X-Git-Url: https://git.saurik.com/apple/launchd.git/blobdiff_plain/ed34e3c3e5fb80e0702ac7fb92f189862089d820..ef3989319e2fdaf6ddb7590bc634ee693aa02a3b:/launchd/src/launchd_core_logic.c diff --git a/launchd/src/launchd_core_logic.c b/launchd/src/launchd_core_logic.c index 2c37ee9..6565b24 100644 --- a/launchd/src/launchd_core_logic.c +++ b/launchd/src/launchd_core_logic.c @@ -1,6 +1,4 @@ /* - * Copyright (c) 2005 Apple Computer, Inc. All rights reserved. - * * @APPLE_APACHE_LICENSE_HEADER_START@ * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -18,10 +16,15 @@ * @APPLE_APACHE_LICENSE_HEADER_END@ */ -static const char *const __rcs_file_version__ = "$Revision: 1.77 $"; +static const char *const __rcs_file_version__ = "$Revision: 23792 $"; +#include "config.h" +#include "launchd_core_logic.h" + +#include #include #include +#include #include #include #include @@ -31,14 +34,15 @@ static const char *const __rcs_file_version__ = "$Revision: 1.77 $"; #include #include #include +#include #include #include #include -#include #include #include #include #include +#include #include #include #include @@ -46,14 +50,15 @@ static const char *const __rcs_file_version__ = "$Revision: 1.77 $"; #include #include #include +#include #include #include #include #include +#include #include #include #include -#include #include #include #include @@ -68,84 +73,146 @@ static const char *const __rcs_file_version__ = "$Revision: 1.77 $"; #include #include #include +#include +#if HAVE_SANDBOX +#include +#endif +#if HAVE_QUARANTINE +#include +#endif #include "launch.h" #include "launch_priv.h" +#include "launch_internal.h" +#include "bootstrap.h" +#include "bootstrap_priv.h" +#include "vproc.h" +#include "vproc_internal.h" + +#include "reboot2.h" + #include "launchd.h" -#include "launchd_core_logic.h" +#include "launchd_runtime.h" #include "launchd_unix_ipc.h" -#include "bootstrap_private.h" -#include "bootstrap.h" -#include "bootstrapServer.h" -#include "mpm_reply.h" - -/* sys/queue.h is not up to date */ -#ifndef SLIST_FOREACH_SAFE -#define SLIST_FOREACH_SAFE(var, head, field, tvar) \ - for ((var) = SLIST_FIRST((head)); \ - (var) && ((tvar) = SLIST_NEXT((var), field), 1); \ - (var) = (tvar)) -#endif +#include "protocol_vproc.h" +#include "protocol_vprocServer.h" +#include "protocol_job_reply.h" + +#define LAUNCHD_MIN_JOB_RUN_TIME 10 +#define LAUNCHD_DEFAULT_EXIT_TIMEOUT 20 +#define LAUNCHD_SIGKILL_TIMER 5 + + +#define TAKE_SUBSET_NAME "TakeSubsetName" +#define TAKE_SUBSET_PID "TakeSubsetPID" +#define TAKE_SUBSET_PERPID "TakeSubsetPerPID" + +#define IS_POWER_OF_TWO(v) (!(v & (v - 1)) && v) + +extern char **environ; + +struct waiting_for_removal { + SLIST_ENTRY(waiting_for_removal) sle; + mach_port_t reply_port; +}; + +static bool waiting4removal_new(job_t j, mach_port_t rp); +static void waiting4removal_delete(job_t j, struct waiting_for_removal *w4r); + +struct mspolicy { + SLIST_ENTRY(mspolicy) sle; + unsigned int allow:1, per_pid:1; + const char name[0]; +}; + +static bool mspolicy_new(job_t j, const char *name, bool allow, bool pid_local, bool skip_check); +static bool mspolicy_copy(job_t j_to, job_t j_from); +static void mspolicy_setup(launch_data_t obj, const char *key, void *context); +static bool mspolicy_check(job_t j, const char *name, bool pid_local); +static void mspolicy_delete(job_t j, struct mspolicy *msp); struct machservice { SLIST_ENTRY(machservice) sle; - struct jobcb *job; + SLIST_ENTRY(machservice) special_port_sle; + LIST_ENTRY(machservice) name_hash_sle; + LIST_ENTRY(machservice) port_hash_sle; + job_t job; + uint64_t bad_perf_cnt; + unsigned int gen_num; mach_port_name_t port; - unsigned int isActive:1, reset:1, recv:1, hide:1, kUNCServer:1, __junk:27; - char name[0]; + unsigned int isActive:1, reset:1, recv:1, hide:1, kUNCServer:1, per_user_hack:1, debug_on_close:1, per_pid:1, special_port_num:10; + const char name[0]; }; +static SLIST_HEAD(, machservice) special_ports; /* hack, this should be per jobmgr_t */ + +#define PORT_HASH_SIZE 32 +#define HASH_PORT(x) (IS_POWER_OF_TWO(PORT_HASH_SIZE) ? (MACH_PORT_INDEX(x) & (PORT_HASH_SIZE - 1)) : (MACH_PORT_INDEX(x) % PORT_HASH_SIZE)) + +static LIST_HEAD(, machservice) port_hash[PORT_HASH_SIZE]; + static void machservice_setup(launch_data_t obj, const char *key, void *context); static void machservice_setup_options(launch_data_t obj, const char *key, void *context); -static void machservice_resetport(struct jobcb *j, struct machservice *ms); - +static void machservice_resetport(job_t j, struct machservice *ms); +static struct machservice *machservice_new(job_t j, const char *name, mach_port_t *serviceport, bool pid_local); +static void machservice_ignore(job_t j, struct machservice *ms); +static void machservice_watch(job_t j, struct machservice *ms); +static void machservice_delete(job_t j, struct machservice *, bool port_died); +static void machservice_request_notifications(struct machservice *); +static mach_port_t machservice_port(struct machservice *); +static job_t machservice_job(struct machservice *); +static bool machservice_hidden(struct machservice *); +static bool machservice_active(struct machservice *); +static const char *machservice_name(struct machservice *); +static bootstrap_status_t machservice_status(struct machservice *); struct socketgroup { SLIST_ENTRY(socketgroup) sle; int *fds; unsigned int junkfds:1, fd_cnt:31; - char name[0]; + union { + const char name[0]; + char name_init[0]; + }; }; -static bool socketgroup_new(struct jobcb *j, const char *name, int *fds, unsigned int fd_cnt, bool junkfds); -static void socketgroup_delete(struct jobcb *j, struct socketgroup *sg); -static void socketgroup_watch(struct jobcb *j, struct socketgroup *sg); -static void socketgroup_ignore(struct jobcb *j, struct socketgroup *sg); -static void socketgroup_callback(struct jobcb *j, struct kevent *kev); +static bool socketgroup_new(job_t j, const char *name, int *fds, unsigned int fd_cnt, bool junkfds); +static void socketgroup_delete(job_t j, struct socketgroup *sg); +static void socketgroup_watch(job_t j, struct socketgroup *sg); +static void socketgroup_ignore(job_t j, struct socketgroup *sg); +static void socketgroup_callback(job_t j); static void socketgroup_setup(launch_data_t obj, const char *key, void *context); - -struct watchpath { - SLIST_ENTRY(watchpath) sle; - int fd; - unsigned int is_qdir:1, __junk:31; - char name[0]; -}; - -static bool watchpath_new(struct jobcb *j, const char *name, bool qdir); -static void watchpath_delete(struct jobcb *j, struct watchpath *wp); -static void watchpath_watch(struct jobcb *j, struct watchpath *wp); -static void watchpath_ignore(struct jobcb *j, struct watchpath *wp); -static void watchpath_callback(struct jobcb *j, struct kevent *kev); +static void socketgroup_kevent_mod(job_t j, struct socketgroup *sg, bool do_add); struct calendarinterval { + LIST_ENTRY(calendarinterval) global_sle; SLIST_ENTRY(calendarinterval) sle; + job_t job; struct tm when; + time_t when_next; }; -static bool calendarinterval_new(struct jobcb *j, struct tm *w); -static bool calendarinterval_new_from_obj(struct jobcb *j, launch_data_t obj); -static void calendarinterval_delete(struct jobcb *j, struct calendarinterval *ci); -static void calendarinterval_setalarm(struct jobcb *j, struct calendarinterval *ci); -static void calendarinterval_callback(struct jobcb *j, struct kevent *kev); +static LIST_HEAD(, calendarinterval) sorted_calendar_events; + +static bool calendarinterval_new(job_t j, struct tm *w); +static bool calendarinterval_new_from_obj(job_t j, launch_data_t obj); +static void calendarinterval_new_from_obj_dict_walk(launch_data_t obj, const char *key, void *context); +static void calendarinterval_delete(job_t j, struct calendarinterval *ci); +static void calendarinterval_setalarm(job_t j, struct calendarinterval *ci); +static void calendarinterval_callback(void); +static void calendarinterval_sanity_check(void); struct envitem { SLIST_ENTRY(envitem) sle; char *value; - char key[0]; + union { + const char key[0]; + char key_init[0]; + }; }; -static bool envitem_new(struct jobcb *j, const char *k, const char *v, bool global); -static void envitem_delete(struct jobcb *j, struct envitem *ei, bool global); +static bool envitem_new(job_t j, const char *k, const char *v, bool global); +static void envitem_delete(job_t j, struct envitem *ei, bool global); static void envitem_setup(launch_data_t obj, const char *key, void *context); struct limititem { @@ -154,9 +221,12 @@ struct limititem { unsigned int setsoft:1, sethard:1, which:30; }; -static bool limititem_update(struct jobcb *j, int w, rlim_t r); -static void limititem_delete(struct jobcb *j, struct limititem *li); +static bool limititem_update(job_t j, int w, rlim_t r); +static void limititem_delete(job_t j, struct limititem *li); static void limititem_setup(launch_data_t obj, const char *key, void *context); +#if HAVE_SANDBOX +static void seatbelt_setup_flags(launch_data_t obj, const char *key, void *context); +#endif typedef enum { NETWORK_UP = 1, @@ -165,101 +235,233 @@ typedef enum { FAILED_EXIT, PATH_EXISTS, PATH_MISSING, + OTHER_JOB_ENABLED, + OTHER_JOB_DISABLED, + OTHER_JOB_ACTIVE, + OTHER_JOB_INACTIVE, + PATH_CHANGES, + DIR_NOT_EMPTY, // FILESYSTEMTYPE_IS_MOUNTED, /* for nfsiod, but maybe others */ } semaphore_reason_t; struct semaphoreitem { SLIST_ENTRY(semaphoreitem) sle; semaphore_reason_t why; - char what[0]; + int fd; + union { + const char what[0]; + char what_init[0]; + }; }; -static bool semaphoreitem_new(struct jobcb *j, semaphore_reason_t why, const char *what); -static void semaphoreitem_delete(struct jobcb *j, struct semaphoreitem *si); -static void semaphoreitem_setup(launch_data_t obj, const char *key, void *context); -static void semaphoreitem_setup_paths(launch_data_t obj, const char *key, void *context); +struct semaphoreitem_dict_iter_context { + job_t j; + semaphore_reason_t why_true; + semaphore_reason_t why_false; +}; +static bool semaphoreitem_new(job_t j, semaphore_reason_t why, const char *what); +static void semaphoreitem_delete(job_t j, struct semaphoreitem *si); +static void semaphoreitem_setup(launch_data_t obj, const char *key, void *context); +static void semaphoreitem_setup_dict_iter(launch_data_t obj, const char *key, void *context); +static void semaphoreitem_callback(job_t j, struct kevent *kev); +static void semaphoreitem_watch(job_t j, struct semaphoreitem *si); +static void semaphoreitem_ignore(job_t j, struct semaphoreitem *si); +static void semaphoreitem_runtime_mod_ref(struct semaphoreitem *si, bool add); + +#define ACTIVE_JOB_HASH_SIZE 32 +#define ACTIVE_JOB_HASH(x) (IS_POWER_OF_TWO(ACTIVE_JOB_HASH_SIZE) ? (x & (ACTIVE_JOB_HASH_SIZE - 1)) : (x % ACTIVE_JOB_HASH_SIZE)) +#define MACHSERVICE_HASH_SIZE 37 + +struct jobmgr_s { + kq_callback kqjobmgr_callback; + SLIST_ENTRY(jobmgr_s) sle; + SLIST_HEAD(, jobmgr_s) submgrs; + LIST_HEAD(, job_s) jobs; + LIST_HEAD(, job_s) active_jobs[ACTIVE_JOB_HASH_SIZE]; + LIST_HEAD(, machservice) ms_hash[MACHSERVICE_HASH_SIZE]; + mach_port_t jm_port; + mach_port_t req_port; + jobmgr_t parentmgr; + int reboot_flags; + unsigned int global_on_demand_cnt; + unsigned int hopefully_first_cnt; + unsigned int normal_active_cnt; + unsigned int sent_stop_to_normal_jobs:1, sent_stop_to_hopefully_last_jobs:1, shutting_down:1, session_initialized:1; + union { + const char name[0]; + char name_init[0]; + }; +}; -struct jobcb { +#define jobmgr_assumes(jm, e) \ + (__builtin_expect(!(e), 0) ? jobmgr_log_bug(jm, __rcs_file_version__, __FILE__, __LINE__, #e), false : true) + +static jobmgr_t jobmgr_new(jobmgr_t jm, mach_port_t requestorport, mach_port_t transfer_port, bool sflag, const char *name); +static job_t jobmgr_import2(jobmgr_t jm, launch_data_t pload); +static jobmgr_t jobmgr_parent(jobmgr_t jm); +static jobmgr_t jobmgr_do_garbage_collection(jobmgr_t jm); +static bool jobmgr_label_test(jobmgr_t jm, const char *str); +static void jobmgr_reap_bulk(jobmgr_t jm, struct kevent *kev); +static void jobmgr_log_stray_children(jobmgr_t jm); +static void jobmgr_remove(jobmgr_t jm); +static void jobmgr_dispatch_all(jobmgr_t jm, bool newmounthack); +static job_t jobmgr_init_session(jobmgr_t jm, const char *session_type, bool sflag); +static job_t jobmgr_find_by_pid(jobmgr_t jm, pid_t p, bool create_anon); +static job_t job_mig_intran2(jobmgr_t jm, mach_port_t mport, pid_t upid); +static void job_export_all2(jobmgr_t jm, launch_data_t where); +static void jobmgr_callback(void *obj, struct kevent *kev); +static void jobmgr_setup_env_from_other_jobs(jobmgr_t jm); +static void jobmgr_export_env_from_other_jobs(jobmgr_t jm, launch_data_t dict); +static struct machservice *jobmgr_lookup_service(jobmgr_t jm, const char *name, bool check_parent, pid_t target_pid); +static void jobmgr_logv(jobmgr_t jm, int pri, int err, const char *msg, va_list ap) __attribute__((format(printf, 4, 0))); +static void jobmgr_log(jobmgr_t jm, int pri, const char *msg, ...) __attribute__((format(printf, 3, 4))); +/* static void jobmgr_log_error(jobmgr_t jm, int pri, const char *msg, ...) __attribute__((format(printf, 3, 4))); */ +static void jobmgr_log_bug(jobmgr_t jm, const char *rcs_rev, const char *path, unsigned int line, const char *test); + +#define DO_RUSAGE_SUMMATION 0 + +#define AUTO_PICK_LEGACY_LABEL (const char *)(~0) + +struct job_s { kq_callback kqjob_callback; - SLIST_ENTRY(jobcb) sle; + LIST_ENTRY(job_s) sle; + LIST_ENTRY(job_s) pid_hash_sle; + LIST_ENTRY(job_s) label_hash_sle; SLIST_HEAD(, socketgroup) sockets; - SLIST_HEAD(, watchpath) vnodes; SLIST_HEAD(, calendarinterval) cal_intervals; SLIST_HEAD(, envitem) global_env; SLIST_HEAD(, envitem) env; SLIST_HEAD(, limititem) limits; + SLIST_HEAD(, mspolicy) mspolicies; SLIST_HEAD(, machservice) machservices; SLIST_HEAD(, semaphoreitem) semaphores; - SLIST_HEAD(, jobcb) jobs; + SLIST_HEAD(, waiting_for_removal) removal_watchers; +#if DO_RUSAGE_SUMMATION struct rusage ru; - struct jobcb *parent; - mach_port_t bs_port; - mach_port_t req_port; - mach_port_t wait_reply_port; +#endif + cpu_type_t *j_binpref; + size_t j_binpref_cnt; + mach_port_t j_port; + mach_port_t wait_reply_port; /* we probably should switch to a list of waiters */ uid_t mach_uid; + jobmgr_t mgr; char **argv; char *prog; char *rootdir; char *workingdir; char *username; char *groupname; - char *stdinpath; char *stdoutpath; char *stderrpath; + char *alt_exc_handler; + struct machservice *lastlookup; + unsigned int lastlookup_gennum; +#if HAVE_SANDBOX + char *seatbelt_profile; + uint64_t seatbelt_flags; +#endif +#if HAVE_QUARANTINE + void *quarantine_data; + size_t quarantine_data_sz; +#endif pid_t p; int argc; int last_exit_status; - int execfd; + int forkfd; + int log_redirect_fd; int nice; - int timeout; - time_t start_time; - size_t failed_exits; - unsigned int start_interval; - unsigned int checkedin:1, firstborn:1, debug:1, throttle:1, inetcompat:1, inetcompat_wait:1, - ondemand:1, session_create:1, low_pri_io:1, init_groups:1, priv_port_has_senders:1, - importing_global_env:1, importing_hard_limits:1, setmask:1, legacy_mach_job:1, runatload:1; + unsigned int timeout; + unsigned int exit_timeout; + int stdout_err_fd; + uint64_t sent_sigterm_time; + uint64_t start_time; + uint32_t min_run_time; + uint32_t start_interval; + unsigned int checkedin:1, anonymous:1, debug:1, inetcompat:1, inetcompat_wait:1, + ondemand:1, session_create:1, low_pri_io:1, no_init_groups:1, priv_port_has_senders:1, + importing_global_env:1, importing_hard_limits:1, setmask:1, legacy_mach_job:1, start_pending:1; mode_t mask; - unsigned int globargv:1, wait4debugger:1, transfer_bstrap:1, unload_at_exit:1, force_ppc:1, stall_before_exec:1, __pad:26; - char label[0]; + unsigned int globargv:1, wait4debugger:1, unload_at_exit:1, stall_before_exec:1, only_once:1, + currently_ignored:1, forced_peers_to_demand_mode:1, setnice:1, hopefully_exits_last:1, removal_pending:1, + wait4pipe_eof:1, sent_sigkill:1, debug_before_kill:1, weird_bootstrap:1, start_on_mount:1, + per_user:1, hopefully_exits_first:1, deny_unknown_mslookups:1, unload_at_mig_return:1, abandon_pg:1, + poll_for_vfs_changes:1, internal_exc_handler:1, deny_job_creation:1; + const char label[0]; }; -static struct jobcb *job_import2(launch_data_t pload); +#define LABEL_HASH_SIZE 53 + +static LIST_HEAD(, job_s) label_hash[LABEL_HASH_SIZE]; +static size_t hash_label(const char *label) __attribute__((pure)); +static size_t hash_ms(const char *msstr) __attribute__((pure)); + + +#define job_assumes(j, e) \ + (__builtin_expect(!