113d1975be
This replaces some old Chromium code that tries to minimally disentangle an arbitrary file descriptor mapping with simpler algorithm, for several reasons: 1. Do something appropriate when a file descriptor is mapped to the same fd number in the child; currently they're ignored, which means they'll be closed if they were close-on-exec. This implementation duplicates the fd twice in that case, which seems to be uncommon in practice; this isn't maximally efficient but avoids special-case code. 2. Make this more generally applicable; the previous design is specialized for arbitrary code running between fork and exec, but we also want to use this on OS X with posix_spawn, which exposes a very limited set of operations. 3. Avoid the use of C++ standard library iterators in async signal safe code; the Chromium developers mention that this is a potential problem in some debugging implementations that take locks. 4. In general the algorithm is simpler and should be more "obviously correct"; more concretely, it should get complete coverage just by being run normally in a debug build. As a convenient side benefit, CloseSuperfluousFds now takes an arbitrary predicate for which fds to leave open, which means it can be used in other code that needs it without creating a fake fd mapping. MozReview-Commit-ID: EoiRttrbrKL
119 lines
3.6 KiB
C++
119 lines
3.6 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
|
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "FileDescriptorShuffle.h"
|
|
|
|
#include "base/eintr_wrapper.h"
|
|
#include "mozilla/Assertions.h"
|
|
#include "mozilla/DebugOnly.h"
|
|
|
|
#include <algorithm>
|
|
#include <unistd.h>
|
|
#include <fcntl.h>
|
|
|
|
namespace mozilla {
|
|
namespace ipc {
|
|
|
|
// F_DUPFD_CLOEXEC is like F_DUPFD (see below) but atomically makes
|
|
// the new fd close-on-exec. This is useful to prevent accidental fd
|
|
// leaks into processes created by plain fork/exec, but IPC uses
|
|
// CloseSuperfluousFds so it's not essential.
|
|
//
|
|
// F_DUPFD_CLOEXEC is in POSIX 2008, but as of 2018 there are still
|
|
// some OSes that don't support it. (Specifically: Solaris 10 doesn't
|
|
// have it, and Android should have kernel support but doesn't define
|
|
// the constant until API 21 (Lollipop). We also don't use this for
|
|
// IPC child launching on Android, so there's no point in hard-coding
|
|
// the definitions like we do for Android in some other cases.)
|
|
#ifdef F_DUPFD_CLOEXEC
|
|
static const int kDupFdCmd = F_DUPFD_CLOEXEC;
|
|
#else
|
|
static const int kDupFdCmd = F_DUPFD;
|
|
#endif
|
|
|
|
// This implementation ensures that the *ranges* of the source and
|
|
// destination fds don't overlap, which is unnecessary but sufficient
|
|
// to avoid conflicts or identity mappings.
|
|
//
|
|
// In practice, the source fds will usually be large and the
|
|
// destination fds will all be relatively small, so there mostly won't
|
|
// be temporary fds. This approach has the advantage of being simple
|
|
// (and linear-time, but hopefully there aren't enough fds for that to
|
|
// matter).
|
|
bool
|
|
FileDescriptorShuffle::Init(MappingRef aMapping)
|
|
{
|
|
MOZ_ASSERT(mMapping.IsEmpty());
|
|
|
|
// Find the maximum destination fd; any source fds not greater than
|
|
// this will be duplicated.
|
|
int maxDst = STDERR_FILENO;
|
|
for (const auto& elem : aMapping) {
|
|
maxDst = std::max(maxDst, elem.second);
|
|
}
|
|
mMaxDst = maxDst;
|
|
|
|
#ifdef DEBUG
|
|
// Increase the limit to make sure the F_DUPFD case gets test coverage.
|
|
if (!aMapping.IsEmpty()) {
|
|
// Try to find a value that will create a nontrivial partition.
|
|
int fd0 = aMapping[0].first;
|
|
int fdn = aMapping.rbegin()->first;
|
|
maxDst = std::max(maxDst, (fd0 + fdn) / 2);
|
|
}
|
|
#endif
|
|
|
|
for (const auto& elem : aMapping) {
|
|
int src = elem.first;
|
|
// F_DUPFD is like dup() but allows placing a lower bound
|
|
// on the new fd, which is exactly what we want.
|
|
if (src <= maxDst) {
|
|
src = fcntl(src, kDupFdCmd, maxDst + 1);
|
|
if (src < 0) {
|
|
return false;
|
|
}
|
|
mTempFds.AppendElement(src);
|
|
}
|
|
MOZ_ASSERT(src > maxDst);
|
|
#ifdef DEBUG
|
|
// Check for accidentally mapping two different fds to the same
|
|
// destination. (This is O(n^2) time, but it shouldn't matter.)
|
|
for (const auto& otherElem : mMapping) {
|
|
MOZ_ASSERT(elem.second != otherElem.second);
|
|
}
|
|
#endif
|
|
mMapping.AppendElement(std::make_pair(src, elem.second));
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool
|
|
FileDescriptorShuffle::MapsTo(int aFd) const
|
|
{
|
|
// Prune fds that are too large to be a destination, rather than
|
|
// searching; this should be the common case.
|
|
if (aFd > mMaxDst) {
|
|
return false;
|
|
}
|
|
for (const auto& elem : mMapping) {
|
|
if (elem.second == aFd) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
FileDescriptorShuffle::~FileDescriptorShuffle()
|
|
{
|
|
for (const auto& fd : mTempFds) {
|
|
mozilla::DebugOnly<int> rv = IGNORE_EINTR(close(fd));
|
|
MOZ_ASSERT(rv == 0);
|
|
}
|
|
}
|
|
|
|
} // namespace ipc
|
|
} // namespace mozilla
|