcode)
{
  struct terminated_child *c;

  c = xtrymalloc (sizeof *c);
  if (c == NULL)
    return _gpg_err_code_from_syserror ();

  c->pid = pid;
  c->exitcode = exitcode;
  c->next = terminated_children;
  terminated_children = c;

  return 0;
}


static int
get_result (pid_t pid, int *r_exitcode)
{
  struct terminated_child *c, **prevp;

  for (prevp = &terminated_children, c = terminated_children;
       c;
       prevp = &c->next, c = c->next)
    if (c->pid == pid)
      {
        *prevp = c->next;
        *r_exitcode = c->exitcode;
        xfree (c);
        return 1;
      }

  return 0;
}


/* See gpgrt-int.h for a description.  */
gpg_err_code_t
_gpgrt_wait_process (const char *pgmname, pid_t pid, int hang, int *r_exitcode)
{
  gpg_err_code_t ec;
  int i, status;

  if (r_exitcode)
    *r_exitcode = -1;

  if (pid == (pid_t)(-1))
    return GPG_ERR_INV_VALUE;

  _gpgrt_pre_syscall ();
  while ((i=waitpid (pid, &status, hang? 0:WNOHANG)) == (pid_t)(-1)
	 && errno == EINTR);
  _gpgrt_post_syscall ();

  if (i == (pid_t)(-1))
    {
      ec = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("waiting for process %d to terminate failed: %s\n"),
                        (int)pid, _gpg_strerror (ec));
    }
  else if (!i)
    {
      ec = GPG_ERR_TIMEOUT; /* Still running.  */
    }
  else if (WIFEXITED (status) && WEXITSTATUS (status) == 127)
    {
      /* FIXME: This is GnuPG specific.  */
      _gpgrt_log_error (_("error running '%s': probably not installed\n"),
                        pgmname);
      ec = GPG_ERR_CONFIGURATION;
    }
  else if (WIFEXITED (status) && WEXITSTATUS (status))
    {
      if (!r_exitcode)
        _gpgrt_log_error (_("error running '%s': exit status %d\n"), pgmname,
                          WEXITSTATUS (status));
      else
        *r_exitcode = WEXITSTATUS (status);
      ec = GPG_ERR_GENERAL;
    }
  else if (!WIFEXITED (status))
    {
      _gpgrt_log_error (_("error running '%s': terminated\n"), pgmname);
      ec = GPG_ERR_GENERAL;
    }
  else
    {
      if (r_exitcode)
        *r_exitcode = 0;
      ec = 0;
    }

  return ec;
}


/* See gpgrt-int.h for a description.
 *
 * FIXME: What about using a poll like data structure for the pids and
 * their exit codes?  The whole thing is anyway problematic in a
 * threaded processs because waitpid has no association between PIDS
 * and threads.
 */
gpg_err_code_t
_gpgrt_wait_processes (const char **pgmnames, pid_t *pids, size_t count,
                       int hang, int *r_exitcodes)
{
  gpg_err_code_t ec = 0;
  size_t i, left;
  int *dummy = NULL;

  if (!r_exitcodes)
    {
      dummy = r_exitcodes = xtrymalloc (sizeof *r_exitcodes * count);
      if (!dummy)
        return _gpg_err_code_from_syserror ();
    }

  for (i = 0, left = count; i < count; i++)
    {
      int status = -1;

      if (pids[i] == (pid_t)(-1))
        return GPG_ERR_INV_VALUE;

      /* See if there was a previously stored result for this pid.  */
      if (get_result (pids[i], &status))
        left -= 1;

      r_exitcodes[i] = status;
    }

  while (left > 0)
    {
      pid_t pid;
      int status;

      _gpgrt_pre_syscall ();
      while ((pid = waitpid (-1, &status, hang ? 0 : WNOHANG)) == (pid_t)(-1)
             && errno == EINTR);
      _gpgrt_post_syscall ();

      if (pid == (pid_t)(-1))
        {
          ec = _gpg_err_code_from_syserror ();
          _gpgrt_log_error (_("waiting for processes to terminate"
                              " failed: %s\n"), _gpg_strerror (ec));
          break;
        }
      else if (!pid)
        {
          ec = GPG_ERR_TIMEOUT; /* Still running.  */
          break;
        }
      else
        {
          for (i = 0; i < count; i++)
            if (pid == pids[i])
              break;

          if (i == count)
            {
              /* No match, store this result.  */
              ec = store_result (pid, status);
              if (ec)
                break;
              continue;
            }