(e), 0) ? job_log_bug(j, __rcs_file_version__, __FILE__, __LINE__, #e), false : true) + static void job_import_keys(launch_data_t obj, const char *key, void *context); -static void job_import_bool(struct jobcb *j, const char *key, bool value); -static void job_import_string(struct jobcb *j, const char *key, const char *value); -static void job_import_integer(struct jobcb *j, const char *key, long long value); -static void job_import_dictionary(struct jobcb *j, const char *key, launch_data_t value); -static void job_import_array(struct jobcb *j, const char *key, launch_data_t value); -static void job_watch(struct jobcb *j); -static void job_ignore(struct jobcb *j); -static void job_reap(struct jobcb *j); -static bool job_useless(struct jobcb *j); -static bool job_keepalive(struct jobcb *j); -static void job_start_child(struct jobcb *j, int execfd) __attribute__((noreturn)); -static void job_setup_attributes(struct jobcb *j); -static bool job_setup_machport(struct jobcb *j); +static void job_import_bool(job_t j, const char *key, bool value); +static void job_import_string(job_t j, const char *key, const char *value); +static void job_import_integer(job_t j, const char *key, long long value); +static void job_import_dictionary(job_t j, const char *key, launch_data_t value); +static void job_import_array(job_t j, const char *key, launch_data_t value); +static void job_import_opaque(job_t j, const char *key, launch_data_t value); +static bool job_set_global_on_demand(job_t j, bool val); +static const char *job_active(job_t j); +static void job_watch(job_t j); +static void job_ignore(job_t j); +static void job_reap(job_t j); +static bool job_useless(job_t j); +static bool job_keepalive(job_t j); +static void job_start(job_t j); +static void job_start_child(job_t j) __attribute__((noreturn)); +static void job_setup_attributes(job_t j); +static bool job_setup_machport(job_t j); +static void job_setup_fd(job_t j, int target_fd, const char *path, int flags); +static void job_postfork_become_user(job_t j); +#if !TARGET_OS_EMBEDDED +static void job_enable_audit_for_user(job_t j, uid_t u, char *name); +#endif +static void job_find_and_blame_pids_with_weird_uids(job_t j); +static void job_force_sampletool(job_t j); +static void job_setup_exception_port(job_t j, task_t target_task); +static void job_reparent_hack(job_t j, const char *where); static void job_callback(void *obj, struct kevent *kev); -static pid_t job_fork(struct jobcb *j); -static size_t job_prep_log_preface(struct jobcb *j, char *buf); -static void job_setup_env_from_other_jobs(struct jobcb *j); -static void job_export_all2(struct jobcb *j, launch_data_t where); -static launch_data_t job_export2(struct jobcb *j, bool subjobs); +static void job_callback_proc(job_t j, int flags, int fflags); +static void job_callback_timer(job_t j, void *ident); +static void job_callback_read(job_t j, int ident); +static void job_log_stray_pg(job_t j); +static job_t job_new_anonymous(jobmgr_t jm, pid_t anonpid); +static job_t job_new(jobmgr_t jm, const char *label, const char *prog, const char *const *argv); +static job_t job_new_via_mach_init(job_t j, const char *cmd, uid_t uid, bool ond); +static const char *job_prog(job_t j); +static jobmgr_t job_get_bs(job_t j); +static void job_kill(job_t j); +static void job_uncork_fork(job_t j); +static void job_log_stdouterr(job_t j); +static void job_logv(job_t j, int pri, int err, const char *msg, va_list ap) __attribute__((format(printf, 4, 0))); +static void job_log_error(job_t j, int pri, const char *msg, ...) __attribute__((format(printf, 3, 4))); +static void job_log_bug(job_t j, const char *rcs_rev, const char *path, unsigned int line, const char *test); +static void job_log_stdouterr2(job_t j, const char *msg, ...); +static void job_set_exeception_port(job_t j, mach_port_t port); +static kern_return_t job_handle_mpm_wait(job_t j, mach_port_t srp, int *waitstatus); + static const struct { const char *key; int val; } launchd_keys2limits[] = { - { LAUNCH_JOBKEY_RESOURCELIMIT_CORE, RLIMIT_CORE }, - { LAUNCH_JOBKEY_RESOURCELIMIT_CPU, RLIMIT_CPU }, - { LAUNCH_JOBKEY_RESOURCELIMIT_DATA, RLIMIT_DATA }, - { LAUNCH_JOBKEY_RESOURCELIMIT_FSIZE, RLIMIT_FSIZE }, - { LAUNCH_JOBKEY_RESOURCELIMIT_MEMLOCK, RLIMIT_MEMLOCK }, - { LAUNCH_JOBKEY_RESOURCELIMIT_NOFILE, RLIMIT_NOFILE }, - { LAUNCH_JOBKEY_RESOURCELIMIT_NPROC, RLIMIT_NPROC }, - { LAUNCH_JOBKEY_RESOURCELIMIT_RSS, RLIMIT_RSS }, - { LAUNCH_JOBKEY_RESOURCELIMIT_STACK, RLIMIT_STACK }, + { LAUNCH_JOBKEY_RESOURCELIMIT_CORE, RLIMIT_CORE }, + { LAUNCH_JOBKEY_RESOURCELIMIT_CPU, RLIMIT_CPU }, + { LAUNCH_JOBKEY_RESOURCELIMIT_DATA, RLIMIT_DATA }, + { LAUNCH_JOBKEY_RESOURCELIMIT_FSIZE, RLIMIT_FSIZE }, + { LAUNCH_JOBKEY_RESOURCELIMIT_MEMLOCK, RLIMIT_MEMLOCK }, + { LAUNCH_JOBKEY_RESOURCELIMIT_NOFILE, RLIMIT_NOFILE }, + { LAUNCH_JOBKEY_RESOURCELIMIT_NPROC, RLIMIT_NPROC }, + { LAUNCH_JOBKEY_RESOURCELIMIT_RSS, RLIMIT_RSS }, + { LAUNCH_JOBKEY_RESOURCELIMIT_STACK, RLIMIT_STACK }, }; static time_t cronemu(int mon, int mday, int hour, int min); @@ -269,115 +471,167 @@ static bool cronemu_mday(struct tm *wtm, int mday, int hour, int min); static bool cronemu_hour(struct tm *wtm, int hour, int min); static bool cronemu_min(struct tm *wtm, int min); -static void simple_zombie_reaper(void *, struct kevent *); - -kq_callback kqsimple_zombie_reaper = simple_zombie_reaper; - -static int dir_has_files(const char *path); +/* miscellaneous file local functions */ +static void ensure_root_bkgd_setup(void); +static int dir_has_files(job_t j, const char *path); static char **mach_cmd2argv(const char *string); -struct jobcb *root_job = NULL; -struct jobcb *gc_this_job = NULL; -size_t total_children = 0; +static size_t our_strhash(const char *s) __attribute__((pure)); +static void extract_rcsid_substr(const char *i, char *o, size_t osz); +static void do_first_per_user_launchd_hack(void); +static size_t get_kern_max_proc(void); +static void do_file_init(void) __attribute__((constructor)); + +/* file local globals */ +static bool do_apple_internal_magic; +static size_t total_children; +static size_t total_anon_children; +static mach_port_t the_exception_server; +static bool did_first_per_user_launchd_BootCache_hack; +#define JOB_BOOTCACHE_HACK_CHECK(j) (j->per_user && !did_first_per_user_launchd_BootCache_hack && (j->mach_uid >= 500) && (j->mach_uid != (uid_t)-2)) +static jobmgr_t background_jobmgr; +static job_t workaround_5477111; +static mach_timebase_info_data_t tbi; + +/* process wide globals */ +mach_port_t inherited_bootstrap_port; +jobmgr_t root_jobmgr; -void -simple_zombie_reaper(void *obj __attribute__((unused)), struct kevent *kev) -{ - waitpid(kev->ident, NULL, 0); -} void -job_ignore(struct jobcb *j) +job_ignore(job_t j) { + struct semaphoreitem *si; struct socketgroup *sg; struct machservice *ms; - struct watchpath *wp; - SLIST_FOREACH(sg, &j->sockets, sle) + if (j->currently_ignored) { + return; + } + + job_log(j, LOG_DEBUG, "Ignoring..."); + + j->currently_ignored = true; + + if (j->poll_for_vfs_changes) { + j->poll_for_vfs_changes = false; + job_assumes(j, kevent_mod((uintptr_t)&j->semaphores, EVFILT_TIMER, EV_DELETE, 0, 0, j) != -1); + } + + SLIST_FOREACH(sg, &j->sockets, sle) { socketgroup_ignore(j, sg); + } - SLIST_FOREACH(wp, &j->vnodes, sle) - watchpath_ignore(j, wp); + SLIST_FOREACH(ms, &j->machservices, sle) { + machservice_ignore(j, ms); + } - SLIST_FOREACH(ms, &j->machservices, sle) - launchd_assumes(launchd_mport_request_callback(ms->port, NULL, false) == KERN_SUCCESS); + SLIST_FOREACH(si, &j->semaphores, sle) { + semaphoreitem_ignore(j, si); + } } void -job_watch(struct jobcb *j) +job_watch(job_t j) { + struct semaphoreitem *si; struct socketgroup *sg; struct machservice *ms; - struct watchpath *wp; - SLIST_FOREACH(sg, &j->sockets, sle) + if (!j->currently_ignored) { + return; + } + + job_log(j, LOG_DEBUG, "Watching..."); + + j->currently_ignored = false; + + SLIST_FOREACH(sg, &j->sockets, sle) { socketgroup_watch(j, sg); + } - SLIST_FOREACH(wp, &j->vnodes, sle) - watchpath_watch(j, wp); + SLIST_FOREACH(ms, &j->machservices, sle) { + machservice_watch(j, ms); + } - SLIST_FOREACH(ms, &j->machservices, sle) - launchd_assumes(launchd_mport_request_callback(ms->port, j, false) == KERN_SUCCESS); + SLIST_FOREACH(si, &j->semaphores, sle) { + semaphoreitem_watch(j, si); + } } void -job_stop(struct jobcb *j) +job_stop(job_t j) { - if (j->p) - kill(j->p, SIGTERM); -} + if (!j->p || j->anonymous) { + return; + } -launch_data_t -job_export(struct jobcb *j) -{ - return job_export2(j, true); + job_assumes(j, runtime_kill(j->p, SIGTERM) != -1); + j->sent_sigterm_time = mach_absolute_time(); + + if (j->exit_timeout) { + job_assumes(j, kevent_mod((uintptr_t)&j->exit_timeout, EVFILT_TIMER, + EV_ADD|EV_ONESHOT, NOTE_SECONDS, j->exit_timeout, j) != -1); + } + + job_log(j, LOG_DEBUG, "Sent SIGTERM signal"); } launch_data_t -job_export2(struct jobcb *j, bool subjobs) +job_export(job_t j) { launch_data_t tmp, tmp2, tmp3, r = launch_data_alloc(LAUNCH_DATA_DICTIONARY); - if (r == NULL) + if (r == NULL) { return NULL; + } - if ((tmp = launch_data_new_string(j->label))) + if ((tmp = launch_data_new_string(j->label))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_LABEL); - - if ((tmp = launch_data_new_bool(j->ondemand))) + } + if ((tmp = launch_data_new_string(j->mgr->name))) { + launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_LIMITLOADTOSESSIONTYPE); + } + if ((tmp = launch_data_new_bool(j->ondemand))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_ONDEMAND); - - if ((tmp = launch_data_new_integer(j->last_exit_status))) + } + if ((tmp = launch_data_new_integer(j->last_exit_status))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_LASTEXITSTATUS); - - if (j->p && (tmp = launch_data_new_integer(j->p))) + } + if (j->p && (tmp = launch_data_new_integer(j->p))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_PID); - - if ((tmp = launch_data_new_integer(j->timeout))) + } + if ((tmp = launch_data_new_integer(j->timeout))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_TIMEOUT); - - if (j->prog && (tmp = launch_data_new_string(j->prog))) + } + if (j->prog && (tmp = launch_data_new_string(j->prog))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_PROGRAM); - - if (j->stdoutpath && (tmp = launch_data_new_string(j->stdoutpath))) + } + if (j->stdoutpath && (tmp = launch_data_new_string(j->stdoutpath))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_STANDARDOUTPATH); - - if (j->stderrpath && (tmp = launch_data_new_string(j->stderrpath))) + } + if (j->stderrpath && (tmp = launch_data_new_string(j->stderrpath))) { launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_STANDARDERRORPATH); - + } if (j->argv && (tmp = launch_data_alloc(LAUNCH_DATA_ARRAY))) { int i; for (i = 0; i < j->argc; i++) { - if ((tmp2 = launch_data_new_string(j->argv[i]))) + if ((tmp2 = launch_data_new_string(j->argv[i]))) { launch_data_array_set_index(tmp, tmp2, i); + } } launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_PROGRAMARGUMENTS); } + if (j->session_create && (tmp = launch_data_new_bool(true))) { + launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_SESSIONCREATE); + } + if (j->inetcompat && (tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY))) { - if ((tmp2 = launch_data_new_bool(j->inetcompat_wait))) + if ((tmp2 = launch_data_new_bool(j->inetcompat_wait))) { launch_data_dict_insert(tmp, tmp2, LAUNCH_JOBINETDCOMPATIBILITY_WAIT); + } launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_INETDCOMPATIBILITY); } @@ -386,10 +640,14 @@ job_export2(struct jobcb *j, bool subjobs) int i; SLIST_FOREACH(sg, &j->sockets, sle) { + if (sg->junkfds) { + continue; + } if ((tmp2 = launch_data_alloc(LAUNCH_DATA_ARRAY))) { for (i = 0; i < sg->fd_cnt; i++) { - if ((tmp3 = launch_data_new_fd(sg->fds[i]))) + if ((tmp3 = launch_data_new_fd(sg->fds[i]))) { launch_data_array_set_index(tmp2, tmp3, i); + } } launch_data_dict_insert(tmp, tmp2, sg->name); } @@ -400,150 +658,271 @@ job_export2(struct jobcb *j, bool subjobs) if (!SLIST_EMPTY(&j->machservices) && (tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY))) { struct machservice *ms; + + tmp3 = NULL; SLIST_FOREACH(ms, &j->machservices, sle) { - tmp2 = launch_data_new_machport(MACH_PORT_NULL); - launch_data_dict_insert(tmp, tmp2, ms->name); + if (ms->per_pid) { + if (tmp3 == NULL) { + tmp3 = launch_data_alloc(LAUNCH_DATA_DICTIONARY); + } + if (tmp3) { + tmp2 = launch_data_new_machport(MACH_PORT_NULL); + launch_data_dict_insert(tmp3, tmp2, ms->name); + } + } else { + tmp2 = launch_data_new_machport(MACH_PORT_NULL); + launch_data_dict_insert(tmp, tmp2, ms->name); + } } launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_MACHSERVICES); + + if (tmp3) { + launch_data_dict_insert(r, tmp3, LAUNCH_JOBKEY_PERJOBMACHSERVICES); + } + } + + return r; +} + +static void +jobmgr_log_active_jobs(jobmgr_t jm) +{ + const char *why_active; + jobmgr_t jmi; + job_t ji; + + SLIST_FOREACH(jmi, &jm->submgrs, sle) { + jobmgr_log_active_jobs(jmi); } - if (subjobs && !SLIST_EMPTY(&j->jobs) && (tmp = launch_data_alloc(LAUNCH_DATA_ARRAY))) { - struct jobcb *ji; - size_t i = 0; + LIST_FOREACH(ji, &jm->jobs, sle) { + why_active = job_active(ji); + + job_log(ji, LOG_DEBUG, "%s", why_active ? why_active : "Inactive"); + } + +} + +static void +still_alive_with_check(void) +{ + jobmgr_log(root_jobmgr, LOG_NOTICE, "Still alive with %lu/%lu children", total_children, total_anon_children); + + jobmgr_log_active_jobs(root_jobmgr); + + runtime_closelog(); /* hack to flush logs */ +} + +jobmgr_t +jobmgr_shutdown(jobmgr_t jm) +{ + jobmgr_t jmi, jmn; + job_t ji; + + jobmgr_log(jm, LOG_DEBUG, "Beginning job manager shutdown with flags: %s", reboot_flags_to_C_names(jm->reboot_flags)); - SLIST_FOREACH(ji, &j->jobs, sle) { - tmp2 = job_export2(ji, true); - launch_data_array_set_index(tmp, tmp2, i); - i++; + jm->shutting_down = true; + + SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) { + jobmgr_shutdown(jmi); + } + + if (jm->hopefully_first_cnt) { + LIST_FOREACH(ji, &jm->jobs, sle) { + if (ji->p && ji->hopefully_exits_first) { + job_stop(ji); + } } + } - launch_data_dict_insert(r, tmp, LAUNCH_JOBKEY_SUBJOBS); + if (debug_shutdown_hangs && jm->parentmgr == NULL && getpid() == 1) { + runtime_set_timeout(still_alive_with_check, 5); } - return r; + return jobmgr_do_garbage_collection(jm); } void -job_remove_all_inactive(struct jobcb *j) +jobmgr_remove(jobmgr_t jm) { - struct jobcb *ji; + jobmgr_t jmi; + job_t ji; - SLIST_FOREACH(ji, &j->jobs, sle) - job_remove_all_inactive(ji); + jobmgr_log(jm, LOG_DEBUG, "Removed job manager"); - if (!job_active(j)) { - job_remove(j); - } else if (getpid() != 1) { - job_stop(j); + if (!jobmgr_assumes(jm, SLIST_EMPTY(&jm->submgrs))) { + while ((jmi = SLIST_FIRST(&jm->submgrs))) { + jobmgr_remove(jmi); + } + } + + while ((ji = LIST_FIRST(&jm->jobs))) { + /* We should only have anonymous jobs left */ + job_assumes(ji, ji->anonymous); + job_remove(ji); } + + if (jm->req_port) { + jobmgr_assumes(jm, launchd_mport_deallocate(jm->req_port) == KERN_SUCCESS); + } + + if (jm->jm_port) { + jobmgr_assumes(jm, launchd_mport_close_recv(jm->jm_port) == KERN_SUCCESS); + } + + if (jm == background_jobmgr) { + background_jobmgr = NULL; + } + + if (jm->parentmgr) { + runtime_del_ref(); + SLIST_REMOVE(&jm->parentmgr->submgrs, jm, jobmgr_s, sle); + } else if (getpid() == 1) { + jobmgr_log(jm, LOG_DEBUG, "About to call: reboot(%s)", reboot_flags_to_C_names(jm->reboot_flags)); + runtime_closelog(); + jobmgr_assumes(jm, reboot(jm->reboot_flags) != -1); + runtime_closelog(); + } else { + runtime_closelog(); + jobmgr_log(jm, LOG_DEBUG, "About to exit"); + exit(EXIT_SUCCESS); + } + + free(jm); } void -job_remove(struct jobcb *j) +job_remove(job_t j) { - struct jobcb *ji; + struct waiting_for_removal *w4r; struct calendarinterval *ci; + struct semaphoreitem *si; struct socketgroup *sg; - struct watchpath *wp; + struct machservice *ms; struct limititem *li; + struct mspolicy *msp; struct envitem *ei; - struct machservice *ms; - struct semaphoreitem *si; - job_log(j, LOG_DEBUG, "Removed"); + if (j->p && j->anonymous) { + job_reap(j); + } else if (j->p) { + job_log(j, LOG_DEBUG, "Removal pended until the job exits"); - if (j->p) { - if (kevent_mod(j->p, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, &kqsimple_zombie_reaper) == -1) { - job_reap(j); - } else { - /* we've attached the simple zombie reaper, we're going to delete the job before it is dead */ - total_children--; + if (!j->removal_pending) { + j->removal_pending = true; job_stop(j); } + + return; } - if (j->parent) - SLIST_REMOVE(&j->parent->jobs, j, jobcb, sle); + ipc_close_all_with_job(j); - if (j->execfd) - launchd_assumes(close(j->execfd) == 0); + if (j->forced_peers_to_demand_mode) { + job_set_global_on_demand(j, false); + } - if (j->bs_port) { - if (j->transfer_bstrap) { - launchd_assumes(launchd_mport_deallocate(j->bs_port) == KERN_SUCCESS); - } else { - launchd_assumes(launchd_mport_close_recv(j->bs_port) == KERN_SUCCESS); - } + if (!job_assumes(j, j->forkfd == 0)) { + job_assumes(j, runtime_close(j->forkfd) != -1); } - if (j->req_port) - launchd_assumes(launchd_mport_deallocate(j->req_port) == KERN_SUCCESS); + if (!job_assumes(j, j->log_redirect_fd == 0)) { + job_assumes(j, runtime_close(j->log_redirect_fd) != -1); + } -#if 0 - if (j->wait_reply_port) { + if (j->j_port) { + job_assumes(j, launchd_mport_close_recv(j->j_port) == KERN_SUCCESS); } -#endif - while ((ji = SLIST_FIRST(&j->jobs))) - job_remove(ji); + if (!job_assumes(j, j->wait_reply_port == MACH_PORT_NULL)) { + job_assumes(j, launchd_mport_deallocate(j->wait_reply_port) == KERN_SUCCESS); + } - while ((sg = SLIST_FIRST(&j->sockets))) + while ((msp = SLIST_FIRST(&j->mspolicies))) { + mspolicy_delete(j, msp); + } + while ((sg = SLIST_FIRST(&j->sockets))) { socketgroup_delete(j, sg); - - while ((wp = SLIST_FIRST(&j->vnodes))) - watchpath_delete(j, wp); - - while ((ci = SLIST_FIRST(&j->cal_intervals))) + } + while ((ci = SLIST_FIRST(&j->cal_intervals))) { calendarinterval_delete(j, ci); - - while ((ei = SLIST_FIRST(&j->env))) + } + while ((ei = SLIST_FIRST(&j->env))) { envitem_delete(j, ei, false); - - while ((ei = SLIST_FIRST(&j->global_env))) + } + while ((ei = SLIST_FIRST(&j->global_env))) { envitem_delete(j, ei, true); - - while ((li = SLIST_FIRST(&j->limits))) + } + while ((li = SLIST_FIRST(&j->limits))) { limititem_delete(j, li); - - while ((ms = SLIST_FIRST(&j->machservices))) - machservice_delete(ms); - - while ((si = SLIST_FIRST(&j->semaphores))) + } + while ((ms = SLIST_FIRST(&j->machservices))) { + machservice_delete(j, ms, false); + } + while ((si = SLIST_FIRST(&j->semaphores))) { semaphoreitem_delete(j, si); + } + while ((w4r = SLIST_FIRST(&j->removal_watchers))) { + waiting4removal_delete(j, w4r); + } - if (j->prog) + if (j->prog) { free(j->prog); - - if (j->argv) + } + if (j->argv) { free(j->argv); - - if (j->rootdir) + } + if (j->rootdir) { free(j->rootdir); - - if (j->workingdir) + } + if (j->workingdir) { free(j->workingdir); - - if (j->username) + } + if (j->username) { free(j->username); - - if (j->groupname) + } + if (j->groupname) { free(j->groupname); - - if (j->stdinpath) - free(j->stdinpath); - - if (j->stdoutpath) + } + if (j->stdoutpath) { free(j->stdoutpath); - - if (j->stderrpath) + } + if (j->stderrpath) { free(j->stderrpath); - - if (j->start_interval) - kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_DELETE, 0, 0, NULL); + } + if (j->alt_exc_handler) { + free(j->alt_exc_handler); + } +#if HAVE_SANDBOX + if (j->seatbelt_profile) { + free(j->seatbelt_profile); + } +#endif +#if HAVE_QUARANTINE + if (j->quarantine_data) { + free(j->quarantine_data); + } +#endif + if (j->j_binpref) { + free(j->j_binpref); + } + if (j->start_interval) { + runtime_del_ref(); + job_assumes(j, kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_DELETE, 0, 0, NULL) != -1); + } + if (j->poll_for_vfs_changes) { + job_assumes(j, kevent_mod((uintptr_t)&j->semaphores, EVFILT_TIMER, EV_DELETE, 0, 0, j) != -1); + } kevent_mod((uintptr_t)j, EVFILT_TIMER, EV_DELETE, 0, 0, NULL); + + LIST_REMOVE(j, sle); + LIST_REMOVE(j, label_hash_sle); + + job_log(j, LOG_DEBUG, "Removed"); + free(j); } @@ -551,20 +930,22 @@ void socketgroup_setup(launch_data_t obj, const char *key, void *context) { launch_data_t tmp_oai; - struct jobcb *j = context; + job_t j = context; unsigned int i, fd_cnt = 1; int *fds; - if (launch_data_get_type(obj) == LAUNCH_DATA_ARRAY) + if (launch_data_get_type(obj) == LAUNCH_DATA_ARRAY) { fd_cnt = launch_data_array_get_count(obj); + } fds = alloca(fd_cnt * sizeof(int)); for (i = 0; i < fd_cnt; i++) { - if (launch_data_get_type(obj) == LAUNCH_DATA_ARRAY) + if (launch_data_get_type(obj) == LAUNCH_DATA_ARRAY) { tmp_oai = launch_data_array_get_index(obj, i); - else + } else { tmp_oai = obj; + } fds[i] = launch_data_get_fd(tmp_oai); } @@ -575,68 +956,100 @@ socketgroup_setup(launch_data_t obj, const char *key, void *context) } bool -job_setup_machport(struct jobcb *j) +job_set_global_on_demand(job_t j, bool val) +{ + if (j->forced_peers_to_demand_mode && val) { + return false; + } else if (!j->forced_peers_to_demand_mode && !val) { + return false; + } + + if ((j->forced_peers_to_demand_mode = val)) { + j->mgr->global_on_demand_cnt++; + } else { + j->mgr->global_on_demand_cnt--; + } + + if (j->mgr->global_on_demand_cnt == 0) { + jobmgr_dispatch_all(j->mgr, false); + } + + return true; +} + +bool +job_setup_machport(job_t j) { - if (!launchd_assumes(launchd_mport_create_recv(&j->bs_port) == KERN_SUCCESS)) + mach_msg_size_t mxmsgsz; + + if (!job_assumes(j, launchd_mport_create_recv(&j->j_port) == KERN_SUCCESS)) { goto out_bad; + } + + /* Sigh... at the moment, MIG has maxsize == sizeof(reply union) */ + mxmsgsz = sizeof(union __RequestUnion__job_mig_protocol_vproc_subsystem); + if (job_mig_protocol_vproc_subsystem.maxsize > mxmsgsz) { + mxmsgsz = job_mig_protocol_vproc_subsystem.maxsize; + } - if (!launchd_assumes(launchd_mport_request_callback(j->bs_port, j, true) == KERN_SUCCESS)) + if (!job_assumes(j, runtime_add_mport(j->j_port, protocol_vproc_server, mxmsgsz) == KERN_SUCCESS)) { goto out_bad2; + } + + if (!job_assumes(j, launchd_mport_notify_req(j->j_port, MACH_NOTIFY_NO_SENDERS) == KERN_SUCCESS)) { + job_assumes(j, launchd_mport_close_recv(j->j_port) == KERN_SUCCESS); + goto out_bad; + } return true; out_bad2: - launchd_assumes(launchd_mport_close_recv(j->bs_port) == KERN_SUCCESS); + job_assumes(j, launchd_mport_close_recv(j->j_port) == KERN_SUCCESS); out_bad: return false; } -struct jobcb * -job_new_via_mach_init(struct jobcb *jbs, const char *cmd, uid_t uid, bool ond) +job_t +job_new_via_mach_init(job_t j, const char *cmd, uid_t uid, bool ond) { const char **argv = (const char **)mach_cmd2argv(cmd); - struct jobcb *j = NULL; - char buf[1000]; + job_t jr = NULL; - if (!launchd_assumes(argv != NULL)) + if (!job_assumes(j, argv != NULL)) { goto out_bad; + } - /* preflight the string so we know how big it is */ - sprintf(buf, "100000.