[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANP3RGcT8njs7tJxd9wondFRN6iAsMRytwczBHn=dkLn0b_Nsg@mail.gmail.com>
Date: Fri, 6 May 2022 15:29:05 -0700
From: Maciej Żenczykowski <maze@...gle.com>
To: Florian Weimer <fweimer@...hat.com>
Cc: enh <enh@...gle.com>, libc-coord@...ts.openwall.com
Subject: Re: posix_spawn() support for close_range(CLOSE_RANGE_CLOEXEC)
On Mon, Jan 24, 2022 at 2:08 PM Maciej Żenczykowski <maze@...gle.com> wrote:
>
> On Mon, Jan 24, 2022 at 1:24 PM Florian Weimer <fweimer@...hat.com> wrote:
> >
> > > we have a proposal to add a new posix_spawn() flag to bionic
> > > (Android's libc) that would mark all file descriptors not otherwise
> > > mentioned as close-on-exec.
> > >
> > > (see https://android-review.googlesource.com/c/platform/bionic/+/1955269
> > > for the proposed implementation.)
> > >
> > > anyone aware of any other work in this kind of direction?
> >
> > Solaris and glibc have posix_spawn_file_actions_addclosefrom_np (Solaris
> > was first). Given that the execve is unavoidable (except for errors),
> > that seems pretty much equivalent. Perhaps POSIX_SPAWN_CLOEXEC_DEFAULT
> > is a little bit easier to use?
>
> Right, I realized that basically what I want/need is to close
> everything except for a specific set of fds.
> That set is stdin/out/err (closing these before exec is just a really
> bad idea, they should at the minimum be /dev/null) and any file
> descriptors I'm explicitly trying to pass (which requires explicit
> posix_spawn_actions_adddup2 (maybe addopen) calls or it's racy wrt
> other threads, since if they're opened pre-posix_spawn, then they
> need/should be opened with O_CLOEXEC anyway, and we don't have a
> posix_spawn_actions_adduncloexec helper besides dup2 - note that
> dup2(X, X) doesn't work to unset O_CLOEXEC).
>
> adddup2 is also better than addopen, because it allows for better
> error handling (dup2 is unlikely to fail, open much more so, logging
> prior to posix_spawn() is easier).
>
> Hence, this approach seems to be by far the easiest to use.
> Just set the flag, and your code works and doesn't leak fds any more
> even if other threads are forgetting to set O_CLOEXEC and/or racing
> with you.
FYI in https://android-review.googlesource.com/c/platform/bionic/+/1955269
and https://android-review.googlesource.com/c/platform/bionic/+/2072627
bionic implemented POSIX_SPAWN_CLOEXEC_DEFAULT which basically does
close_range(0, ~0U, CLOSE_RANGE_CLOEXEC) just before user registered
fd operations.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