          /* Process PIDS[i] died.  */
          if (r_exitcodes[i] != (pid_t) -1)
            {
              _gpgrt_log_error ("PID %d was reused", pid);
              ec = GPG_ERR_GENERAL;
              break;
            }

          left -= 1;
          r_exitcodes[i] = status;
        }
    }

  for (i = 0; i < count; i++)
    {
      if (r_exitcodes[i] == -1)
        continue;

      if (WIFEXITED (r_exitcodes[i]) && WEXITSTATUS (r_exitcodes[i]) == 127)
        {
          _gpgrt_log_error (_("error running '%s': probably not installed\n"),
                            pgmnames[i]);
          ec = GPG_ERR_CONFIGURATION;
        }
      else if (WIFEXITED (r_exitcodes[i]) && WEXITSTATUS (r_exitcodes[i]))
        {
          if (dummy)
            _gpgrt_log_error (_("error running '%s': exit status %d\n"),
                              pgmnames[i], WEXITSTATUS (r_exitcodes[i]));
          else
            r_exitcodes[i] = WEXITSTATUS (r_exitcodes[i]);
          ec = GPG_ERR_GENERAL;
        }
      else if (!WIFEXITED (r_exitcodes[i]))
        {
          _gpgrt_log_error (_("error running '%s': terminated\n"), pgmnames[i]);
          ec = GPG_ERR_GENERAL;
        }
    }

  xfree (dummy);
  return ec;
}


/* See gpgrt-int.h for a description.  FIXME: We should add a prexec
 * callback. */
gpg_err_code_t
_gpgrt_spawn_process_detached (const char *pgmname, const char *argv[],
                               const char *envp[] )
{
  gpg_err_code_t ec;
  pid_t pid;
  int i;

  /* FIXME: Is this GnuPG specific or should we keep it.  */
  if (getuid() != geteuid())
    return GPG_ERR_BUG;

  if (access (pgmname, X_OK))
    return _gpg_err_code_from_syserror ();

  _gpgrt_pre_syscall ();
  pid = fork ();
  _gpgrt_post_syscall ();
  if (pid == (pid_t)(-1))
    {
      ec = _gpg_err_code_from_syserror ();
      _gpgrt_log_error (_("error forking process: %s\n"), _gpg_strerror (ec));
      return ec;
    }

  if (!pid)
    {
      pid_t pid2;

      /* gcry_control (GCRYCTL_TERM_SECMEM); */
      if (setsid() == -1 || chdir ("/"))
        _exit (1);

      pid2 = fork (); /* Double fork to let init take over the new child. */
      if (pid2 == (pid_t)(-1))
        _exit (1);
      if (pid2)
        _exit (0);  /* Let the parent exit immediately. */

      for (i=0; envp && envp[i]; i++)
        {
          char *p = xtrystrdup (envp[i]);
          if (!p)
            out_of_core (__LINE__);
          putenv (p);
        }

      do_exec (pgmname, argv, -1, -1, -1, NULL, NULL);
      /*NOTREACHED*/
    }

  _gpgrt_pre_syscall ();
  if (waitpid (pid, NULL, 0) == -1)
    {
      _gpgrt_post_syscall ();
      ec = _gpg_err_code_from_syserror ();
      _gpgrt_log_error ("waitpid failed in gpgrt_spawn_process_detached: %s",
                        _gpg_strerror (ec));
      return ec;
    }
  else
    _gpgrt_post_syscall ();

  return 0;
}


/* Kill a process; that is send an appropriate signal to the process.
 * gnupg_wait_process must be called to actually remove the process
   from the system.  An invalid PID is ignored.  */
void
_gpgrt_kill_process (pid_t pid)
{
  if (pid != (pid_t)(-1))
    {
      _gpgrt_pre_syscall ();
      kill (pid, SIGTERM);
      _gpgrt_post_syscall ();
    }
}


void
_gpgrt_release_process (pid_t pid)
{
  (void)pid;
}