%s", basename((char *)argv[0])); - - j = job_new(jbs, buf, NULL, argv, NULL, MACH_PORT_NULL); + jr = job_new(j->mgr, AUTO_PICK_LEGACY_LABEL, NULL, argv); free(argv); - if (!launchd_assumes(j != NULL)) + /* jobs can easily be denied creation during shutdown */ + if (!jr) { goto out_bad; + } - j->mach_uid = uid; - j->ondemand = ond; - j->legacy_mach_job = true; - j->priv_port_has_senders = true; /* the IPC that called us will make-send on this port */ - - if (!job_setup_machport(j)) - goto out_bad; + jr->mach_uid = uid; + jr->ondemand = ond; + jr->legacy_mach_job = true; + jr->abandon_pg = true; + jr->priv_port_has_senders = true; /* the IPC that called us will make-send on this port */ - if (!launchd_assumes(launchd_mport_notify_req(j->bs_port, MACH_NOTIFY_NO_SENDERS) == KERN_SUCCESS)) { - launchd_assumes(launchd_mport_close_recv(j->bs_port) == KERN_SUCCESS); + if (!job_setup_machport(jr)) { goto out_bad; } - sprintf(j->label, "%d.%s", MACH_PORT_INDEX(j->bs_port), basename(j->argv[0])); + job_log(jr, LOG_INFO, "Legacy%s server created", ond ? " on-demand" : ""); - job_log(j, LOG_INFO, "New%s server in bootstrap: %x", ond ? " on-demand" : "", jbs->bs_port); - - return j; + return jr; out_bad: - if (j) - job_remove(j); + if (jr) { + job_remove(jr); + } return NULL; } kern_return_t -job_handle_mpm_wait(struct jobcb *j, mach_port_t srp, int *waitstatus) +job_handle_mpm_wait(job_t j, mach_port_t srp, int *waitstatus) { if (j->p) { j->wait_reply_port = srp; @@ -648,108 +1061,171 @@ job_handle_mpm_wait(struct jobcb *j, mach_port_t srp, int *waitstatus) return 0; } -struct jobcb * -job_new_spawn(const char *label, const char *path, const char *workingdir, const char *const *argv, const char *const *env, mode_t *u_mask, bool w4d, bool fppc) +job_t +job_new_anonymous(jobmgr_t jm, pid_t anonpid) { - struct jobcb *jr; - - if ((jr = job_find(root_job, label)) != NULL) { - errno = EEXIST; + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, anonpid }; + struct kinfo_proc kp; + size_t len = sizeof(kp); + const char *zombie = NULL; + bool shutdown_state; + job_t jp = NULL, jr = NULL; + + if (!jobmgr_assumes(jm, anonpid != 0)) { + return NULL; + } + + if (!jobmgr_assumes(jm, anonpid < 100000)) { + /* The kernel current defines PID_MAX to be 99999, but that define isn't exported */ return NULL; } - jr = job_new(root_job, label, path, argv, NULL, MACH_PORT_NULL); - - if (!jr) + if (!jobmgr_assumes(jm, sysctl(mib, 4, &kp, &len, NULL, 0) != -1)) { return NULL; + } - jr->unload_at_exit = true; - jr->stall_before_exec = w4d; - jr->force_ppc = fppc; + if (len != sizeof(kp)) { + jobmgr_log(jm, LOG_DEBUG, "Tried to create an anonymous job for nonexistent PID: %u", anonpid); + return NULL; + } - if (!job_setup_machport(jr)) { - job_remove(jr); + if (!jobmgr_assumes(jm, kp.kp_proc.p_comm[0] != '\0')) { return NULL; } - if (workingdir) - jr->workingdir = strdup(workingdir); + if (kp.kp_proc.p_stat == SZOMB) { + jobmgr_log(jm, LOG_DEBUG, "Tried to create an anonymous job for zombie PID: %u", anonpid); + zombie = "zombie"; + } + + switch (kp.kp_eproc.e_ppid) { + case 0: + /* the kernel */ + break; + case 1: + if (getpid() != 1) { + /* we cannot possibly find a parent job_t that is useful in this function */ + break; + } + /* fall through */ + default: + jp = jobmgr_find_by_pid(jm, kp.kp_eproc.e_ppid, true); + jobmgr_assumes(jm, jp != NULL); + break; + } - if (u_mask) { - jr->mask = *u_mask; - jr->setmask = true; + /* A total hack: Normally, job_new() returns an error during shutdown, but anonymous jobs are special. */ + if ((shutdown_state = jm->shutting_down)) { + jm->shutting_down = false; } - if (env) for (; *env; env++) { - char newkey[strlen(*env) + 1], *eqoff = strchr(*env, '='); - if (!eqoff) { - job_log(jr, LOG_WARNING, "Environmental variable missing '=' separator: %s", *env); - continue; + if (jobmgr_assumes(jm, (jr = job_new(jm, AUTO_PICK_LEGACY_LABEL, zombie ? zombie : kp.kp_proc.p_comm, NULL)) != NULL)) { + u_int proc_fflags = NOTE_EXEC|NOTE_EXIT /* |NOTE_REAP */; + + total_anon_children++; + jr->anonymous = true; + jr->p = anonpid; + + /* anonymous process reaping is messy */ + LIST_INSERT_HEAD(&jm->active_jobs[ACTIVE_JOB_HASH(jr->p)], jr, pid_hash_sle); + + if (kevent_mod(jr->p, EVFILT_PROC, EV_ADD, proc_fflags, 0, root_jobmgr) == -1 && job_assumes(jr, errno == ESRCH)) { + /* zombies are weird */ + job_log(jr, LOG_ERR, "Failed to add kevent for PID %u. Will unload at MIG return", jr->p); + jr->unload_at_mig_return = true; + } + + if (jp) { + job_assumes(jr, mspolicy_copy(jr, jp)); } - strcpy(newkey, *env); - *eqoff = '\0'; - envitem_new(jr, newkey, eqoff + 1, false); + + if (shutdown_state && jm->hopefully_first_cnt == 0) { + job_log(jr, LOG_APPLEONLY, "This process showed up to the party while all the guests were leaving. Odds are that it will have a miserable time"); + } + + job_log(jr, LOG_DEBUG, "Created PID %u anonymously by PPID %u%s%s", anonpid, kp.kp_eproc.e_ppid, jp ? ": " : "", jp ? jp->label : ""); } - job_start(jr); + if (shutdown_state) { + jm->shutting_down = true; + } return jr; } -struct jobcb * -job_new(struct jobcb *p, const char *label, const char *prog, const char *const *argv, const char *stdinpath, mach_port_t reqport) +job_t +job_new(jobmgr_t jm, const char *label, const char *prog, const char *const *argv) { const char *const *argv_tmp = argv; + char auto_label[1000]; + const char *bn = NULL; char *co; + size_t minlabel_len; int i, cc = 0; - struct jobcb *j; + job_t j; + + launchd_assert(offsetof(struct job_s, kqjob_callback) == 0); + + if (jm->shutting_down) { + errno = EINVAL; + return NULL; + } - if (reqport == MACH_PORT_NULL && prog == NULL && argv == NULL) { + if (prog == NULL && argv == NULL) { errno = EINVAL; return NULL; } - j = calloc(1, sizeof(struct jobcb) + strlen(label) + 1); + if (label == AUTO_PICK_LEGACY_LABEL) { + bn = prog ? prog : basename((char *)argv[0]); /* prog for auto labels is kp.kp_kproc.p_comm */ + snprintf(auto_label, sizeof(auto_label), "%s.%s", sizeof(void *) == 8 ? "0xdeadbeeffeedface" : "0xbabecafe", bn); + label = auto_label; + /* This is so we can do gross things later. See NOTE_EXEC for anonymous jobs */ + minlabel_len = strlen(label) + MAXCOMLEN; + } else { + minlabel_len = strlen(label); + } - if (!launchd_assumes(j != NULL)) - goto out_bad; + j = calloc(1, sizeof(struct job_s) + minlabel_len + 1); - strcpy(j->label, label); + if (!jobmgr_assumes(jm, j != NULL)) { + return NULL; + } + + if (label == auto_label) { + snprintf((char *)j->label, strlen(label) + 1, "%p.%s", j, bn); + } else { + strcpy((char *)j->label, label); + } j->kqjob_callback = job_callback; - j->parent = p ? job_get_bs(p) : NULL; + j->mgr = jm; + j->min_run_time = LAUNCHD_MIN_JOB_RUN_TIME; + j->timeout = RUNTIME_ADVISABLE_IDLE_TIMEOUT; + j->exit_timeout = LAUNCHD_DEFAULT_EXIT_TIMEOUT; + j->currently_ignored = true; j->ondemand = true; j->checkedin = true; - j->firstborn = (strcmp(label, FIRSTBORN_LABEL) == 0); - - if (reqport != MACH_PORT_NULL) { - j->req_port = reqport; - if (!launchd_assumes(launchd_mport_notify_req(reqport, MACH_NOTIFY_DEAD_NAME) == KERN_SUCCESS)) - goto out_bad; - } if (prog) { j->prog = strdup(prog); - if (!launchd_assumes(j->prog != NULL)) - goto out_bad; - } - - if (stdinpath) { - j->stdinpath = strdup(stdinpath); - if (!launchd_assumes(j->stdinpath != NULL)) + if (!job_assumes(j, j->prog != NULL)) { goto out_bad; + } } if (argv) { while (*argv_tmp++) j->argc++; - for (i = 0; i < j->argc; i++) + for (i = 0; i < j->argc; i++) { cc += strlen(argv[i]) + 1; + } j->argv = malloc((j->argc + 1) * sizeof(char *) + cc); - if (!launchd_assumes(j != NULL)) + if (!job_assumes(j, j->argv != NULL)) { goto out_bad; + } co = ((char *)j->argv) + ((j->argc + 1) * sizeof(char *)); @@ -761,156 +1237,254 @@ job_new(struct jobcb *p, const char *label, const char *prog, const char *const j->argv[i] = NULL; } - if (j->parent) { - SLIST_INSERT_HEAD(&j->parent->jobs, j, sle); - job_log(j->parent, LOG_DEBUG, "Conceived"); - } + LIST_INSERT_HEAD(&jm->jobs, j, sle); + LIST_INSERT_HEAD(&label_hash[hash_label(j->label)], j, label_hash_sle); + + job_log(j, LOG_DEBUG, "Conceived"); return j; out_bad: - if (j) { - if (j->prog) - free(j->prog); - if (j->stdinpath) - free(j->stdinpath); - free(j); + if (j->prog) { + free(j->prog); } + free(j); + return NULL; } -struct jobcb * +job_t job_import(launch_data_t pload) { - struct jobcb *j = job_import2(pload); + job_t j = jobmgr_import2(root_jobmgr, pload); - if (j == NULL) + if (j == NULL) { return NULL; + } - job_dispatch(j); - - return j; + return job_dispatch(j, false); } launch_data_t job_import_bulk(launch_data_t pload) { launch_data_t resp = launch_data_alloc(LAUNCH_DATA_ARRAY); - struct jobcb **ja; + job_t *ja; size_t i, c = launch_data_array_get_count(pload); - ja = alloca(c * sizeof(struct jobcb *)); + ja = alloca(c * sizeof(job_t )); for (i = 0; i < c; i++) { - if ((ja[i] = job_import2(launch_data_array_get_index(pload, i)))) + if ((ja[i] = jobmgr_import2(root_jobmgr, launch_data_array_get_index(pload, i)))) { errno = 0; + } launch_data_array_set_index(resp, launch_data_new_errno(errno), i); } for (i = 0; i < c; i++) { - if (ja[i] == NULL) + if (ja[i] == NULL) { continue; - job_dispatch(ja[i]); + } + job_dispatch(ja[i], false); } return resp; } void -job_import_bool(struct jobcb *j, const char *key, bool value) +job_import_bool(job_t j, const char *key, bool value) { + bool found_key = false; + switch (key[0]) { - case 'f': - case 'F': - if (strcasecmp(key, LAUNCH_JOBKEY_FORCEPOWERPC) == 0) - j->force_ppc = value; + case 'a': + case 'A': + if (strcasecmp(key, LAUNCH_JOBKEY_ABANDONPROCESSGROUP) == 0) { + j->abandon_pg = value; + found_key = true; + } break; case 'k': case 'K': - if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE) == 0) { j->ondemand = !value; + found_key = true; + } break; case 'o': case 'O': - if (strcasecmp(key, LAUNCH_JOBKEY_ONDEMAND) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_ONDEMAND) == 0) { j->ondemand = value; + found_key = true; + } break; case 'd': case 'D': - if (strcasecmp(key, LAUNCH_JOBKEY_DEBUG) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_DEBUG) == 0) { j->debug = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_DISABLED) == 0) { + job_assumes(j, !value); + found_key = true; + } + break; + case 'h': + case 'H': + if (strcasecmp(key, LAUNCH_JOBKEY_HOPEFULLYEXITSLAST) == 0) { + j->hopefully_exits_last = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_HOPEFULLYEXITSFIRST) == 0) { + j->hopefully_exits_first = value; + found_key = true; + } break; case 's': case 'S': - if (strcasecmp(key, LAUNCH_JOBKEY_SESSIONCREATE) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_SESSIONCREATE) == 0) { j->session_create = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_STARTONMOUNT) == 0) { + j->start_on_mount = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_SERVICEIPC) == 0) { + /* this only does something on Mac OS X 10.4 "Tiger" */ + found_key = true; + } break; case 'l': case 'L': - if (strcasecmp(key, LAUNCH_JOBKEY_LOWPRIORITYIO) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_LOWPRIORITYIO) == 0) { j->low_pri_io = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LAUNCHONLYONCE) == 0) { + j->only_once = value; + found_key = true; + } + break; + case 'm': + case 'M': + if (strcasecmp(key, LAUNCH_JOBKEY_MACHEXCEPTIONHANDLER) == 0) { + j->internal_exc_handler = value; + found_key = true; + } break; case 'i': case 'I': - if (strcasecmp(key, LAUNCH_JOBKEY_INITGROUPS) == 0) - j->init_groups = value; + if (strcasecmp(key, LAUNCH_JOBKEY_INITGROUPS) == 0) { + if (getuid() != 0) { + job_log(j, LOG_WARNING, "Ignored this key: %s", key); + return; + } + j->no_init_groups = !value; + found_key = true; + } break; case 'r': case 'R': - if (strcasecmp(key, LAUNCH_JOBKEY_RUNATLOAD) == 0) - j->runatload = value; + if (strcasecmp(key, LAUNCH_JOBKEY_RUNATLOAD) == 0) { + if (value) { + /* We don't want value == false to change j->start_pending */ + j->start_pending = true; + } + found_key = true; + } break; case 'e': case 'E': - if (strcasecmp(key, LAUNCH_JOBKEY_ENABLEGLOBBING) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_ENABLEGLOBBING) == 0) { j->globargv = value; + found_key = true; + } else if (strcasecmp(key, LAUNCH_JOBKEY_ENTERKERNELDEBUGGERBEFOREKILL) == 0) { + j->debug_before_kill = value; + found_key = true; + } break; case 'w': case 'W': - if (strcasecmp(key, LAUNCH_JOBKEY_WAITFORDEBUGGER) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_WAITFORDEBUGGER) == 0) { j->wait4debugger = value; + found_key = true; + } break; default: break; } + + if (!found_key) { + job_log(j, LOG_WARNING, "Unknown key for boolean: %s", key); + } } void -job_import_string(struct jobcb *j, const char *key, const char *value) +job_import_string(job_t j, const char *key, const char *value) { char **where2put = NULL; - char **ignore = (char **)-1; switch (key[0]) { + case 'm': + case 'M': + if (strcasecmp(key, LAUNCH_JOBKEY_MACHEXCEPTIONHANDLER) == 0) { + where2put = &j->alt_exc_handler; + } + break; case 'p': case 'P': - if (strcasecmp(key, LAUNCH_JOBKEY_PROGRAM) == 0) - where2put = ignore; + if (strcasecmp(key, LAUNCH_JOBKEY_PROGRAM) == 0) { + return; + } break; case 'l': case 'L': - if (strcasecmp(key, LAUNCH_JOBKEY_LABEL) == 0) - where2put = ignore; + if (strcasecmp(key, LAUNCH_JOBKEY_LABEL) == 0) { + return; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADTOHOSTS) == 0) { + return; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADFROMHOSTS) == 0) { + return; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADTOSESSIONTYPE) == 0) { + job_reparent_hack(j, value); + return; + } break; case 'r': case 'R': - if (strcasecmp(key, LAUNCH_JOBKEY_ROOTDIRECTORY) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_ROOTDIRECTORY) == 0) { + if (getuid() != 0) { + job_log(j, LOG_WARNING, "Ignored this key: %s", key); + return; + } where2put = &j->rootdir; + } break; case 'w': case 'W': - if (strcasecmp(key, LAUNCH_JOBKEY_WORKINGDIRECTORY) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_WORKINGDIRECTORY) == 0) { where2put = &j->workingdir; + } break; case 'u': case 'U': - if (strcasecmp(key, LAUNCH_JOBKEY_USERNAME) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_USERNAME) == 0) { + if (getuid() != 0) { + job_log(j, LOG_WARNING, "Ignored this key: %s", key); + return; + } else if (strcmp(value, "root") == 0) { + return; + } where2put = &j->username; + } break; case 'g': case 'G': - if (strcasecmp(key, LAUNCH_JOBKEY_GROUPNAME) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_GROUPNAME) == 0) { + if (getuid() != 0) { + job_log(j, LOG_WARNING, "Ignored this key: %s", key); + return; + } else if (strcmp(value, "wheel") == 0) { + return; + } where2put = &j->groupname; + } break; case 's': case 'S': @@ -918,38 +1492,65 @@ job_import_string(struct jobcb *j, const char *key, const char *value) where2put = &j->stdoutpath; } else if (strcasecmp(key, LAUNCH_JOBKEY_STANDARDERRORPATH) == 0) { where2put = &j->stderrpath; +#if HAVE_SANDBOX + } else if (strcasecmp(key, LAUNCH_JOBKEY_SANDBOXPROFILE) == 0) { + where2put = &j->seatbelt_profile; +#endif } break; default: + job_log(j, LOG_WARNING, "Unknown key for string: %s", key); break; } if (where2put) { - if (where2put == ignore) - return; - - launchd_assumes((*where2put = strdup(value)) != NULL); + job_assumes(j, (*where2put = strdup(value)) != NULL); } else { - job_log(j, LOG_WARNING, "Unknown value for key %s: %s", key, value); + job_log(j, LOG_WARNING, "Unknown key: %s", key); } } void -job_import_integer(struct jobcb *j, const char *key, long long value) +job_import_integer(job_t j, const char *key, long long value) { switch (key[0]) { + case 'e': + case 'E': + if (strcasecmp(key, LAUNCH_JOBKEY_EXITTIMEOUT) == 0) { + if (value < 0) { + job_log(j, LOG_WARNING, "%s less than zero. Ignoring.", LAUNCH_JOBKEY_EXITTIMEOUT); + } else if (value > UINT32_MAX) { + job_log(j, LOG_WARNING, "%s is too large. Ignoring.", LAUNCH_JOBKEY_EXITTIMEOUT); + } else { + j->exit_timeout = value; + } + } + break; case 'n': case 'N': - if (strcasecmp(key, LAUNCH_JOBKEY_NICE) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_NICE) == 0) { j->nice = value; + j->setnice = true; + } break; case 't': case 'T': if (strcasecmp(key, LAUNCH_JOBKEY_TIMEOUT) == 0) { - if (value <= 0) - job_log(j, LOG_WARNING, "Timeout less than or equal to zero. Ignoring."); - else + if (value < 0) { + job_log(j, LOG_WARNING, "%s less than zero. Ignoring.", LAUNCH_JOBKEY_TIMEOUT); + } else if (value > UINT32_MAX) { + job_log(j, LOG_WARNING, "%s is too large. Ignoring.", LAUNCH_JOBKEY_TIMEOUT); + } else { j->timeout = value; + } + } else if (strcasecmp(key, LAUNCH_JOBKEY_THROTTLEINTERVAL) == 0) { + if (value < 0) { + job_log(j, LOG_WARNING, "%s less than zero. Ignoring.", LAUNCH_JOBKEY_THROTTLEINTERVAL); + } else if (value > UINT32_MAX) { + job_log(j, LOG_WARNING, "%s is too large. Ignoring.", LAUNCH_JOBKEY_THROTTLEINTERVAL); + } else { + j->min_run_time = value; + } } break; case 'u': @@ -962,42 +1563,108 @@ job_import_integer(struct jobcb *j, const char *key, long long value) case 's': case 'S': if (strcasecmp(key, LAUNCH_JOBKEY_STARTINTERVAL) == 0) { - if (value <= 0) - job_log(j, LOG_WARNING, "StartInterval is not greater than zero, ignoring"); - else + if (value <= 0) { + job_log(j, LOG_WARNING, "%s is not greater than zero. Ignoring.", LAUNCH_JOBKEY_STARTINTERVAL); + } else if (value > UINT32_MAX) { + job_log(j, LOG_WARNING, "%s is too large. Ignoring.", LAUNCH_JOBKEY_STARTINTERVAL); + } else { + runtime_add_ref(); j->start_interval = value; - if (-1 == kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, value, j)) - job_log_error(j, LOG_ERR, "adding kevent timer"); + + job_assumes(j, kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, value, j) != -1); + } +#if HAVE_SANDBOX + } else if (strcasecmp(key, LAUNCH_JOBKEY_SANDBOXFLAGS) == 0) { + j->seatbelt_flags = value; +#endif + } + + break; + default: + job_log(j, LOG_WARNING, "Unknown key for integer: %s", key); + break; + } +} + +void +job_import_opaque(job_t j __attribute__((unused)), + const char *key, launch_data_t value __attribute__((unused))) +{ + switch (key[0]) { + case 'q': + case 'Q': +#if HAVE_QUARANTINE + if (strcasecmp(key, LAUNCH_JOBKEY_QUARANTINEDATA) == 0) { + size_t tmpsz = launch_data_get_opaque_size(value); + + if (job_assumes(j, j->quarantine_data = malloc(tmpsz))) { + memcpy(j->quarantine_data, launch_data_get_opaque(value), tmpsz); + j->quarantine_data_sz = tmpsz; + } + } +#endif + break; + default: + break; + } +} + +static void +policy_setup(launch_data_t obj, const char *key, void *context) +{ + job_t j = context; + bool found_key = false; + + switch (key[0]) { + case 'd': + case 'D': + if (strcasecmp(key, LAUNCH_JOBPOLICY_DENYCREATINGOTHERJOBS) == 0) { + j->deny_job_creation = launch_data_get_bool(obj); + found_key = true; } break; default: break; } + + if (unlikely(!found_key)) { + job_log(j, LOG_WARNING, "Unknown policy: %s", key); + } } void -job_import_dictionary(struct jobcb *j, const char *key, launch_data_t value) +job_import_dictionary(job_t j, const char *key, launch_data_t value) { launch_data_t tmp; switch (key[0]) { + case 'p': + case 'P': + if (strcasecmp(key, LAUNCH_JOBKEY_POLICIES) == 0) { + launch_data_dict_iterate(value, policy_setup, j); + } + break; case 'k': case 'K': - if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE) == 0) { launch_data_dict_iterate(value, semaphoreitem_setup, j); + } break; case 'i': case 'I': if (strcasecmp(key, LAUNCH_JOBKEY_INETDCOMPATIBILITY) == 0) { j->inetcompat = true; - if ((tmp = launch_data_dict_lookup(value, LAUNCH_JOBINETDCOMPATIBILITY_WAIT))) + j->abandon_pg = true; + if ((tmp = launch_data_dict_lookup(value, LAUNCH_JOBINETDCOMPATIBILITY_WAIT))) { j->inetcompat_wait = launch_data_get_bool(tmp); + } } break; case 'e': case 'E': - if (strcasecmp(key, LAUNCH_JOBKEY_ENVIRONMENTVARIABLES) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_ENVIRONMENTVARIABLES) == 0) { launch_data_dict_iterate(value, envitem_setup, j); + } break; case 'u': case 'U': @@ -1015,6 +1682,10 @@ job_import_dictionary(struct jobcb *j, const char *key, launch_data_t value) calendarinterval_new_from_obj(j, value); } else if (strcasecmp(key, LAUNCH_JOBKEY_SOFTRESOURCELIMITS) == 0) { launch_data_dict_iterate(value, limititem_setup, j); +#if HAVE_SANDBOX + } else if (strcasecmp(key, LAUNCH_JOBKEY_SANDBOXFLAGS) == 0) { + launch_data_dict_iterate(value, seatbelt_setup_flags, j); +#endif } break; case 'h': @@ -1029,69 +1700,99 @@ job_import_dictionary(struct jobcb *j, const char *key, launch_data_t value) case 'M': if (strcasecmp(key, LAUNCH_JOBKEY_MACHSERVICES) == 0) { launch_data_dict_iterate(value, machservice_setup, j); - if (!SLIST_EMPTY(&j->machservices)) - job_setup_machport(j); + } else if (strcasecmp(key, LAUNCH_JOBKEY_MACHSERVICELOOKUPPOLICIES) == 0) { + launch_data_dict_iterate(value, mspolicy_setup, j); } break; default: + job_log(j, LOG_WARNING, "Unknown key for dictionary: %s", key); break; } } void -job_import_array(struct jobcb *j, const char *key, launch_data_t value) +job_import_array(job_t j, const char *key, launch_data_t value) { - bool is_q_dir = false; - bool is_wp = false; + size_t i, value_cnt = launch_data_array_get_count(value); + const char *str; switch (key[0]) { + case 'p': + case 'P': + if (strcasecmp(key, LAUNCH_JOBKEY_PROGRAMARGUMENTS) == 0) { + return; + } + break; + case 'l': + case 'L': + if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADTOHOSTS) == 0) { + return; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADFROMHOSTS) == 0) { + return; + } else if (strcasecmp(key, LAUNCH_JOBKEY_LIMITLOADTOSESSIONTYPE) == 0) { + job_log(j, LOG_NOTICE, "launchctl should have transformed the \"%s\" array to a string", LAUNCH_JOBKEY_LIMITLOADTOSESSIONTYPE); + return; + } + break; case 'q': case 'Q': if (strcasecmp(key, LAUNCH_JOBKEY_QUEUEDIRECTORIES) == 0) { - is_q_dir = true; - is_wp = true; + for (i = 0; i < value_cnt; i++) { + str = launch_data_get_string(launch_data_array_get_index(value, i)); + if (job_assumes(j, str != NULL)) { + semaphoreitem_new(j, DIR_NOT_EMPTY, str); + } + } + } break; case 'w': case 'W': - if (strcasecmp(key, LAUNCH_JOBKEY_WATCHPATHS) == 0) - is_wp = true; + if (strcasecmp(key, LAUNCH_JOBKEY_WATCHPATHS) == 0) { + for (i = 0; i < value_cnt; i++) { + str = launch_data_get_string(launch_data_array_get_index(value, i)); + if (job_assumes(j, str != NULL)) { + semaphoreitem_new(j, PATH_CHANGES, str); + } + } + } break; case 'b': case 'B': - if (strcasecmp(key, LAUNCH_JOBKEY_BONJOURFDS) == 0) + if (strcasecmp(key, LAUNCH_JOBKEY_BONJOURFDS) == 0) { socketgroup_setup(value, LAUNCH_JOBKEY_BONJOURFDS, j); + } else if (strcasecmp(key, LAUNCH_JOBKEY_BINARYORDERPREFERENCE) == 0) { + if (job_assumes(j, j->j_binpref = malloc(value_cnt * sizeof(*j->j_binpref)))) { + j->j_binpref_cnt = value_cnt; + for (i = 0; i < value_cnt; i++) { + j->j_binpref[i] = launch_data_get_integer(launch_data_array_get_index(value, i)); + } + } + } break; case 's': case 'S': if (strcasecmp(key, LAUNCH_JOBKEY_STARTCALENDARINTERVAL) == 0) { - size_t i = 0, ci_cnt = launch_data_array_get_count(value); - for (i = 0; i < ci_cnt; i++) + for (i = 0; i < value_cnt; i++) { calendarinterval_new_from_obj(j, launch_data_array_get_index(value, i)); + } } break; default: + job_log(j, LOG_WARNING, "Unknown key for array: %s", key); break; } - - if (is_wp) { - size_t i, wp_cnt = launch_data_array_get_count(value); - const char *thepath; - for (i = 0; i < wp_cnt; i++) { - thepath = launch_data_get_string(launch_data_array_get_index(value, i)); - watchpath_new(j, thepath, is_q_dir); - } - } } void job_import_keys(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + job_t j = context; launch_data_type_t kind; - if (obj == NULL) + if (obj == NULL) { return; + } kind = launch_data_get_type(obj); @@ -1111,151 +1812,419 @@ job_import_keys(launch_data_t obj, const char *key, void *context) case LAUNCH_DATA_ARRAY: job_import_array(j, key, obj); break; + case LAUNCH_DATA_OPAQUE: + job_import_opaque(j, key, obj); + break; default: job_log(j, LOG_WARNING, "Unknown value type '%d' for key: %s", kind, key); break; } } -struct jobcb * -job_import2(launch_data_t pload) +job_t +jobmgr_import2(jobmgr_t jm, launch_data_t pload) { launch_data_t tmp, ldpa; const char *label = NULL, *prog = NULL; const char **argv = NULL; - struct jobcb *j; + job_t j; - if (pload == NULL) + if (pload == NULL) { + errno = EINVAL; return NULL; + } - if (launch_data_get_type(pload) != LAUNCH_DATA_DICTIONARY) + if (launch_data_get_type(pload) != LAUNCH_DATA_DICTIONARY) { + errno = EINVAL; return NULL; - - if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_LABEL)) && - (launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) { - label = launch_data_get_string(tmp); - } - if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAM)) && - (launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) { - prog = launch_data_get_string(tmp); } - ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS); - if (label == NULL) { + if (!(tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_LABEL))) { errno = EINVAL; return NULL; - } else if ((j = job_find(root_job, label)) != NULL) { - errno = EEXIST; + } + + if (launch_data_get_type(tmp) != LAUNCH_DATA_STRING) { + errno = EINVAL; return NULL; - } else if (label[0] == '\0' || (strncasecmp(label, "", strlen("com.apple.launchd")) == 0) || - (strtol(label, NULL, 10) != 0)) { - syslog(LOG_ERR, "Somebody attempted to use a reserved prefix for a label: %s", label); - /* the empty string, com.apple.launchd and number prefixes for labels are reserved */ + } + + if (!(label = launch_data_get_string(tmp))) { errno = EINVAL; return NULL; } - if (ldpa) { - size_t i, c = launch_data_array_get_count(ldpa); + if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAM)) && + (launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) { + prog = launch_data_get_string(tmp); + } + + if ((ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS))) { + size_t i, c; + + if (launch_data_get_type(ldpa) != LAUNCH_DATA_ARRAY) { + errno = EINVAL; + return NULL; + } + + c = launch_data_array_get_count(ldpa); argv = alloca((c + 1) * sizeof(char *)); - for (i = 0; i < c; i++) - argv[i] = launch_data_get_string(launch_data_array_get_index(ldpa, i)); + for (i = 0; i < c; i++) { + tmp = launch_data_array_get_index(ldpa, i); + + if (launch_data_get_type(tmp) != LAUNCH_DATA_STRING) { + errno = EINVAL; + return NULL; + } + + argv[i] = launch_data_get_string(tmp); + } + argv[i] = NULL; } - if ((j = job_new(root_job, label, prog, argv, NULL, MACH_PORT_NULL))) + if ((j = job_find(label)) != NULL) { + errno = EEXIST; + return NULL; + } else if (!jobmgr_label_test(jm, label)) { + errno = EINVAL; + return NULL; + } + + if ((j = job_new(jm, label, prog, argv))) { launch_data_dict_iterate(pload, job_import_keys, j); + } return j; } -struct jobcb * -job_find(struct jobcb *j, const char *label) +bool +jobmgr_label_test(jobmgr_t jm, const char *str) { - struct jobcb *jr, *ji; + char *endstr = NULL; + const char *ptr; - if (label[0] == '\0') - return root_job; - - if (strcmp(j->label, label) == 0) - return j; + if (str[0] == '\0') { + jobmgr_log(jm, LOG_ERR, "Empty job labels are not allowed"); + return false; + } + + for (ptr = str; *ptr; ptr++) { + if (iscntrl(*ptr)) { + jobmgr_log(jm, LOG_ERR, "ASCII control characters are not allowed in job labels. Index: %td Value: 0x%hhx", ptr - str, *ptr); + return false; + } + } + + strtoll(str, &endstr, 0); - SLIST_FOREACH(ji, &j->jobs, sle) { - if ((jr = job_find(ji, label))) - return jr; + if (str != endstr) { + jobmgr_log(jm, LOG_ERR, "Job labels are not allowed to begin with numbers: %s", str); + return false; + } + + if ((strncasecmp(str, "com.apple.launchd", strlen("com.apple.launchd")) == 0) || + (strncasecmp(str, "com.apple.launchctl", strlen("com.apple.launchctl")) == 0)) { + jobmgr_log(jm, LOG_ERR, "Job labels are not allowed to use a reserved prefix: %s", str); + return false; } - errno = ESRCH; - return NULL; + return true; } -struct jobcb * -job_find_by_pid(struct jobcb *j, pid_t p) +job_t +job_find(const char *label) { - struct jobcb *jr, *ji; + job_t ji; - if (j->p == p) - return j; + LIST_FOREACH(ji, &label_hash[hash_label(label)], label_hash_sle) { + if (ji->removal_pending) { + continue; /* 5351245 */ + } else if (ji->mgr->shutting_down) { + continue; /* 5488633 */ + } - SLIST_FOREACH(ji, &j->jobs, sle) { - if ((jr = job_find_by_pid(ji, p))) - return jr; + if (strcmp(ji->label, label) == 0) { + return ji; + } } errno = ESRCH; return NULL; } -void -job_export_all2(struct jobcb *j, launch_data_t where) +job_t +jobmgr_find_by_pid(jobmgr_t jm, pid_t p, bool create_anon) { - launch_data_t tmp; - struct jobcb *ji; - - if (launchd_assumes((tmp = job_export2(j, false)) != NULL)) - launch_data_dict_insert(where, tmp, j->label); + job_t ji = NULL; - SLIST_FOREACH(ji, &j->jobs, sle) - job_export_all2(ji, where); -} + LIST_FOREACH(ji, &jm->active_jobs[ACTIVE_JOB_HASH(p)], pid_hash_sle) { + if (ji->p == p) { + break; + } + } + + if (ji) { + return ji; + } else if (create_anon) { + return job_new_anonymous(jm, p); + } else { + return NULL; + } +} + +job_t +job_mig_intran2(jobmgr_t jm, mach_port_t mport, pid_t upid) +{ + jobmgr_t jmi; + job_t ji; + + if (jm->jm_port == mport) { + jobmgr_assumes(jm, (ji = jobmgr_find_by_pid(jm, upid, true)) != NULL); + return ji; + } + + SLIST_FOREACH(jmi, &jm->submgrs, sle) { + job_t jr; + + if ((jr = job_mig_intran2(jmi, mport, upid))) { + return jr; + } + } + + LIST_FOREACH(ji, &jm->jobs, sle) { + if (ji->j_port == mport) { + return ji; + } + } + + return NULL; +} + +job_t +job_mig_intran(mach_port_t p) +{ + struct ldcred ldc; + job_t jr; + + runtime_get_caller_creds(&ldc); + + jr = job_mig_intran2(root_jobmgr, p, ldc.pid); + + if (!jobmgr_assumes(root_jobmgr, jr != NULL)) { + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, 0 }; + struct kinfo_proc kp; + size_t len = sizeof(kp); + + mib[3] = ldc.pid; + + if (jobmgr_assumes(root_jobmgr, sysctl(mib, 4, &kp, &len, NULL, 0) != -1) && jobmgr_assumes(root_jobmgr, len == sizeof(kp))) { + jobmgr_log(root_jobmgr, LOG_ERR, "%s() was confused by PID %u UID %u EUID %u Mach Port 0x%x: %s", __func__, ldc.pid, ldc.uid, ldc.euid, p, kp.kp_proc.p_comm); + } + } + + return jr; +} + +job_t +job_find_by_service_port(mach_port_t p) +{ + struct machservice *ms; + + LIST_FOREACH(ms, &port_hash[HASH_PORT(p)], port_hash_sle) { + if (ms->recv && (ms->port == p)) { + return ms->job; + } + } + + return NULL; +} + +void +job_mig_destructor(job_t j) +{ + /* + * 5477111 + * + * 'j' can be invalid at this point. We should fix this up after Leopard ships. + */ + + if (j && j != workaround_5477111 && j->unload_at_mig_return) { + job_log(j, LOG_NOTICE, "Unloading PID %u at MIG return.", j->p); + job_remove(j); + } + + workaround_5477111 = NULL; + + calendarinterval_sanity_check(); +} + +void +job_export_all2(jobmgr_t jm, launch_data_t where) +{ + jobmgr_t jmi; + job_t ji; + + SLIST_FOREACH(jmi, &jm->submgrs, sle) { + job_export_all2(jmi, where); + } + + LIST_FOREACH(ji, &jm->jobs, sle) { + launch_data_t tmp; + + if (jobmgr_assumes(jm, (tmp = job_export(ji)) != NULL)) { + launch_data_dict_insert(where, tmp, ji->label); + } + } +} launch_data_t job_export_all(void) { launch_data_t resp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); - job_export_all2(root_job, resp); + if (launchd_assumes(resp != NULL)) { + job_export_all2(root_jobmgr, resp); + } return resp; } void -job_reap(struct jobcb *j) +job_log_stray_pg(job_t j) +{ + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PGRP, j->p }; + size_t i, kp_cnt, len = sizeof(struct kinfo_proc) * get_kern_max_proc(); + struct kinfo_proc *kp; + +#if TARGET_OS_EMBEDDED + if (!do_apple_internal_magic) { + return; + } +#endif + + if (!job_assumes(j, (kp = malloc(len)) != NULL)) { + return; + } + if (!job_assumes(j, sysctl(mib, 4, kp, &len, NULL, 0) != -1)) { + goto out; + } + + kp_cnt = len / sizeof(struct kinfo_proc); + + for (i = 0; i < kp_cnt; i++) { + pid_t p_i = kp[i].kp_proc.p_pid; + pid_t pp_i = kp[i].kp_eproc.e_ppid; + const char *z = (kp[i].kp_proc.p_stat == SZOMB) ? "zombie " : ""; + const char *n = kp[i].kp_proc.p_comm; + + if (p_i == j->p) { + continue; + } else if (!job_assumes(j, p_i != 0 && p_i != 1)) { + continue; + } + + job_log(j, LOG_WARNING, "Stray %sprocess with PGID equal to this dead job: PID %u PPID %u %s", z, p_i, pp_i, n); + } + +out: + free(kp); +} + +void +job_reap(job_t j) { struct rusage ru; - time_t td = time(NULL) - j->start_time; - bool bad_exit = false; int status; job_log(j, LOG_DEBUG, "Reaping"); - if (j->execfd) { - launchd_assumes(close(j->execfd) == 0); - j->execfd = 0; + if (j->weird_bootstrap) { + mach_msg_size_t mxmsgsz = sizeof(union __RequestUnion__job_mig_protocol_vproc_subsystem); + + if (job_mig_protocol_vproc_subsystem.maxsize > mxmsgsz) { + mxmsgsz = job_mig_protocol_vproc_subsystem.maxsize; + } + + job_assumes(j, runtime_add_mport(j->mgr->jm_port, protocol_vproc_server, mxmsgsz) == KERN_SUCCESS); + j->weird_bootstrap = false; } - if (!launchd_assumes(wait4(j->p, &status, 0, &ru) != -1)) { - return; + if (j->log_redirect_fd && !j->wait4pipe_eof) { + job_assumes(j, runtime_close(j->log_redirect_fd) != -1); + j->log_redirect_fd = 0; + } + + if (j->forkfd) { + job_assumes(j, runtime_close(j->forkfd) != -1); + j->forkfd = 0; + } + + if (j->anonymous) { + status = 0; + memset(&ru, 0, sizeof(ru)); + } else { + /* + * The job is dead. While the PID/PGID is still known to be + * valid, try to kill abandoned descendant processes. + */ + job_log_stray_pg(j); + if (!j->abandon_pg) { + job_assumes(j, runtime_killpg(j->p, SIGTERM) != -1 || errno == ESRCH); + } + + /* + * 5020256 + * + * The current implementation of ptrace() causes the traced process to + * be abducted away from the true parent and adopted by the tracer. + * + * Once the tracing process relinquishes control, the kernel then + * restores the true parent/child relationship. + * + * Unfortunately, the wait*() family of APIs is unaware of the temporarily + * data structures changes, and they return an error if reality hasn't + * been restored by the time they are called. + */ + if (!job_assumes(j, wait4(j->p, &status, 0, &ru) != -1)) { + job_log(j, LOG_NOTICE, "Working around 5020256. Assuming the job crashed."); + + status = W_EXITCODE(0, SIGSEGV); + memset(&ru, 0, sizeof(ru)); + } + } + + if (j->exit_timeout) { + kevent_mod((uintptr_t)&j->exit_timeout, EVFILT_TIMER, EV_DELETE, 0, 0, NULL); + } + + if (j->anonymous) { + total_anon_children--; + } else { + runtime_del_ref(); + total_children--; } + LIST_REMOVE(j, pid_hash_sle); if (j->wait_reply_port) { job_log(j, LOG_DEBUG, "MPM wait reply being sent"); - launchd_assumes(mpm_wait_reply(j->wait_reply_port, 0, status) == 0); + job_assumes(j, job_mig_wait_reply(j->wait_reply_port, 0, status) == 0); j->wait_reply_port = MACH_PORT_NULL; } + if (j->sent_sigterm_time) { + uint64_t td_sec, td_usec, td = (mach_absolute_time() - j->sent_sigterm_time) * tbi.numer / tbi.denom; + + td_sec = td / NSEC_PER_SEC; + td_usec = (td % NSEC_PER_SEC) / NSEC_PER_USEC; + + job_log(j, LOG_INFO, "Exited %lld.%06lld seconds after %s was sent", + td_sec, td_usec, signal_to_C_name(j->sent_sigkill ? SIGKILL : SIGTERM)); + } + +#if DO_RUSAGE_SUMMATION timeradd(&ru.ru_utime, &j->ru.ru_utime, &j->ru.ru_utime); timeradd(&ru.ru_stime, &j->ru.ru_stime, &j->ru.ru_stime); j->ru.ru_maxrss += ru.ru_maxrss; @@ -1272,10 +2241,10 @@ job_reap(struct jobcb *j) j->ru.ru_nsignals += ru.ru_nsignals; j->ru.ru_nvcsw += ru.ru_nvcsw; j->ru.ru_nivcsw += ru.ru_nivcsw; +#endif if (WIFEXITED(status) && WEXITSTATUS(status) != 0) { - job_log(j, LOG_WARNING, "exited with exit code: %d", WEXITSTATUS(status)); - bad_exit = true; + job_log(j, LOG_WARNING, "Exited with exit code: %d", WEXITSTATUS(status)); } if (WIFSIGNALED(status)) { @@ -1284,242 +2253,512 @@ job_reap(struct jobcb *j) job_log(j, LOG_NOTICE, "Exited: %s", strsignal(s)); } else { job_log(j, LOG_WARNING, "Exited abnormally: %s", strsignal(s)); - bad_exit = true; } } - if (!j->ondemand && !j->legacy_mach_job) { - if (td < LAUNCHD_MIN_JOB_RUN_TIME) { - job_log(j, LOG_WARNING, "respawning too quickly! throttling"); - bad_exit = true; - j->throttle = true; - } else if (td >= LAUNCHD_REWARD_JOB_RUN_TIME) { - job_log(j, LOG_INFO, "lived long enough, forgiving past exit failures"); - j->failed_exits = 0; - } + if (j->hopefully_exits_first) { + j->mgr->hopefully_first_cnt--; + } else if (!j->anonymous && !j->hopefully_exits_last) { + j->mgr->normal_active_cnt--; + } + j->last_exit_status = status; + j->sent_sigkill = false; + j->lastlookup = NULL; + j->lastlookup_gennum = 0; + j->p = 0; + + /* + * We need to someday evaluate other jobs and find those who wish to track the + * active/inactive state of this job. The current job_dispatch() logic makes + * this messy, given that jobs can be deleted at dispatch. + */ +} + +void +jobmgr_dispatch_all(jobmgr_t jm, bool newmounthack) +{ + jobmgr_t jmi, jmn; + job_t ji, jn; + + if (jm->shutting_down) { + return; + } + + SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) { + jobmgr_dispatch_all(jmi, newmounthack); } - if (!j->legacy_mach_job && bad_exit) - j->failed_exits++; + LIST_FOREACH_SAFE(ji, &jm->jobs, sle, jn) { + if (newmounthack && ji->start_on_mount) { + ji->start_pending = true; + } - if (j->failed_exits > 0) { - int failures_left = LAUNCHD_FAILED_EXITS_THRESHOLD - j->failed_exits; - if (failures_left) - job_log(j, LOG_WARNING, "%d more failure%s without living at least %d seconds will cause job removal", - failures_left, failures_left > 1 ? "s" : "", LAUNCHD_REWARD_JOB_RUN_TIME); + job_dispatch(ji, false); } +} - total_children--; - j->last_exit_status = status; - j->p = 0; +job_t +job_dispatch(job_t j, bool kickstart) +{ + /* + * The whole job removal logic needs to be consolidated. The fact that + * a job can be removed from just about anywhere makes it easy to have + * stale pointers left behind somewhere on the stack that might get + * used after the deallocation. In particular, during job iteration. + * + * This is a classic example. The act of dispatching a job may delete it. + */ + if (!job_active(j)) { + if (job_useless(j)) { + job_remove(j); + return NULL; + } else if (kickstart || job_keepalive(j)) { + job_start(j); + } else { + job_watch(j); + + /* + * 5455720 + * + * Path checking and monitoring is really racy right now. + * We should clean this up post Leopard. + */ + if (job_keepalive(j)) { + job_start(j); + } + } + } else { + job_log(j, LOG_DEBUG, "Tried to dispatch an already active job."); + } + + return j; } void -job_dispatch(struct jobcb *j) +job_log_stdouterr2(job_t j, const char *msg, ...) { - if (job_active(j)) { + struct runtime_syslog_attr attr = { j->label, j->label, j->mgr->name, LOG_NOTICE, getuid(), j->p, j->p }; + va_list ap; + + va_start(ap, msg); + runtime_vsyslog(&attr, msg, ap); + va_end(ap); +} + +void +job_log_stdouterr(job_t j) +{ + char *msg, *bufindex, *buf = malloc(BIG_PIPE_SIZE + 1); + bool close_log_redir = false; + ssize_t rsz; + + if (!job_assumes(j, buf != NULL)) { return; - } else if (job_useless(j)) { - job_remove(j); - } else if (job_keepalive(j)) { - job_start(j); + } + + bufindex = buf; + + rsz = read(j->log_redirect_fd, buf, BIG_PIPE_SIZE); + + if (rsz == 0) { + job_log(j, LOG_DEBUG, "Standard out/error pipe closed"); + close_log_redir = true; + } else if (!job_assumes(j, rsz != -1)) { + close_log_redir = true; } else { - job_watch(j); + buf[rsz] = '\0'; + + while ((msg = strsep(&bufindex, "\n\r"))) { + if (msg[0]) { + job_log_stdouterr2(j, "%s", msg); + } + } + } + + free(buf); + + if (close_log_redir) { + job_assumes(j, runtime_close(j->log_redirect_fd) != -1); + j->log_redirect_fd = 0; + job_dispatch(j, false); } } void -job_callback(void *obj, struct kevent *kev) +job_kill(job_t j) { - struct jobcb *j = obj; - bool d = j->debug; - int oldmask = 0; + if (!j->p || j->anonymous) { + return; + } - if (d) { - oldmask = setlogmask(LOG_UPTO(LOG_DEBUG)); + job_assumes(j, runtime_kill(j->p, SIGKILL) != -1); + + j->sent_sigkill = true; + + job_assumes(j, kevent_mod((uintptr_t)&j->exit_timeout, EVFILT_TIMER, + EV_ADD, NOTE_SECONDS, LAUNCHD_SIGKILL_TIMER, j) != -1); + + job_log(j, LOG_DEBUG, "Sent SIGKILL signal."); +} + +void +job_callback_proc(job_t j, int flags __attribute__((unused)), int fflags) +{ + if ((fflags & NOTE_EXEC) && j->anonymous) { + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, j->p }; + struct kinfo_proc kp; + size_t len = sizeof(kp); + + if (job_assumes(j, sysctl(mib, 4, &kp, &len, NULL, 0) != -1)) { + char newlabel[1000]; + + snprintf(newlabel, sizeof(newlabel), "%p.%s", j, kp.kp_proc.p_comm); + + job_log(j, LOG_DEBUG, "Program changed. Updating the label to: %s", newlabel); + + LIST_REMOVE(j, label_hash_sle); + strcpy((char *)j->label, newlabel); + LIST_INSERT_HEAD(&label_hash[hash_label(j->label)], j, label_hash_sle); + } } - switch (kev->filter) { - case EVFILT_PROC: + if (fflags & NOTE_FORK) { + job_log(j, LOG_DEBUG, "Called fork()"); + } + + if (fflags & NOTE_EXIT) { job_reap(j); - if (j->firstborn) { - job_log(j, LOG_DEBUG, "first born died, begin shutdown"); - launchd_shutdown(); + if (j->anonymous) { + job_remove(j); + j = NULL; } else { - job_dispatch(j); + j = job_dispatch(j, false); } - break; - case EVFILT_TIMER: - if ((uintptr_t)j == kev->ident) { - job_start(j); + } + + /* NOTE_REAP sanity checking is disabled for now while we try and diagnose 5289559 */ +#if 0 + if (j && (fflags & NOTE_REAP)) { + job_assumes(j, flags & EV_ONESHOT); + job_assumes(j, flags & EV_EOF); + + job_assumes(j, j->p == 0); + } +#endif +} + +void +job_callback_timer(job_t j, void *ident) +{ + if (j == ident) { + job_dispatch(j, true); + } else if (&j->semaphores == ident) { + job_dispatch(j, false); + } else if (&j->start_interval == ident) { + j->start_pending = true; + job_dispatch(j, false); + } else if (&j->exit_timeout == ident) { + if (j->sent_sigkill) { + uint64_t td = (mach_absolute_time() - j->sent_sigterm_time) * tbi.numer / tbi.denom; + + td /= NSEC_PER_SEC; + td -= j->exit_timeout; + + job_log(j, LOG_ERR, "Did not die after sending SIGKILL %llu seconds ago...", td); } else { - calendarinterval_callback(j, kev); + job_force_sampletool(j); + if (j->debug_before_kill) { + job_log(j, LOG_NOTICE, "Exit timeout elapsed. Entering the kernel debugger."); + job_assumes(j, host_reboot(mach_host_self(), HOST_REBOOT_DEBUGGER) == KERN_SUCCESS); + } + job_log(j, LOG_WARNING, "Exit timeout elapsed (%u seconds). Killing.", j->exit_timeout); + job_kill(j); } - break; - case EVFILT_VNODE: - watchpath_callback(j, kev); - break; - case EVFILT_READ: - if ((int)kev->ident != j->execfd) { - socketgroup_callback(j, kev); - break; + } else { + job_assumes(j, false); + } +} + +void +job_callback_read(job_t j, int ident) +{ + if (ident == j->log_redirect_fd) { + job_log_stdouterr(j); + } else { + socketgroup_callback(j); + } +} + +void +jobmgr_reap_bulk(jobmgr_t jm, struct kevent *kev) +{ + jobmgr_t jmi; + job_t j; + + SLIST_FOREACH(jmi, &jm->submgrs, sle) { + jobmgr_reap_bulk(jmi, kev); + } + + if ((j = jobmgr_find_by_pid(jm, kev->ident, false))) { + kev->udata = j; + job_callback(j, kev); + } +} + +void +jobmgr_callback(void *obj, struct kevent *kev) +{ + jobmgr_t jm = obj; + + switch (kev->filter) { + case EVFILT_PROC: + jobmgr_reap_bulk(jm, kev); + if (launchd_assumes(root_jobmgr != NULL)) { + root_jobmgr = jobmgr_do_garbage_collection(root_jobmgr); } - if (j->wait4debugger) { - /* Allow somebody else to attach */ - launchd_assumes(kill(j->p, SIGSTOP) != -1); - launchd_assumes(ptrace(PT_DETACH, j->p, NULL, 0) != -1); + break; + case EVFILT_SIGNAL: + switch (kev->ident) { + case SIGTERM: + return launchd_shutdown(); + case SIGUSR1: + return calendarinterval_callback(); + default: + return (void)jobmgr_assumes(jm, false); } - if (kev->data > 0) { - int e; - - read(j->execfd, &e, sizeof(e)); - errno = e; - job_log_error(j, LOG_ERR, "execve()"); - job_remove(j); - j = NULL; - } else { - launchd_assumes(close(j->execfd) == 0); - j->execfd = 0; + break; + case EVFILT_FS: + if (kev->fflags & VQ_MOUNT) { + jobmgr_dispatch_all(jm, true); } + jobmgr_dispatch_all_semaphores(jm); break; - case EVFILT_MACHPORT: - job_start(j); + case EVFILT_TIMER: + if (jobmgr_assumes(jm, kev->ident == (uintptr_t)&sorted_calendar_events)) { + calendarinterval_callback(); + } break; default: - launchd_assumes(false); - break; + return (void)jobmgr_assumes(jm, false); } +} - if (d) { - /* the job might have been removed, must not call job_log() */ - setlogmask(oldmask); +void +job_callback(void *obj, struct kevent *kev) +{ + job_t j = obj; + + job_log(j, LOG_DEBUG, "Dispatching kevent callback."); + + switch (kev->filter) { + case EVFILT_PROC: + return job_callback_proc(j, kev->flags, kev->fflags); + case EVFILT_TIMER: + return job_callback_timer(j, (void *)kev->ident); + case EVFILT_VNODE: + return semaphoreitem_callback(j, kev); + case EVFILT_READ: + return job_callback_read(j, kev->ident); + case EVFILT_MACHPORT: + return (void)job_dispatch(j, true); + default: + return (void)job_assumes(j, false); } } void -job_start(struct jobcb *j) +job_start(job_t j) { + uint64_t td, tnow = mach_absolute_time(); int spair[2]; int execspair[2]; + int oepair[2]; char nbuf[64]; pid_t c; bool sipc = false; + u_int proc_fflags = /* NOTE_EXEC|NOTE_FORK| */ NOTE_EXIT /* |NOTE_REAP */; - if (!launchd_assumes(j->req_port == MACH_PORT_NULL)) - return; - - if (!launchd_assumes(j->parent != NULL)) + if (!job_assumes(j, j->mgr != NULL)) { return; + } if (job_active(j)) { job_log(j, LOG_DEBUG, "Already started"); return; - } else if (!j->legacy_mach_job && j->throttle) { - j->throttle = false; - job_log(j, LOG_WARNING, "Throttling: Will restart in %d seconds", LAUNCHD_MIN_JOB_RUN_TIME); - launchd_assumes(kevent_mod((uintptr_t)j, EVFILT_TIMER, EV_ADD|EV_ONESHOT, - NOTE_SECONDS, LAUNCHD_MIN_JOB_RUN_TIME, j) != -1); - return; } - job_log(j, LOG_DEBUG, "Starting"); - - if (!j->legacy_mach_job) - sipc = (!SLIST_EMPTY(&j->sockets) || !SLIST_EMPTY(&j->machservices)); - - /* FIXME, using stdinpath is a hack for re-reading the conf file */ - if (j->stdinpath) - sipc = true; + job_assumes(j, tnow > j->start_time); - j->checkedin = false; - - if (sipc) - socketpair(AF_UNIX, SOCK_STREAM, 0, spair); + /* + * Some users adjust the wall-clock and then expect software to not notice. + * Therefore, launchd must use an absolute clock instead of gettimeofday() + * or time() wherever possible. + */ + td = (tnow - j->start_time) * tbi.numer / tbi.denom; + td /= NSEC_PER_SEC; - socketpair(AF_UNIX, SOCK_STREAM, 0, execspair); + if (j->start_time && (td < j->min_run_time) && !j->legacy_mach_job && !j->inetcompat) { + time_t respawn_delta = j->min_run_time - (uint32_t)td; - time(&j->start_time); + /* + * We technically should ref-count throttled jobs to prevent idle exit, + * but we're not directly tracking the 'throttled' state at the moment. + */ - if (j->bs_port) { - launchd_assumes(launchd_mport_notify_req(j->bs_port, MACH_NOTIFY_NO_SENDERS) == KERN_SUCCESS); + job_log(j, LOG_WARNING, "Throttling respawn: Will start in %ld seconds", respawn_delta); + job_assumes(j, kevent_mod((uintptr_t)j, EVFILT_TIMER, EV_ADD|EV_ONESHOT, NOTE_SECONDS, respawn_delta, j) != -1); + job_ignore(j); + return; } - switch (c = job_fork(j->bs_port ? j : j->parent)) { + j->sent_sigterm_time = 0; + + if (!j->legacy_mach_job) { + sipc = (!SLIST_EMPTY(&j->sockets) || !SLIST_EMPTY(&j->machservices)); +#if TARGET_OS_EMBEDDED + if (j->username && strcmp(j->username, "mobile") == 0 && strncmp(j->label, "com.apple.", strlen("com.apple.")) != 0) { + sipc = false; + } +#endif + } + + j->checkedin = false; + + if (sipc) { + job_assumes(j, socketpair(AF_UNIX, SOCK_STREAM, 0, spair) != -1); + } + + job_assumes(j, socketpair(AF_UNIX, SOCK_STREAM, 0, execspair) != -1); + + if (!j->legacy_mach_job && job_assumes(j, pipe(oepair) != -1)) { + j->log_redirect_fd = _fd(oepair[0]); + job_assumes(j, fcntl(j->log_redirect_fd, F_SETFL, O_NONBLOCK) != -1); + job_assumes(j, kevent_mod(j->log_redirect_fd, EVFILT_READ, EV_ADD, 0, 0, j) != -1); + } + + j->start_time = tnow; + + switch (c = runtime_fork(j->weird_bootstrap ? j->j_port : j->mgr->jm_port)) { case -1: job_log_error(j, LOG_ERR, "fork() failed, will try again in one second"); - launchd_assumes(close(execspair[0]) == 0); - launchd_assumes(close(execspair[1]) == 0); + job_assumes(j, runtime_close(execspair[0]) == 0); + job_assumes(j, runtime_close(execspair[1]) == 0); if (sipc) { - launchd_assumes(close(spair[0]) == 0); - launchd_assumes(close(spair[1]) == 0); + job_assumes(j, runtime_close(spair[0]) == 0); + job_assumes(j, runtime_close(spair[1]) == 0); + } + if (!j->legacy_mach_job) { + job_assumes(j, runtime_close(oepair[0]) != -1); + job_assumes(j, runtime_close(oepair[1]) != -1); + j->log_redirect_fd = 0; } break; case 0: - launchd_assumes(close(execspair[0]) == 0); + if (_vproc_post_fork_ping()) { + _exit(EXIT_FAILURE); + } + if (!j->legacy_mach_job) { + job_assumes(j, dup2(oepair[1], STDOUT_FILENO) != -1); + job_assumes(j, dup2(oepair[1], STDERR_FILENO) != -1); + job_assumes(j, runtime_close(oepair[1]) != -1); + } + job_assumes(j, runtime_close(execspair[0]) == 0); /* wait for our parent to say they've attached a kevent to us */ read(_fd(execspair[1]), &c, sizeof(c)); - if (j->firstborn) { - setpgid(getpid(), getpid()); - if (isatty(STDIN_FILENO)) { - if (tcsetpgrp(STDIN_FILENO, getpid()) == -1) - job_log_error(j, LOG_WARNING, "tcsetpgrp()"); - } - } if (sipc) { - launchd_assumes(close(spair[0]) == 0); - sprintf(nbuf, "%d", spair[1]); + job_assumes(j, runtime_close(spair[0]) == 0); + snprintf(nbuf, sizeof(nbuf), "%d", spair[1]); setenv(LAUNCHD_TRUSTED_FD_ENV, nbuf, 1); } - job_start_child(j, execspair[1]); + job_start_child(j); break; default: - if (!SLIST_EMPTY(&j->machservices)) - j->priv_port_has_senders = true; - j->p = c; + job_log(j, LOG_DEBUG, "Started as PID: %u", c); + + j->start_pending = false; + + runtime_add_ref(); total_children++; - launchd_assumes(close(execspair[1]) == 0); - j->execfd = _fd(execspair[0]); + LIST_INSERT_HEAD(&j->mgr->active_jobs[ACTIVE_JOB_HASH(c)], j, pid_hash_sle); + + if (JOB_BOOTCACHE_HACK_CHECK(j)) { + did_first_per_user_launchd_BootCache_hack = true; + } + + if (!j->legacy_mach_job) { + job_assumes(j, runtime_close(oepair[1]) != -1); + } + j->p = c; + if (j->hopefully_exits_first) { + j->mgr->hopefully_first_cnt++; + } else if (!j->hopefully_exits_last) { + j->mgr->normal_active_cnt++; + } + j->forkfd = _fd(execspair[0]); + job_assumes(j, runtime_close(execspair[1]) == 0); if (sipc) { - launchd_assumes(close(spair[1]) == 0); + job_assumes(j, runtime_close(spair[1]) == 0); ipc_open(_fd(spair[0]), j); } - if (kevent_mod(j->execfd, EVFILT_READ, EV_ADD, 0, 0, &j->kqjob_callback) == -1) - job_log_error(j, LOG_ERR, "kevent_mod(j->execfd): %m"); - if (kevent_mod(c, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, &j->kqjob_callback) == -1) { - job_log_error(j, LOG_ERR, "kevent()"); - job_reap(j); + if (job_assumes(j, kevent_mod(c, EVFILT_PROC, EV_ADD, proc_fflags, 0, root_jobmgr ? root_jobmgr : j->mgr) != -1)) { + job_ignore(j); } else { - if (j->ondemand) - job_ignore(j); + job_reap(j); } if (!j->stall_before_exec) { - /* this unblocks the child and avoids a race - * between the above fork() and the kevent_mod() */ - write(j->execfd, &c, sizeof(c)); + job_uncork_fork(j); } break; } } void -job_start_child(struct jobcb *j, int execfd) +do_first_per_user_launchd_hack(void) +{ + char *bcct_tool[] = { "/usr/sbin/BootCacheControl", "tag", NULL }; + int dummystatus; + pid_t bcp; + + if (launchd_assumes((bcp = vfork()) != -1)) { + if (bcp == 0) { + execve(bcct_tool[0], bcct_tool, environ); + _exit(EXIT_FAILURE); + } else { + launchd_assumes(waitpid(bcp, &dummystatus, 0) != -1); + } + } +} + +void +job_start_child(job_t j) { const char *file2exec = "/usr/libexec/launchproxy"; const char **argv; + posix_spawnattr_t spattr; int gflags = GLOB_NOSORT|GLOB_NOCHECK|GLOB_TILDE|GLOB_DOOFFS; + pid_t junk_pid; glob_t g; + short spflags = POSIX_SPAWN_SETEXEC; + size_t binpref_out_cnt = 0; int i; + if (JOB_BOOTCACHE_HACK_CHECK(j)) { + do_first_per_user_launchd_hack(); + } + + job_assumes(j, posix_spawnattr_init(&spattr) == 0); + job_setup_attributes(j); if (j->argv && j->globargv) { g.gl_offs = 1; for (i = 0; i < j->argc; i++) { - if (i > 0) + if (i > 0) { gflags |= GLOB_APPEND; + } if (glob(j->argv[i], gflags, NULL, &g) != 0) { job_log_error(j, LOG_ERR, "glob(\"%s\")", j->argv[i]); exit(EXIT_FAILURE); @@ -1530,8 +2769,9 @@ job_start_child(struct jobcb *j, int execfd) } else if (j->argv) { argv = alloca((j->argc + 2) * sizeof(char *)); argv[0] = file2exec; - for (i = 0; i < j->argc; i++) + for (i = 0; i < j->argc; i++) { argv[i + 1] = j->argv[i]; + } argv[i + 1] = NULL; } else { argv = alloca(3 * sizeof(char *)); @@ -1540,188 +2780,396 @@ job_start_child(struct jobcb *j, int execfd) argv[2] = NULL; } - if (!j->inetcompat) + if (!j->inetcompat) { argv++; + } + + if (j->wait4debugger) { + job_log(j, LOG_WARNING, "Spawned and waiting for the debugger to attach before continuing..."); + spflags |= POSIX_SPAWN_START_SUSPENDED; + } + + job_assumes(j, posix_spawnattr_setflags(&spattr, spflags) == 0); + + if (j->j_binpref_cnt) { + job_assumes(j, posix_spawnattr_setbinpref_np(&spattr, j->j_binpref_cnt, j->j_binpref, &binpref_out_cnt) == 0); + job_assumes(j, binpref_out_cnt == j->j_binpref_cnt); + } + +#if HAVE_QUARANTINE + if (j->quarantine_data) { + qtn_proc_t qp; - if (j->wait4debugger && ptrace(PT_TRACE_ME, getpid(), NULL, 0) == -1) - job_log_error(j, LOG_ERR, "ptrace(PT_TRACE_ME, ...)"); + if (job_assumes(j, qp = qtn_proc_alloc())) { + if (job_assumes(j, qtn_proc_init_with_data(qp, j->quarantine_data, j->quarantine_data_sz) == 0)) { + job_assumes(j, qtn_proc_apply_to_self(qp) == 0); + } + } + } +#endif - if (j->force_ppc) { - int affinmib[] = { CTL_KERN, KERN_AFFINITY, 1, 1 }; - size_t mibsz = sizeof(affinmib) / sizeof(affinmib[0]); +#if HAVE_SANDBOX + if (j->seatbelt_profile) { + char *seatbelt_err_buf = NULL; - if (sysctl(affinmib, mibsz, NULL, NULL, NULL, 0) == -1) - job_log_error(j, LOG_WARNING, "Failed to force PowerPC execution"); + if (!job_assumes(j, sandbox_init(j->seatbelt_profile, j->seatbelt_flags, &seatbelt_err_buf) != -1)) { + if (seatbelt_err_buf) { + job_log(j, LOG_ERR, "Sandbox failed to init: %s", seatbelt_err_buf); + } + goto out_bad; + } } +#endif if (j->prog) { - execv(j->inetcompat ? file2exec : j->prog, (char *const*)argv); - job_log_error(j, LOG_ERR, "execv(\"%s\", ...)", j->prog); + errno = posix_spawn(&junk_pid, j->inetcompat ? file2exec : j->prog, NULL, &spattr, (char *const*)argv, environ); + job_log_error(j, LOG_ERR, "posix_spawn(\"%s\", ...)", j->prog); + } else { + errno = posix_spawnp(&junk_pid, j->inetcompat ? file2exec : argv[0], NULL, &spattr, (char *const*)argv, environ); + job_log_error(j, LOG_ERR, "posix_spawnp(\"%s\", ...)", argv[0]); + } + +#if HAVE_SANDBOX +out_bad: +#endif + _exit(EXIT_FAILURE); +} + +void +jobmgr_export_env_from_other_jobs(jobmgr_t jm, launch_data_t dict) +{ + launch_data_t tmp; + struct envitem *ei; + job_t ji; + + if (jm->parentmgr) { + jobmgr_export_env_from_other_jobs(jm->parentmgr, dict); } else { - execvp(j->inetcompat ? file2exec : argv[0], (char *const*)argv); - job_log_error(j, LOG_ERR, "execvp(\"%s\", ...)", argv[0]); + char **tmpenviron = environ; + for (; *tmpenviron; tmpenviron++) { + char envkey[1024]; + launch_data_t s = launch_data_alloc(LAUNCH_DATA_STRING); + launch_data_set_string(s, strchr(*tmpenviron, '=') + 1); + strncpy(envkey, *tmpenviron, sizeof(envkey)); + *(strchr(envkey, '=')) = '\0'; + launch_data_dict_insert(dict, s, envkey); + } } - write(execfd, &errno, sizeof(errno)); - exit(EXIT_FAILURE); + LIST_FOREACH(ji, &jm->jobs, sle) { + SLIST_FOREACH(ei, &ji->global_env, sle) { + if ((tmp = launch_data_new_string(ei->value))) { + launch_data_dict_insert(dict, tmp, ei->key); + } + } + } } -void job_setup_env_from_other_jobs(struct jobcb *j) +void +jobmgr_setup_env_from_other_jobs(jobmgr_t jm) { struct envitem *ei; - struct jobcb *ji; + job_t ji; - SLIST_FOREACH(ji, &j->jobs, sle) - job_setup_env_from_other_jobs(ji); + if (jm->parentmgr) { + jobmgr_setup_env_from_other_jobs(jm->parentmgr); + } - SLIST_FOREACH(ei, &j->global_env, sle) - setenv(ei->key, ei->value, 1); + LIST_FOREACH(ji, &jm->jobs, sle) { + SLIST_FOREACH(ei, &ji->global_env, sle) { + setenv(ei->key, ei->value, 1); + } + } +} + +void +job_find_and_blame_pids_with_weird_uids(job_t j) +{ + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL }; + size_t i, kp_cnt, len = sizeof(struct kinfo_proc) * get_kern_max_proc(); + struct kinfo_proc *kp; + uid_t u = j->mach_uid; + +#if TARGET_OS_EMBEDDED + if (!do_apple_internal_magic) { + return; + } +#endif + kp = malloc(len); + + if (!job_assumes(j, kp != NULL)) { + return; + } + if (!job_assumes(j, sysctl(mib, 3, kp, &len, NULL, 0) != -1)) { + goto out; + } + + kp_cnt = len / sizeof(struct kinfo_proc); + + for (i = 0; i < kp_cnt; i++) { + uid_t i_euid = kp[i].kp_eproc.e_ucred.cr_uid; + uid_t i_uid = kp[i].kp_eproc.e_pcred.p_ruid; + uid_t i_svuid = kp[i].kp_eproc.e_pcred.p_svuid; + pid_t i_pid = kp[i].kp_proc.p_pid; + + if (i_euid != u && i_uid != u && i_svuid != u) { + continue; + } + + job_log(j, LOG_ERR, "PID %u \"%s\" has no account to back it! Real/effective/saved UIDs: %u/%u/%u", + i_pid, kp[i].kp_proc.p_comm, i_uid, i_euid, i_svuid); + +/* Temporarily disabled due to 5423935 and 4946119. */ +#if 0 + /* Ask the accountless process to exit. */ + job_assumes(j, runtime_kill(i_pid, SIGTERM) != -1); +#endif + } + +out: + free(kp); +} + +#if !TARGET_OS_EMBEDDED +void +job_enable_audit_for_user(job_t j, uid_t u, char *name) +{ + auditinfo_t auinfo = { + .ai_auid = u, + .ai_asid = j->p, + }; + long au_cond; + + if (!job_assumes(j, auditon(A_GETCOND, &au_cond, sizeof(long)) == 0)) { + _exit(EXIT_FAILURE); + } + + if (au_cond != AUC_NOAUDIT) { + if (!job_assumes(j, au_user_mask(name, &auinfo.ai_mask) == 0)) { + _exit(EXIT_FAILURE); + } else if (!job_assumes(j, setaudit(&auinfo) == 0)) { + _exit(EXIT_FAILURE); + } + } +} +#endif + +void +job_postfork_become_user(job_t j) +{ + char loginname[2000]; + char tmpdirpath[PATH_MAX]; + char shellpath[PATH_MAX]; + char homedir[PATH_MAX]; + struct passwd *pwe; + size_t r; + gid_t desired_gid = -1; + uid_t desired_uid = -1; + + if (getuid() != 0) { + return; + } + + /* + * I contend that having UID == 0 and GID != 0 is of dubious value. + * Nevertheless, this used to work in Tiger. See: 5425348 + */ + if (j->groupname && !j->username) { + j->username = "root"; + } + + if (j->username) { + if ((pwe = getpwnam(j->username)) == NULL) { + job_log(j, LOG_ERR, "getpwnam(\"%s\") failed", j->username); + _exit(EXIT_FAILURE); + } + } else if (j->mach_uid) { + if ((pwe = getpwuid(j->mach_uid)) == NULL) { + job_log(j, LOG_ERR, "getpwuid(\"%u\") failed", j->mach_uid); + job_find_and_blame_pids_with_weird_uids(j); + _exit(EXIT_FAILURE); + } + } else { + return; + } + + /* + * We must copy the results of getpw*(). + * + * Why? Because subsequent API calls may call getpw*() as a part of + * their implementation. Since getpw*() returns a [now thread scoped] + * global, we must therefore cache the results before continuing. + */ + + desired_uid = pwe->pw_uid; + desired_gid = pwe->pw_gid; + + strlcpy(shellpath, pwe->pw_shell, sizeof(shellpath)); + strlcpy(loginname, pwe->pw_name, sizeof(loginname)); + strlcpy(homedir, pwe->pw_dir, sizeof(homedir)); + + if (pwe->pw_expire && time(NULL) >= pwe->pw_expire) { + job_log(j, LOG_ERR, "Expired account"); + _exit(EXIT_FAILURE); + } + + + if (j->username && strcmp(j->username, loginname) != 0) { + job_log(j, LOG_WARNING, "Suspicious setup: User \"%s\" maps to user: %s", j->username, loginname); + } else if (j->mach_uid && (j->mach_uid != desired_uid)) { + job_log(j, LOG_WARNING, "Suspicious setup: UID %u maps to UID %u", j->mach_uid, desired_uid); + } + + if (j->groupname) { + struct group *gre; + + if ((gre = getgrnam(j->groupname)) == NULL) { + job_log(j, LOG_ERR, "getgrnam(\"%s\") failed", j->groupname); + _exit(EXIT_FAILURE); + } + + desired_gid = gre->gr_gid; + } + +#if !TARGET_OS_EMBEDDED + job_enable_audit_for_user(j, desired_uid, loginname); +#endif + + if (!job_assumes(j, setlogin(loginname) != -1)) { + _exit(EXIT_FAILURE); + } + + if (!job_assumes(j, setgid(desired_gid) != -1)) { + _exit(EXIT_FAILURE); + } + + /* + * The kernel team and the DirectoryServices team want initgroups() + * called after setgid(). See 4616864 for more information. + */ + + if (!j->no_init_groups) { + if (!job_assumes(j, initgroups(loginname, desired_gid) != -1)) { + _exit(EXIT_FAILURE); + } + } + + if (!job_assumes(j, setuid(desired_uid) != -1)) { + _exit(EXIT_FAILURE); + } + + r = confstr(_CS_DARWIN_USER_TEMP_DIR, tmpdirpath, sizeof(tmpdirpath)); + + if (r > 0 && r < sizeof(tmpdirpath)) { + setenv("TMPDIR", tmpdirpath, 0); + } + + setenv("SHELL", shellpath, 0); + setenv("HOME", homedir, 0); + setenv("USER", loginname, 0); + setenv("LOGNAME", loginname, 0); } void -job_setup_attributes(struct jobcb *j) +job_setup_attributes(job_t j) { struct limititem *li; struct envitem *ei; - struct group *gre = NULL; - gid_t gre_g = 0; - setpriority(PRIO_PROCESS, 0, j->nice); + if (j->setnice) { + job_assumes(j, setpriority(PRIO_PROCESS, 0, j->nice) != -1); + } SLIST_FOREACH(li, &j->limits, sle) { struct rlimit rl; - if (getrlimit(li->which, &rl) == -1) { - job_log_error(j, LOG_WARNING, "getrlimit()"); + if (!job_assumes(j, getrlimit(li->which, &rl) != -1)) { continue; } - if (li->sethard) + if (li->sethard) { rl.rlim_max = li->lim.rlim_max; - if (li->setsoft) + } + if (li->setsoft) { rl.rlim_cur = li->lim.rlim_cur; + } - if (setrlimit(li->which, &rl) == -1) + if (setrlimit(li->which, &rl) == -1) { job_log_error(j, LOG_WARNING, "setrlimit()"); + } } - if (!j->inetcompat && j->session_create) + if (!j->inetcompat && j->session_create) { launchd_SessionCreate(); + } if (j->low_pri_io) { - int lowprimib[] = { CTL_KERN, KERN_PROC_LOW_PRI_IO }; - int val = 1; - - if (sysctl(lowprimib, sizeof(lowprimib) / sizeof(lowprimib[0]), NULL, NULL, &val, sizeof(val)) == -1) - job_log_error(j, LOG_WARNING, "sysctl(\"%s\")", "kern.proc_low_pri_io"); + job_assumes(j, setiopolicy_np(IOPOL_TYPE_DISK, IOPOL_SCOPE_PROCESS, IOPOL_THROTTLE) != -1); } if (j->rootdir) { - chroot(j->rootdir); - chdir("."); - } - if (j->groupname) { - gre = getgrnam(j->groupname); - if (gre) { - gre_g = gre->gr_gid; - if (-1 == setgid(gre_g)) { - job_log_error(j, LOG_ERR, "setgid(%d)", gre_g); - exit(EXIT_FAILURE); - } - } else { - job_log(j, LOG_ERR, "getgrnam(\"%s\") failed", j->groupname); - exit(EXIT_FAILURE); - } + job_assumes(j, chroot(j->rootdir) != -1); + job_assumes(j, chdir(".") != -1); } - if (j->username || j->mach_uid) { - struct passwd *pwe; - if (j->username) - pwe = getpwnam(j->username); - else - pwe = getpwuid(j->mach_uid); + job_postfork_become_user(j); - if (pwe) { - uid_t pwe_u = pwe->pw_uid; - uid_t pwe_g = pwe->pw_gid; - - if (pwe->pw_expire && time(NULL) >= pwe->pw_expire) { - job_log(j, LOG_ERR, "expired account: %s", j->username); - exit(EXIT_FAILURE); - } - if (j->init_groups) { - if (-1 == initgroups(j->username, gre ? gre_g : pwe_g)) { - job_log_error(j, LOG_ERR, "initgroups()"); - exit(EXIT_FAILURE); - } - } - if (!gre) { - if (-1 == setgid(pwe_g)) { - job_log_error(j, LOG_ERR, "setgid(%d)", pwe_g); - exit(EXIT_FAILURE); - } - } - if (-1 == setuid(pwe_u)) { - job_log_error(j, LOG_ERR, "setuid(%d)", pwe_u); - exit(EXIT_FAILURE); - } - } else { - if (j->username) { - job_log(j, LOG_WARNING, "getpwnam(\"%s\") failed", j->username); - } else { - job_log(j, LOG_WARNING, "getpwuid(\"%d\") failed", j->mach_uid); - } - exit(EXIT_FAILURE); - } + if (j->workingdir) { + job_assumes(j, chdir(j->workingdir) != -1); } - if (j->workingdir) - chdir(j->workingdir); - if (j->setmask) + + if (j->setmask) { umask(j->mask); - if (j->stdinpath) { - int sifd = open(j->stdinpath, O_RDONLY|O_NOCTTY); - if (sifd == -1) { - job_log_error(j, LOG_WARNING, "open(\"%s\", ...)", j->stdinpath); - } else { - launchd_assumes(dup2(sifd, STDIN_FILENO) != -1); - launchd_assumes(close(sifd) == 0); - } } - if (j->stdoutpath) { - int sofd = open(j->stdoutpath, O_WRONLY|O_APPEND|O_CREAT|O_NOCTTY, DEFFILEMODE); - if (sofd == -1) { - job_log_error(j, LOG_WARNING, "open(\"%s\", ...)", j->stdoutpath); - } else { - launchd_assumes(dup2(sofd, STDOUT_FILENO) != -1); - launchd_assumes(close(sofd) == 0); - } + + job_setup_fd(j, STDOUT_FILENO, j->stdoutpath, O_WRONLY|O_APPEND|O_CREAT); + job_setup_fd(j, STDERR_FILENO, j->stderrpath, O_WRONLY|O_APPEND|O_CREAT); + + jobmgr_setup_env_from_other_jobs(j->mgr); + + SLIST_FOREACH(ei, &j->env, sle) { + setenv(ei->key, ei->value, 1); } - if (j->stderrpath) { - int sefd = open(j->stderrpath, O_WRONLY|O_APPEND|O_CREAT|O_NOCTTY, DEFFILEMODE); - if (sefd == -1) { - job_log_error(j, LOG_WARNING, "open(\"%s\", ...)", j->stderrpath); - } else { - launchd_assumes(dup2(sefd, STDERR_FILENO) != -1); - launchd_assumes(close(sefd) == 0); - } + + /* + * We'd like to call setsid() unconditionally, but we have reason to + * believe that prevents launchd from being able to send signals to + * setuid children. We'll settle for process-groups. + */ + if (getppid() != 1) { + job_assumes(j, setpgid(0, 0) != -1); + } else { + job_assumes(j, setsid() != -1); } +} - job_setup_env_from_other_jobs(root_job); +void +job_setup_fd(job_t j, int target_fd, const char *path, int flags) +{ + int fd; - SLIST_FOREACH(ei, &j->env, sle) - setenv(ei->key, ei->value, 1); + if (!path) { + return; + } - setsid(); + if ((fd = open(path, flags|O_NOCTTY, DEFFILEMODE)) == -1) { + job_log_error(j, LOG_WARNING, "open(\"%s\", ...)", path); + return; + } + + job_assumes(j, dup2(fd, target_fd) != -1); + job_assumes(j, runtime_close(fd) == 0); } int -dir_has_files(const char *path) +dir_has_files(job_t j, const char *path) { DIR *dd = opendir(path); struct dirent *de; bool r = 0; - if (!dd) + if (!dd) { return -1; + } while ((de = readdir(dd))) { if (strcmp(de->d_name, ".") && strcmp(de->d_name, "..")) { @@ -1730,14 +3178,15 @@ dir_has_files(const char *path) } } - launchd_assumes(closedir(dd) == 0); + job_assumes(j, closedir(dd) == 0); return r; } void -calendarinterval_setalarm(struct jobcb *j, struct calendarinterval *ci) +calendarinterval_setalarm(job_t j, struct calendarinterval *ci) { - time_t later; + struct calendarinterval *ci_iter, *ci_prev = NULL; + time_t later, head_later; later = cronemu(ci->when.tm_mon, ci->when.tm_mday, ci->when.tm_hour, ci->when.tm_min); @@ -1751,173 +3200,387 @@ calendarinterval_setalarm(struct jobcb *j, struct calendarinterval *ci) } } - if (-1 == kevent_mod((uintptr_t)ci, EVFILT_TIMER, EV_ADD, NOTE_ABSOLUTE|NOTE_SECONDS, later, j)) { - job_log_error(j, LOG_ERR, "adding kevent alarm"); - } else { - job_log(j, LOG_INFO, "scheduled to run again at %s", ctime(&later)); + ci->when_next = later; + + LIST_FOREACH(ci_iter, &sorted_calendar_events, global_sle) { + if (ci->when_next < ci_iter->when_next) { + LIST_INSERT_BEFORE(ci_iter, ci, global_sle); + break; + } + + ci_prev = ci_iter; } -} -size_t -job_prep_log_preface(struct jobcb *j, char *buf) -{ - size_t lsz = strlen(j->label); - char newlabel[lsz * 2 + 1]; - size_t i, o, r = 0; + if (ci_iter == NULL) { + /* ci must want to fire after every other timer, or there are no timers */ - for (i = 0, o = 0; i < lsz; i++, o++) { - if (j->label[i] == '%') { - newlabel[o] = '%'; - o++; - newlabel[o] = '%'; + if (LIST_EMPTY(&sorted_calendar_events)) { + LIST_INSERT_HEAD(&sorted_calendar_events, ci, global_sle); } else { - newlabel[o] = j->label[i]; + LIST_INSERT_AFTER(ci_prev, ci, global_sle); } } - newlabel[o] = '\0'; - if (j->parent) - r = job_prep_log_preface(j->parent, buf); + head_later = LIST_FIRST(&sorted_calendar_events)->when_next; - return r + sprintf(buf + r, "%s%s", j->parent ? "/" : "", newlabel); -} + /* Workaround 5225889 */ + kevent_mod((uintptr_t)&sorted_calendar_events, EVFILT_TIMER, EV_DELETE, 0, 0, root_jobmgr); -void -job_log_error(struct jobcb *j, int pri, const char *msg, ...) -{ - char newmsg[10000]; - va_list ap; - size_t o; + if (job_assumes(j, kevent_mod((uintptr_t)&sorted_calendar_events, EVFILT_TIMER, EV_ADD, NOTE_ABSOLUTE|NOTE_SECONDS, head_later, root_jobmgr) != -1)) { + char time_string[100]; + size_t time_string_len; - o = job_prep_log_preface(j, newmsg); + ctime_r(&later, time_string); + time_string_len = strlen(time_string); - sprintf(newmsg + o, ": %s: %s", msg, strerror(errno)); + if (time_string_len && time_string[time_string_len - 1] == '\n') { + time_string[time_string_len - 1] = '\0'; + } - va_start(ap, msg); - vsyslog(pri, newmsg, ap); - va_end(ap); + job_log(j, LOG_INFO, "Scheduled to run again at %s", time_string); + } } void -job_log(struct jobcb *j, int pri, const char *msg, ...) +extract_rcsid_substr(const char *i, char *o, size_t osz) { - char newmsg[10000]; - va_list ap; - size_t o; - - o = job_prep_log_preface(j, newmsg); - - sprintf(newmsg + o, ": %s", msg); + char *rcs_rev_tmp = strchr(i, ' '); - va_start(ap, msg); - vsyslog(pri, newmsg, ap); - va_end(ap); + if (!rcs_rev_tmp) { + strlcpy(o, i, osz); + } else { + strlcpy(o, rcs_rev_tmp + 1, osz); + rcs_rev_tmp = strchr(o, ' '); + if (rcs_rev_tmp) { + *rcs_rev_tmp = '\0'; + } + } } -bool -watchpath_new(struct jobcb *j, const char *name, bool qdir) +void +jobmgr_log_bug(jobmgr_t jm, const char *rcs_rev, const char *path, unsigned int line, const char *test) { - struct watchpath *wp = calloc(1, sizeof(struct watchpath) + strlen(name) + 1); - - if (!launchd_assumes(wp != NULL)) - return false; - - wp->is_qdir = qdir; + int saved_errno = errno; + const char *file = strrchr(path, '/'); + char buf[100]; - wp->fd = -1; /* watchpath_watch() will open this */ + extract_rcsid_substr(rcs_rev, buf, sizeof(buf)); - strcpy(wp->name, name); - - SLIST_INSERT_HEAD(&j->vnodes, wp, sle); + if (!file) { + file = path; + } else { + file += 1; + } - return true; -} + jobmgr_log(jm, LOG_NOTICE, "Bug: %s:%u (%s):%u: %s", file, line, buf, saved_errno, test); +} void -watchpath_delete(struct jobcb *j, struct watchpath *wp) +job_log_bug(job_t j, const char *rcs_rev, const char *path, unsigned int line, const char *test) { - if (wp->fd != -1) - launchd_assumes(close(wp->fd) != -1); - - SLIST_REMOVE(&j->vnodes, wp, watchpath, sle); + int saved_errno = errno; + const char *file = strrchr(path, '/'); + char buf[100]; - free(wp); -} + extract_rcsid_substr(rcs_rev, buf, sizeof(buf)); -void -watchpath_ignore(struct jobcb *j, struct watchpath *wp) -{ - if (wp->fd != -1) { - job_log(j, LOG_DEBUG, "Ignoring Vnode: %d", wp->fd); - launchd_assumes(kevent_mod(wp->fd, EVFILT_VNODE, EV_DELETE, 0, 0, NULL) != -1); + if (!file) { + file = path; + } else { + file += 1; } + + job_log(j, LOG_NOTICE, "Bug: %s:%u (%s):%u: %s", file, line, buf, saved_errno, test); } void -watchpath_watch(struct jobcb *j, struct watchpath *wp) +job_logv(job_t j, int pri, int err, const char *msg, va_list ap) { - int fflags = NOTE_WRITE|NOTE_EXTEND|NOTE_ATTRIB|NOTE_LINK; - int qdir_file_cnt; - - if (!wp->is_qdir) - fflags |= NOTE_DELETE|NOTE_RENAME|NOTE_REVOKE; + struct runtime_syslog_attr attr = { "com.apple.launchd", j->label, j->mgr->name, pri, getuid(), getpid(), j->p }; + char *newmsg; + int oldmask = 0; + size_t newmsgsz; - if (wp->fd == -1) - wp->fd = _fd(open(wp->name, O_EVTONLY|O_NOCTTY|O_NOFOLLOW)); + /* + * Hack: If bootstrap_port is set, we must be on the child side of a + * fork(), but before the exec*(). Let's route the log message back to + * launchd proper. + */ + if (bootstrap_port) { + return _vproc_logv(pri, err, msg, ap); + } - if (wp->fd == -1) - return job_log_error(j, LOG_ERR, "Watchpath monitoring failed on \"%s\"", wp->name); + newmsgsz = strlen(msg) + 200; + newmsg = alloca(newmsgsz); - job_log(j, LOG_DEBUG, "Watching Vnode: %d", wp->fd); - launchd_assumes(kevent_mod(wp->fd, EVFILT_VNODE, EV_ADD|EV_CLEAR, fflags, 0, j) != -1); + if (err) { + snprintf(newmsg, newmsgsz, "%s: %s", msg, strerror(err)); + } else { + snprintf(newmsg, newmsgsz, "%s", msg); + } - if (!wp->is_qdir) + if (j->debug) { + oldmask = setlogmask(LOG_UPTO(LOG_DEBUG)); + } + + runtime_vsyslog(&attr, newmsg, ap); + + if (j->debug) { + setlogmask(oldmask); + } +} + +void +job_log_error(job_t j, int pri, const char *msg, ...) +{ + va_list ap; + + va_start(ap, msg); + job_logv(j, pri, errno, msg, ap); + va_end(ap); +} + +void +job_log(job_t j, int pri, const char *msg, ...) +{ + va_list ap; + + va_start(ap, msg); + job_logv(j, pri, 0, msg, ap); + va_end(ap); +} + +#if 0 +void +jobmgr_log_error(jobmgr_t jm, int pri, const char *msg, ...) +{ + va_list ap; + + va_start(ap, msg); + jobmgr_logv(jm, pri, errno, msg, ap); + va_end(ap); +} +#endif + +void +jobmgr_log(jobmgr_t jm, int pri, const char *msg, ...) +{ + va_list ap; + + va_start(ap, msg); + jobmgr_logv(jm, pri, 0, msg, ap); + va_end(ap); +} + +void +jobmgr_logv(jobmgr_t jm, int pri, int err, const char *msg, va_list ap) +{ + char *newmsg; + char *newname; + size_t i, o, jmname_len = strlen(jm->name), newmsgsz; + + newname = alloca((jmname_len + 1) * 2); + newmsgsz = (jmname_len + 1) * 2 + strlen(msg) + 100; + newmsg = alloca(newmsgsz); + + for (i = 0, o = 0; i < jmname_len; i++, o++) { + if (jm->name[i] == '%') { + newname[o] = '%'; + o++; + } + newname[o] = jm->name[i]; + } + newname[o] = '\0'; + + if (err) { + snprintf(newmsg, newmsgsz, "%s: %s: %s", newname, msg, strerror(err)); + } else { + snprintf(newmsg, newmsgsz, "%s: %s", newname, msg); + } + + if (jm->parentmgr) { + jobmgr_logv(jm->parentmgr, pri, 0, newmsg, ap); + } else { + struct runtime_syslog_attr attr = { "com.apple.launchd", "com.apple.launchd", jm->name, pri, getuid(), getpid(), getpid() }; + + runtime_vsyslog(&attr, newmsg, ap); + } +} + +void +semaphoreitem_ignore(job_t j, struct semaphoreitem *si) +{ + if (si->fd != -1) { + job_log(j, LOG_DEBUG, "Ignoring Vnode: %d", si->fd); + job_assumes(j, kevent_mod(si->fd, EVFILT_VNODE, EV_DELETE, 0, 0, NULL) != -1); + } +} + +void +semaphoreitem_watch(job_t j, struct semaphoreitem *si) +{ + char *parentdir, tmp_path[PATH_MAX]; + const char *which_path = si->what; + int saved_errno = 0; + int fflags = 0; + + switch (si->why) { + case PATH_EXISTS: + fflags = NOTE_DELETE|NOTE_RENAME|NOTE_REVOKE|NOTE_EXTEND|NOTE_WRITE; + break; + case PATH_MISSING: + fflags = NOTE_DELETE|NOTE_RENAME; + break; + case DIR_NOT_EMPTY: + case PATH_CHANGES: + fflags = NOTE_DELETE|NOTE_RENAME|NOTE_REVOKE|NOTE_EXTEND|NOTE_WRITE|NOTE_ATTRIB|NOTE_LINK; + break; + default: + return; + } + + /* dirname() may modify tmp_path */ + strlcpy(tmp_path, si->what, sizeof(tmp_path)); + + if (!job_assumes(j, (parentdir = dirname(tmp_path)))) { return; + } + + /* See 5321044 for why we do the do-while loop and 5415523 for why ENOENT is checked */ + do { + if (si->fd == -1) { + if ((si->fd = _fd(open(which_path, O_EVTONLY|O_NOCTTY))) == -1) { + which_path = parentdir; + si->fd = _fd(open(which_path, O_EVTONLY|O_NOCTTY)); + } + } + + if (si->fd == -1) { + return job_log_error(j, LOG_ERR, "Path monitoring failed on \"%s\"", which_path); + } - if (-1 == (qdir_file_cnt = dir_has_files(wp->name))) { - job_log_error(j, LOG_ERR, "dir_has_files(\"%s\", ...)", wp->name); - } else if (qdir_file_cnt > 0) { - job_start(j); + job_log(j, LOG_DEBUG, "Watching Vnode: %d", si->fd); + + if (kevent_mod(si->fd, EVFILT_VNODE, EV_ADD, fflags, 0, j) == -1) { + saved_errno = errno; + /* + * The FD can be revoked between the open() and kevent(). + * This is similar to the inability for kevents to be + * attached to short lived zombie processes after fork() + * but before kevent(). + */ + job_assumes(j, runtime_close(si->fd) == 0); + si->fd = -1; + } + } while ((si->fd == -1) && (saved_errno == ENOENT)); + + if (saved_errno == ENOTSUP) { + /* + * 3524219 NFS needs kqueue support + * 4124079 VFS needs generic kqueue support + * 5226811 EVFILT: Launchd EVFILT_VNODE doesn't work on /dev + */ + job_log(j, LOG_DEBUG, "Falling back to polling for path: %s", si->what); + + if (!j->poll_for_vfs_changes) { + j->poll_for_vfs_changes = true; + job_assumes(j, kevent_mod((uintptr_t)&j->semaphores, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, 3, j) != -1); + } } } void -watchpath_callback(struct jobcb *j, struct kevent *kev) +semaphoreitem_callback(job_t j, struct kevent *kev) { - struct watchpath *wp; - int dir_file_cnt; + char invalidation_reason[100] = ""; + struct semaphoreitem *si; + + SLIST_FOREACH(si, &j->semaphores, sle) { + switch (si->why) { + case PATH_CHANGES: + case PATH_EXISTS: + case PATH_MISSING: + case DIR_NOT_EMPTY: + break; + default: + continue; + } - SLIST_FOREACH(wp, &j->vnodes, sle) { - if (wp->fd == (int)kev->ident) + if (si->fd == (int)kev->ident) { break; + } } - launchd_assumes(wp != NULL); + if (!job_assumes(j, si != NULL)) { + return; + } - if ((NOTE_DELETE|NOTE_RENAME|NOTE_REVOKE) & kev->fflags) { - job_log(j, LOG_DEBUG, "Path invalidated: %s", wp->name); - launchd_assumes(close(wp->fd) == 0); - wp->fd = -1; /* this will get fixed in watchpath_watch() */ - } else if (!wp->is_qdir) { - job_log(j, LOG_DEBUG, "Watch path modified: %s", wp->name); - } else { - job_log(j, LOG_DEBUG, "Queue directory modified: %s", wp->name); + if (NOTE_DELETE & kev->fflags) { + strcat(invalidation_reason, "deleted"); + } - if (-1 == (dir_file_cnt = dir_has_files(wp->name))) { - job_log_error(j, LOG_ERR, "dir_has_files(\"%s\", ...)", wp->name); - } else if (0 == dir_file_cnt) { - job_log(j, LOG_DEBUG, "Spurious wake up, directory is empty again: %s", wp->name); - return; + if (NOTE_RENAME & kev->fflags) { + if (invalidation_reason[0]) { + strcat(invalidation_reason, "/renamed"); + } else { + strcat(invalidation_reason, "renamed"); + } + } + + if (NOTE_REVOKE & kev->fflags) { + if (invalidation_reason[0]) { + strcat(invalidation_reason, "/revoked"); + } else { + strcat(invalidation_reason, "revoked"); } } - job_start(j); + if (invalidation_reason[0]) { + job_log(j, LOG_DEBUG, "Path %s: %s", invalidation_reason, si->what); + job_assumes(j, runtime_close(si->fd) == 0); + si->fd = -1; /* this will get fixed in semaphoreitem_watch() */ + } + + job_log(j, LOG_DEBUG, "Watch path modified: %s", si->what); + + if (si->why == PATH_CHANGES) { + j->start_pending = true; + } + + job_dispatch(j, false); +} + +void +calendarinterval_new_from_obj_dict_walk(launch_data_t obj, const char *key, void *context) +{ + struct tm *tmptm = context; + int64_t val; + + if (LAUNCH_DATA_INTEGER != launch_data_get_type(obj)) { + /* hack to let caller know something went wrong */ + tmptm->tm_sec = -1; + return; + } + + val = launch_data_get_integer(obj); + + if (strcasecmp(key, LAUNCH_JOBKEY_CAL_MINUTE) == 0) { + tmptm->tm_min = val; + } else if (strcasecmp(key, LAUNCH_JOBKEY_CAL_HOUR) == 0) { + tmptm->tm_hour = val; + } else if (strcasecmp(key, LAUNCH_JOBKEY_CAL_DAY) == 0) { + tmptm->tm_mday = val; + } else if (strcasecmp(key, LAUNCH_JOBKEY_CAL_WEEKDAY) == 0) { + tmptm->tm_wday = val; + } else if (strcasecmp(key, LAUNCH_JOBKEY_CAL_MONTH) == 0) { + tmptm->tm_mon = val; + tmptm->tm_mon -= 1; /* 4798263 cron compatibility */ + } } bool -calendarinterval_new_from_obj(struct jobcb *j, launch_data_t obj) +calendarinterval_new_from_obj(job_t j, launch_data_t obj) { - launch_data_t tmp_k; struct tm tmptm; memset(&tmptm, 0, sizeof(0)); @@ -1928,157 +3591,200 @@ calendarinterval_new_from_obj(struct jobcb *j, launch_data_t obj) tmptm.tm_wday = -1; tmptm.tm_mon = -1; - if (LAUNCH_DATA_DICTIONARY != launch_data_get_type(obj)) + if (!job_assumes(j, obj != NULL)) { + return false; + } + + if (LAUNCH_DATA_DICTIONARY != launch_data_get_type(obj)) { return false; + } + + launch_data_dict_iterate(obj, calendarinterval_new_from_obj_dict_walk, &tmptm); - if ((tmp_k = launch_data_dict_lookup(obj, LAUNCH_JOBKEY_CAL_MINUTE))) - tmptm.tm_min = launch_data_get_integer(tmp_k); - if ((tmp_k = launch_data_dict_lookup(obj, LAUNCH_JOBKEY_CAL_HOUR))) - tmptm.tm_hour = launch_data_get_integer(tmp_k); - if ((tmp_k = launch_data_dict_lookup(obj, LAUNCH_JOBKEY_CAL_DAY))) - tmptm.tm_mday = launch_data_get_integer(tmp_k); - if ((tmp_k = launch_data_dict_lookup(obj, LAUNCH_JOBKEY_CAL_WEEKDAY))) - tmptm.tm_wday = launch_data_get_integer(tmp_k); - if ((tmp_k = launch_data_dict_lookup(obj, LAUNCH_JOBKEY_CAL_MONTH))) - tmptm.tm_mon = launch_data_get_integer(tmp_k); + if (tmptm.tm_sec == -1) { + return false; + } return calendarinterval_new(j, &tmptm); } bool -calendarinterval_new(struct jobcb *j, struct tm *w) +calendarinterval_new(job_t j, struct tm *w) { struct calendarinterval *ci = calloc(1, sizeof(struct calendarinterval)); - if (!launchd_assumes(ci != NULL)) + if (!job_assumes(j, ci != NULL)) { return false; + } ci->when = *w; + ci->job = j; SLIST_INSERT_HEAD(&j->cal_intervals, ci, sle); - + calendarinterval_setalarm(j, ci); + runtime_add_ref(); + return true; } void -calendarinterval_delete(struct jobcb *j, struct calendarinterval *ci) +calendarinterval_delete(job_t j, struct calendarinterval *ci) { - launchd_assumes(kevent_mod((uintptr_t)ci, EVFILT_TIMER, EV_DELETE, 0, 0, NULL) != -1); - SLIST_REMOVE(&j->cal_intervals, ci, calendarinterval, sle); + LIST_REMOVE(ci, global_sle); free(ci); + + runtime_del_ref(); } void -calendarinterval_callback(struct jobcb *j, struct kevent *kev) +calendarinterval_sanity_check(void) { - struct calendarinterval *ci; + struct calendarinterval *ci = LIST_FIRST(&sorted_calendar_events); + time_t now = time(NULL); - SLIST_FOREACH(ci, &j->cal_intervals, sle) { - if ((uintptr_t)ci == kev->ident) - break; + if (ci && (ci->when_next < now)) { + jobmgr_assumes(root_jobmgr, raise(SIGUSR1) != -1); } +} + +void +calendarinterval_callback(void) +{ + struct calendarinterval *ci, *ci_next; + time_t now = time(NULL); + + LIST_FOREACH_SAFE(ci, &sorted_calendar_events, global_sle, ci_next) { + job_t j = ci->job; + + if (ci->when_next > now) { + break; + } - if (launchd_assumes(ci != NULL)) { + LIST_REMOVE(ci, global_sle); calendarinterval_setalarm(j, ci); - job_start(j); + + j->start_pending = true; + job_dispatch(j, false); } } bool -socketgroup_new(struct jobcb *j, const char *name, int *fds, unsigned int fd_cnt, bool junkfds) +socketgroup_new(job_t j, const char *name, int *fds, unsigned int fd_cnt, bool junkfds) { struct socketgroup *sg = calloc(1, sizeof(struct socketgroup) + strlen(name) + 1); - if (!launchd_assumes(sg != NULL)) + if (!job_assumes(j, sg != NULL)) { return false; + } sg->fds = calloc(1, fd_cnt * sizeof(int)); sg->fd_cnt = fd_cnt; sg->junkfds = junkfds; - if (!launchd_assumes(sg->fds != NULL)) { + if (!job_assumes(j, sg->fds != NULL)) { free(sg); return false; } memcpy(sg->fds, fds, fd_cnt * sizeof(int)); - strcpy(sg->name, name); + strcpy(sg->name_init, name); SLIST_INSERT_HEAD(&j->sockets, sg, sle); + runtime_add_ref(); + return true; } void -socketgroup_delete(struct jobcb *j, struct socketgroup *sg) +socketgroup_delete(job_t j, struct socketgroup *sg) { unsigned int i; - for (i = 0; i < sg->fd_cnt; i++) - launchd_assumes(close(sg->fds[i]) != -1); + for (i = 0; i < sg->fd_cnt; i++) { +#if 0 + struct sockaddr_storage ss; + struct sockaddr_un *sun = (struct sockaddr_un *)&ss; + socklen_t ss_len = sizeof(ss); + + /* 5480306 */ + if (job_assumes(j, getsockname(sg->fds[i], (struct sockaddr *)&ss, &ss_len) != -1) + && job_assumes(j, ss_len > 0) && (ss.ss_family == AF_UNIX)) { + job_assumes(j, unlink(sun->sun_path) != -1); + /* We might conditionally need to delete a directory here */ + } +#endif + job_assumes(j, runtime_close(sg->fds[i]) != -1); + } SLIST_REMOVE(&j->sockets, sg, socketgroup, sle); free(sg->fds); free(sg); + + runtime_del_ref(); } void -socketgroup_ignore(struct jobcb *j, struct socketgroup *sg) +socketgroup_kevent_mod(job_t j, struct socketgroup *sg, bool do_add) { + struct kevent kev[sg->fd_cnt]; char buf[10000]; unsigned int i, buf_off = 0; - if (sg->junkfds) + if (sg->junkfds) { return; + } + + for (i = 0; i < sg->fd_cnt; i++) { + EV_SET(&kev[i], sg->fds[i], EVFILT_READ, do_add ? EV_ADD : EV_DELETE, 0, 0, j); + buf_off += snprintf(buf + buf_off, sizeof(buf) - buf_off, " %d", sg->fds[i]); + } - for (i = 0; i < sg->fd_cnt; i++) - buf_off += sprintf(buf + buf_off, " %d", sg->fds[i]); + job_log(j, LOG_DEBUG, "%s Sockets:%s", do_add ? "Watching" : "Ignoring", buf); - job_log(j, LOG_DEBUG, "Ignoring Sockets:%s", buf); + job_assumes(j, kevent_bulk_mod(kev, sg->fd_cnt) != -1); - for (i = 0; i < sg->fd_cnt; i++) - launchd_assumes(kevent_mod(sg->fds[i], EVFILT_READ, EV_DELETE, 0, 0, NULL) != -1); + for (i = 0; i < sg->fd_cnt; i++) { + job_assumes(j, kev[i].flags & EV_ERROR); + errno = kev[i].data; + job_assumes(j, kev[i].data == 0); + } } void -socketgroup_watch(struct jobcb *j, struct socketgroup *sg) +socketgroup_ignore(job_t j, struct socketgroup *sg) { - char buf[10000]; - unsigned int i, buf_off = 0; - - if (sg->junkfds) - return; - - for (i = 0; i < sg->fd_cnt; i++) - buf_off += sprintf(buf + buf_off, " %d", sg->fds[i]); - - job_log(j, LOG_DEBUG, "Watching sockets:%s", buf); + socketgroup_kevent_mod(j, sg, false); +} - for (i = 0; i < sg->fd_cnt; i++) - launchd_assumes(kevent_mod(sg->fds[i], EVFILT_READ, EV_ADD, 0, 0, j) != -1); +void +socketgroup_watch(job_t j, struct socketgroup *sg) +{ + socketgroup_kevent_mod(j, sg, true); } void -socketgroup_callback(struct jobcb *j, struct kevent *kev) +socketgroup_callback(job_t j) { - job_start(j); + job_dispatch(j, true); } bool -envitem_new(struct jobcb *j, const char *k, const char *v, bool global) +envitem_new(job_t j, const char *k, const char *v, bool global) { struct envitem *ei = calloc(1, sizeof(struct envitem) + strlen(k) + 1 + strlen(v) + 1); - if (!launchd_assumes(ei != NULL)) + if (!job_assumes(j, ei != NULL)) { return false; + } - strcpy(ei->key, k); - ei->value = ei->key + strlen(k) + 1; + strcpy(ei->key_init, k); + ei->value = ei->key_init + strlen(k) + 1; strcpy(ei->value, v); if (global) { @@ -2087,11 +3793,13 @@ envitem_new(struct jobcb *j, const char *k, const char *v, bool global) SLIST_INSERT_HEAD(&j->env, ei, sle); } + job_log(j, LOG_DEBUG, "Added environmental variable: %s=%s", k, v); + return true; } void -envitem_delete(struct jobcb *j, struct envitem *ei, bool global) +envitem_delete(job_t j, struct envitem *ei, bool global) { if (global) { SLIST_REMOVE(&j->global_env, ei, envitem, sle); @@ -2105,29 +3813,34 @@ envitem_delete(struct jobcb *j, struct envitem *ei, bool global) void envitem_setup(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + job_t j = context; - if (launch_data_get_type(obj) != LAUNCH_DATA_STRING) + if (launch_data_get_type(obj) != LAUNCH_DATA_STRING) { return; + } envitem_new(j, key, launch_data_get_string(obj), j->importing_global_env); } bool -limititem_update(struct jobcb *j, int w, rlim_t r) +limititem_update(job_t j, int w, rlim_t r) { struct limititem *li; SLIST_FOREACH(li, &j->limits, sle) { - if (li->which == w) + if (li->which == w) { break; + } } if (li == NULL) { li = calloc(1, sizeof(struct limititem)); - if (!launchd_assumes(li != NULL)) + if (!job_assumes(j, li != NULL)) { return false; + } + + SLIST_INSERT_HEAD(&j->limits, li, sle); li->which = w; } @@ -2144,61 +3857,92 @@ limititem_update(struct jobcb *j, int w, rlim_t r) } void -limititem_delete(struct jobcb *j, struct limititem *li) +limititem_delete(job_t j, struct limititem *li) { SLIST_REMOVE(&j->limits, li, limititem, sle); free(li); } +#if HAVE_SANDBOX +void +seatbelt_setup_flags(launch_data_t obj, const char *key, void *context) +{ + job_t j = context; + + if (launch_data_get_type(obj) != LAUNCH_DATA_BOOL) { + job_log(j, LOG_WARNING, "Sandbox flag value must be boolean: %s", key); + return; + } + + if (launch_data_get_bool(obj) == false) { + return; + } + + if (strcasecmp(key, LAUNCH_JOBKEY_SANDBOX_NAMED) == 0) { + j->seatbelt_flags |= SANDBOX_NAMED; + } +} +#endif + void limititem_setup(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + job_t j = context; int i, limits_cnt = (sizeof(launchd_keys2limits) / sizeof(launchd_keys2limits[0])); rlim_t rl; - if (launch_data_get_type(obj) != LAUNCH_DATA_INTEGER) + if (launch_data_get_type(obj) != LAUNCH_DATA_INTEGER) { return; + } rl = launch_data_get_integer(obj); for (i = 0; i < limits_cnt; i++) { - if (strcasecmp(launchd_keys2limits[i].key, key) == 0) + if (strcasecmp(launchd_keys2limits[i].key, key) == 0) { break; + } } - if (i == limits_cnt) + if (i == limits_cnt) { return; + } limititem_update(j, launchd_keys2limits[i].val, rl); } bool -job_useless(struct jobcb *j) +job_useless(job_t j) { - if (j->unload_at_exit) { + /* Yes, j->unload_at_exit and j->only_once seem the same, but they'll differ someday... */ + + if ((j->unload_at_exit || j->only_once) && j->start_time != 0) { + if (j->unload_at_exit && j->j_port) { + return false; + } job_log(j, LOG_INFO, "Exited. Was only configured to run once."); return true; - } else if (shutdown_in_progress) { - job_log(j, LOG_INFO, "Exited while shutdown in progress."); + } else if (j->removal_pending) { + job_log(j, LOG_DEBUG, "Exited while removal was pending."); return true; - } else if (j->failed_exits >= LAUNCHD_FAILED_EXITS_THRESHOLD) { - job_log(j, LOG_WARNING, "too many failures in succession"); - return true; - } else if (!j->checkedin && (!SLIST_EMPTY(&j->sockets) || !SLIST_EMPTY(&j->machservices))) { - job_log(j, LOG_WARNING, "Failed to check-in!"); - return true; - } else if (j->legacy_mach_job && SLIST_EMPTY(&j->machservices)) { - job_log(j, LOG_INFO, "Garbage collecting"); + } else if (j->mgr->shutting_down && (j->hopefully_exits_first || j->mgr->hopefully_first_cnt == 0)) { + job_log(j, LOG_DEBUG, "Exited while shutdown in progress. Processes remaining: %lu/%lu", total_children, total_anon_children); return true; + } else if (j->legacy_mach_job) { + if (SLIST_EMPTY(&j->machservices)) { + job_log(j, LOG_INFO, "Garbage collecting"); + return true; + } else if (!j->checkedin) { + job_log(j, LOG_WARNING, "Failed to check-in!"); + return true; + } } return false; } bool -job_keepalive(struct jobcb *j) +job_keepalive(job_t j) { mach_msg_type_number_t statusCnt; mach_port_status_t status; @@ -2206,10 +3950,23 @@ job_keepalive(struct jobcb *j) struct machservice *ms; struct stat sb; bool good_exit = (WIFEXITED(j->last_exit_status) && WEXITSTATUS(j->last_exit_status) == 0); - bool dispatch_others = false; - if (j->runatload && j->start_time == 0) { - job_log(j, LOG_DEBUG, "KeepAlive check: job needs to run at least once."); + if (j->mgr->shutting_down) { + return false; + } + + /* + * 5066316 + * + * We definitely need to revisit this after Leopard ships. Please see + * launchctl.c for the other half of this hack. + */ + if (j->mgr->global_on_demand_cnt > 0 && strcmp(j->label, "com.apple.kextd") != 0) { + return false; + } + + if (j->start_pending) { + job_log(j, LOG_DEBUG, "KeepAlive check: Pent-up non-IPC launch criteria."); return true; } @@ -2221,8 +3978,9 @@ job_keepalive(struct jobcb *j) SLIST_FOREACH(ms, &j->machservices, sle) { statusCnt = MACH_PORT_RECEIVE_STATUS_COUNT; if (mach_port_get_attributes(mach_task_self(), ms->port, MACH_PORT_RECEIVE_STATUS, - (mach_port_info_t)&status, &statusCnt) != KERN_SUCCESS) + (mach_port_info_t)&status, &statusCnt) != KERN_SUCCESS) { continue; + } if (status.mps_msgcount) { job_log(j, LOG_DEBUG, "KeepAlive check: job restarted due to %d queued Mach messages on service: %s", status.mps_msgcount, ms->name); @@ -2233,13 +3991,15 @@ job_keepalive(struct jobcb *j) SLIST_FOREACH(si, &j->semaphores, sle) { bool wanted_state = false; + int qdir_file_cnt; + job_t other_j; + switch (si->why) { case NETWORK_UP: wanted_state = true; case NETWORK_DOWN: if (network_up == wanted_state) { - job_log(j, LOG_DEBUG, "KeepAlive check: job configured to run while the network is %s.", - wanted_state ? "up" : "down"); + job_log(j, LOG_DEBUG, "KeepAlive: The network is %s.", wanted_state ? "up" : "down"); return true; } break; @@ -2247,33 +4007,58 @@ job_keepalive(struct jobcb *j) wanted_state = true; case FAILED_EXIT: if (good_exit == wanted_state) { - job_log(j, LOG_DEBUG, "KeepAlive check: job configured to run while the exit state was %s.", - wanted_state ? "successful" : "failure"); + job_log(j, LOG_DEBUG, "KeepAlive: The exit state was %s.", wanted_state ? "successful" : "failure"); + return true; + } + break; + case OTHER_JOB_ENABLED: + wanted_state = true; + case OTHER_JOB_DISABLED: + if ((bool)job_find(si->what) == wanted_state) { + job_log(j, LOG_DEBUG, "KeepAlive: The following job is %s: %s", wanted_state ? "enabled" : "disabled", si->what); return true; } break; + case OTHER_JOB_ACTIVE: + wanted_state = true; + case OTHER_JOB_INACTIVE: + if ((other_j = job_find(si->what))) { + if ((bool)other_j->p == wanted_state) { + job_log(j, LOG_DEBUG, "KeepAlive: The following job is %s: %s", wanted_state ? "active" : "inactive", si->what); + return true; + } + } + break; case PATH_EXISTS: wanted_state = true; case PATH_MISSING: if ((bool)(stat(si->what, &sb) == 0) == wanted_state) { - job_log(j, LOG_DEBUG, "KeepAlive check: job configured to run while the following path %s: %s", - wanted_state ? "exists" : "is missing", si->what); + if (si->fd != -1) { + job_assumes(j, runtime_close(si->fd) == 0); + si->fd = -1; + } + job_log(j, LOG_DEBUG, "KeepAlive: The following path %s: %s", wanted_state ? "exists" : "is missing", si->what); + return true; + } + break; + case PATH_CHANGES: + break; + case DIR_NOT_EMPTY: + if (-1 == (qdir_file_cnt = dir_has_files(j, si->what))) { + job_log_error(j, LOG_ERR, "Failed to count the number of files in \"%s\"", si->what); + } else if (qdir_file_cnt > 0) { + job_log(j, LOG_DEBUG, "KeepAlive: Directory is not empty: %s", si->what); return true; } - dispatch_others = true; break; } } - /* Maybe another job has the inverse path based semaphore as this job */ - if (dispatch_others) - job_dispatch_all_other_semaphores(root_job, j); - return false; } const char * -job_prog(struct jobcb *j) +job_prog(job_t j) { if (j->prog) { return j->prog; @@ -2284,101 +4069,90 @@ job_prog(struct jobcb *j) } } -bool -job_active(struct jobcb *j) +const char * +job_active(job_t j) { struct machservice *ms; - if (j->req_port) - return true; + if (j->p) { + return "PID is still valid"; + } - if (j->p) - return true; + if (j->mgr->shutting_down && j->log_redirect_fd) { + job_assumes(j, runtime_close(j->log_redirect_fd) != -1); + j->log_redirect_fd = 0; + } - if (j->priv_port_has_senders) { - if (j->start_time && !j->checkedin) { - if (j->legacy_mach_job) { - job_log(j, LOG_NOTICE, "Daemonized. Extremely expensive no-op."); - } else if (!j->unload_at_exit) { - job_log(j, LOG_ERR, "Daemonization is not supported under launchd."); - return false; - } + if (j->log_redirect_fd) { + if (job_assumes(j, j->wait4pipe_eof)) { + return "Standard out/error is still valid"; + } else { + job_assumes(j, runtime_close(j->log_redirect_fd) != -1); + j->log_redirect_fd = 0; } - return true; + } + + if (j->priv_port_has_senders) { + return "Privileged Port still has outstanding senders"; } SLIST_FOREACH(ms, &j->machservices, sle) { - if (ms->isActive) - return true; + if (ms->recv && ms->isActive) { + return "Mach service is still active"; + } } - return false; + return NULL; } -pid_t -launchd_fork(void) +void +machservice_watch(job_t j, struct machservice *ms) { - return job_fork(root_job); + if (ms->recv) { + job_assumes(j, runtime_add_mport(ms->port, NULL, 0) == KERN_SUCCESS); + } } -pid_t -job_fork(struct jobcb *j) +void +machservice_ignore(job_t j, struct machservice *ms) { - mach_port_t p = j->bs_port; - pid_t r = -1; - - sigprocmask(SIG_BLOCK, &blocked_signals, NULL); - - launchd_assumes(launchd_mport_make_send(p) == KERN_SUCCESS); - launchd_assumes(launchd_set_bport(p) == KERN_SUCCESS); - launchd_assumes(launchd_mport_deallocate(p) == KERN_SUCCESS); - - r = fork(); - - if (r != 0) { - launchd_assumes(launchd_set_bport(MACH_PORT_NULL) == KERN_SUCCESS); - } else if (r == 0) { - size_t i; - - for (i = 0; i < NSIG; i++) { - if (sigismember(&blocked_signals, i)) - signal(i, SIG_DFL); - } - } - - sigprocmask(SIG_UNBLOCK, &blocked_signals, NULL); - - return r; + job_assumes(j, runtime_remove_mport(ms->port) == KERN_SUCCESS); } void -machservice_resetport(struct jobcb *j, struct machservice *ms) +machservice_resetport(job_t j, struct machservice *ms) { - launchd_assumes(launchd_mport_close_recv(ms->port) == KERN_SUCCESS); - launchd_assumes(launchd_mport_deallocate(ms->port) == KERN_SUCCESS); - launchd_assumes(launchd_mport_create_recv(&ms->port) == KERN_SUCCESS); - launchd_assumes(launchd_mport_make_send(ms->port) == KERN_SUCCESS); + LIST_REMOVE(ms, port_hash_sle); + job_assumes(j, launchd_mport_close_recv(ms->port) == KERN_SUCCESS); + job_assumes(j, launchd_mport_deallocate(ms->port) == KERN_SUCCESS); + ms->gen_num++; + job_assumes(j, launchd_mport_create_recv(&ms->port) == KERN_SUCCESS); + job_assumes(j, launchd_mport_make_send(ms->port) == KERN_SUCCESS); + LIST_INSERT_HEAD(&port_hash[HASH_PORT(ms->port)], ms, port_hash_sle); } struct machservice * -machservice_new(struct jobcb *j, const char *name, mach_port_t *serviceport) +machservice_new(job_t j, const char *name, mach_port_t *serviceport, bool pid_local) { struct machservice *ms; - if ((ms = calloc(1, sizeof(struct machservice) + strlen(name) + 1)) == NULL) + if ((ms = calloc(1, sizeof(struct machservice) + strlen(name) + 1)) == NULL) { return NULL; + } - strcpy(ms->name, name); + strcpy((char *)ms->name, name); ms->job = j; + ms->per_pid = pid_local; if (*serviceport == MACH_PORT_NULL) { - if (!launchd_assumes(launchd_mport_create_recv(&ms->port) == KERN_SUCCESS)) + if (!job_assumes(j, launchd_mport_create_recv(&ms->port) == KERN_SUCCESS)) { goto out_bad; + } - if (!launchd_assumes(launchd_mport_make_send(ms->port) == KERN_SUCCESS)) + if (!job_assumes(j, launchd_mport_make_send(ms->port) == KERN_SUCCESS)) { goto out_bad2; + } *serviceport = ms->port; - ms->isActive = false; ms->recv = true; } else { ms->port = *serviceport; @@ -2386,12 +4160,14 @@ machservice_new(struct jobcb *j, const char *name, mach_port_t *serviceport) } SLIST_INSERT_HEAD(&j->machservices, ms, sle); + LIST_INSERT_HEAD(&j->mgr->ms_hash[hash_ms(ms->name)], ms, name_hash_sle); + LIST_INSERT_HEAD(&port_hash[HASH_PORT(ms->port)], ms, port_hash_sle); job_log(j, LOG_INFO, "Mach service added: %s", name); return ms; out_bad2: - launchd_assumes(launchd_mport_close_recv(ms->port) == KERN_SUCCESS); + job_assumes(j, launchd_mport_close_recv(ms->port) == KERN_SUCCESS); out_bad: free(ms); return NULL; @@ -2410,22 +4186,67 @@ machservice_status(struct machservice *ms) } void -machservice_setup_options(launch_data_t obj, const char *key, void *context) +job_setup_exception_port(job_t j, task_t target_task) { - struct machservice *ms = context; - mach_port_t mhp = mach_host_self(); - mach_port_t mts = mach_task_self(); + struct machservice *ms; thread_state_flavor_t f = 0; - int which_port; - bool b; + mach_port_t exc_port = the_exception_server; -#if defined (__ppc__) - f = PPC_THREAD_STATE64; -#elif defined(__i386__) - f = x86_THREAD_STATE; + if (j->alt_exc_handler) { + ms = jobmgr_lookup_service(j->mgr, j->alt_exc_handler, true, 0); + if (ms) { + exc_port = machservice_port(ms); + } else { + job_log(j, LOG_WARNING, "Falling back to default Mach exception handler. Could not find: %s", j->alt_exc_handler); + } + } else if (j->internal_exc_handler) { + exc_port = runtime_get_kernel_port(); + } else if (!exc_port) { + return; + } + +#if defined (__ppc__) || defined (__ppc64__) + f = PPC_THREAD_STATE64; +#elif defined(__i386__) || defined(__x86_64__) + f = x86_THREAD_STATE; +#elif defined(__arm__) + f = ARM_THREAD_STATE; +#else +#error "unknown architecture" #endif - if (!launchd_assumes(mhp != MACH_PORT_NULL)) { + if (target_task) { + job_assumes(j, task_set_exception_ports(target_task, EXC_MASK_CRASH, exc_port, + EXCEPTION_STATE_IDENTITY | MACH_EXCEPTION_CODES, f) == KERN_SUCCESS); + } else if (getpid() == 1 && the_exception_server) { + mach_port_t mhp = mach_host_self(); + job_assumes(j, host_set_exception_ports(mhp, EXC_MASK_CRASH, the_exception_server, + EXCEPTION_STATE_IDENTITY | MACH_EXCEPTION_CODES, f) == KERN_SUCCESS); + job_assumes(j, launchd_mport_deallocate(mhp) == KERN_SUCCESS); + } + +} + +void +job_set_exeception_port(job_t j, mach_port_t port) +{ + if (!the_exception_server) { + the_exception_server = port; + job_setup_exception_port(j, 0); + } else { + job_log(j, LOG_WARNING, "The exception server is already claimed!"); + } +} + +void +machservice_setup_options(launch_data_t obj, const char *key, void *context) +{ + struct machservice *ms = context; + mach_port_t mhp = mach_host_self(); + int which_port; + bool b; + + if (!job_assumes(ms->job, mhp != MACH_PORT_NULL)) { return; } @@ -2433,44 +4254,65 @@ machservice_setup_options(launch_data_t obj, const char *key, void *context) case LAUNCH_DATA_INTEGER: which_port = launch_data_get_integer(obj); if (strcasecmp(key, LAUNCH_JOBKEY_MACH_TASKSPECIALPORT) == 0) { - launchd_assumes((errno = task_set_special_port(mts, which_port, ms->port)) == KERN_SUCCESS); + switch (which_port) { + case TASK_KERNEL_PORT: + case TASK_HOST_PORT: + case TASK_NAME_PORT: + case TASK_BOOTSTRAP_PORT: + /* I find it a little odd that zero isn't reserved in the header */ + case 0: + job_log(ms->job, LOG_WARNING, "Tried to set a reserved task special port: %d", which_port); + break; + default: + ms->special_port_num = which_port; + SLIST_INSERT_HEAD(&special_ports, ms, special_port_sle); + break; + } } else if (strcasecmp(key, LAUNCH_JOBKEY_MACH_HOSTSPECIALPORT) == 0 && getpid() == 1) { - launchd_assumes((errno = host_set_special_port(mhp, which_port, ms->port)) == KERN_SUCCESS); + if (which_port > HOST_MAX_SPECIAL_KERNEL_PORT) { + job_assumes(ms->job, (errno = host_set_special_port(mhp, which_port, ms->port)) == KERN_SUCCESS); + } else { + job_log(ms->job, LOG_WARNING, "Tried to set a reserved host special port: %d", which_port); + } } case LAUNCH_DATA_BOOL: b = launch_data_get_bool(obj); - if (strcasecmp(key, LAUNCH_JOBKEY_MACH_RESETATCLOSE) == 0) { + if (strcasecmp(key, LAUNCH_JOBKEY_MACH_ENTERKERNELDEBUGGERONCLOSE) == 0) { + ms->debug_on_close = b; + } else if (strcasecmp(key, LAUNCH_JOBKEY_MACH_RESETATCLOSE) == 0) { ms->reset = b; } else if (strcasecmp(key, LAUNCH_JOBKEY_MACH_HIDEUNTILCHECKIN) == 0) { ms->hide = b; } else if (strcasecmp(key, LAUNCH_JOBKEY_MACH_EXCEPTIONSERVER) == 0) { - launchd_assumes(task_set_exception_ports(mts, EXC_MASK_ALL, ms->port, - EXCEPTION_STATE_IDENTITY, f) == KERN_SUCCESS); + job_set_exeception_port(ms->job, ms->port); } else if (strcasecmp(key, LAUNCH_JOBKEY_MACH_KUNCSERVER) == 0) { ms->kUNCServer = b; - launchd_assumes(host_set_UNDServer(mhp, ms->port) == KERN_SUCCESS); + job_assumes(ms->job, host_set_UNDServer(mhp, ms->port) == KERN_SUCCESS); } break; + case LAUNCH_DATA_DICTIONARY: + job_set_exeception_port(ms->job, ms->port); + break; default: break; } - launchd_assumes(launchd_mport_deallocate(mhp) == KERN_SUCCESS); + job_assumes(ms->job, launchd_mport_deallocate(mhp) == KERN_SUCCESS); } void machservice_setup(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + job_t j = context; struct machservice *ms; mach_port_t p = MACH_PORT_NULL; - if ((ms = job_lookup_service(j->parent, key, false))) { + if ((ms = jobmgr_lookup_service(j->mgr, key, false, 0))) { job_log(j, LOG_WARNING, "Conflict with job: %s over Mach service: %s", ms->job->label, key); return; } - if ((ms = machservice_new(j, key, &p)) == NULL) { + if ((ms = machservice_new(j, key, &p, false)) == NULL) { job_log_error(j, LOG_WARNING, "Cannot add service: %s", key); return; } @@ -2482,96 +4324,299 @@ machservice_setup(launch_data_t obj, const char *key, void *context) } } -struct jobcb * -job_parent(struct jobcb *j) +jobmgr_t +jobmgr_do_garbage_collection(jobmgr_t jm) { - return j->parent; -} + jobmgr_t jmi, jmn; + job_t ji, jn; -void -job_uncork_fork(struct jobcb *j) -{ - pid_t c = j->p; + SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) { + jobmgr_do_garbage_collection(jmi); + } - if (j->stall_before_exec) { - job_log(j, LOG_DEBUG, "Uncorking the fork()."); - /* this unblocks the child and avoids a race - * between the above fork() and the kevent_mod() */ - write(j->execfd, &c, sizeof(c)); - j->stall_before_exec = false; - } else { - job_log(j, LOG_WARNING, "Attempt to uncork a job that isn't in the middle of a fork()."); + if (!jm->shutting_down) { + return jm; + } + + jobmgr_log(jm, LOG_DEBUG, "Garbage collecting."); + + /* + * Normally, we wait for all resources of a job (Unix PIDs/FDs and Mach ports) + * to reset before we conider the job truly dead and ready to be spawned again. + * + * In order to work around 5487724 and 3456090, we're going to call reboot() + * when the last PID dies and not wait for the associated resources to reset. + */ + if (getpid() == 1 && jm->parentmgr == NULL && total_children == 0) { + jobmgr_log(jm, LOG_DEBUG, "About to force a call to: reboot(%s)", reboot_flags_to_C_names(jm->reboot_flags)); + runtime_closelog(); + jobmgr_assumes(jm, reboot(jm->reboot_flags) != -1); + } + + if (jm->hopefully_first_cnt) { + return jm; + } + + if (jm->parentmgr && jm->parentmgr->shutting_down && jm->parentmgr->hopefully_first_cnt) { + return jm; + } + + if (!jm->sent_stop_to_normal_jobs) { + jobmgr_log(jm, LOG_DEBUG, "Asking \"normal\" jobs to exit."); + + LIST_FOREACH_SAFE(ji, &jm->jobs, sle, jn) { + if (!job_active(ji)) { + job_remove(ji); + } else if (!ji->hopefully_exits_last) { + job_stop(ji); + } + } + + jm->sent_stop_to_normal_jobs = true; + } + + if (jm->normal_active_cnt) { + return jm; + } + + if (!jm->sent_stop_to_hopefully_last_jobs) { + jobmgr_log(jm, LOG_DEBUG, "Asking \"hopefully last\" jobs to exit."); + + LIST_FOREACH(ji, &jm->jobs, sle) { + if (ji->p && ji->anonymous) { + continue; + } else if (ji->p && job_assumes(ji, ji->hopefully_exits_last)) { + job_stop(ji); + } + } + + jm->sent_stop_to_hopefully_last_jobs = true; + } + + if (!SLIST_EMPTY(&jm->submgrs)) { + return jm; + } + + LIST_FOREACH(ji, &jm->jobs, sle) { + if (!ji->anonymous) { + return jm; + } } + + jobmgr_log_stray_children(jm); + jobmgr_remove(jm); + return NULL; } void -job_foreach_service(struct jobcb *j, void (*bs_iter)(struct machservice *, void *), void *context, bool include_subjobs) +jobmgr_log_stray_children(jobmgr_t jm) { - struct machservice *ms; - struct jobcb *ji; + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL }; + size_t i, kp_cnt, len = sizeof(struct kinfo_proc) * get_kern_max_proc(); + struct kinfo_proc *kp; + +#if TARGET_OS_EMBEDDED + if (!do_apple_internal_magic) { + return; + } +#endif + if (jm->parentmgr || getpid() != 1) { + return; + } + + if (!jobmgr_assumes(jm, (kp = malloc(len)) != NULL)) { + return; + } + if (!jobmgr_assumes(jm, sysctl(mib, 3, kp, &len, NULL, 0) != -1)) { + goto out; + } - j = job_get_bs(j); + kp_cnt = len / sizeof(struct kinfo_proc); - if (include_subjobs) { - SLIST_FOREACH(ji, &j->jobs, sle) { - if (ji->req_port) - continue; + for (i = 0; i < kp_cnt; i++) { + pid_t p_i = kp[i].kp_proc.p_pid; + pid_t pp_i = kp[i].kp_eproc.e_ppid; + pid_t pg_i = kp[i].kp_eproc.e_pgid; + const char *z = (kp[i].kp_proc.p_stat == SZOMB) ? "zombie " : ""; + const char *n = kp[i].kp_proc.p_comm; - SLIST_FOREACH(ms, &ji->machservices, sle) - bs_iter(ms, context); + if (p_i == 0 || p_i == 1) { + continue; } + + jobmgr_log(jm, LOG_WARNING, "Stray %sprocess at shutdown: PID %u PPID %u PGID %u %s", z, p_i, pp_i, pg_i, n); + + /* + * The kernel team requested that launchd not do this for Leopard. + * jobmgr_assumes(jm, runtime_kill(p_i, SIGKILL) != -1); + */ } - SLIST_FOREACH(ms, &j->machservices, sle) - bs_iter(ms, context); +out: + free(kp); } -struct jobcb * -job_new_bootstrap(struct jobcb *p, mach_port_t requestorport, mach_port_t checkin_port) +jobmgr_t +jobmgr_parent(jobmgr_t jm) { - char bslabel[1024] = "100000"; - struct jobcb *j; + return jm->parentmgr; +} - if (requestorport == MACH_PORT_NULL) { - if (p) { - job_log(p, LOG_ERR, "Mach sub-bootstrap create request requires a requester port"); - } +void +job_uncork_fork(job_t j) +{ + pid_t c = j->p; + + job_log(j, LOG_DEBUG, "Uncorking the fork()."); + /* this unblocks the child and avoids a race + * between the above fork() and the kevent_mod() */ + job_assumes(j, write(j->forkfd, &c, sizeof(c)) == sizeof(c)); + job_assumes(j, runtime_close(j->forkfd) != -1); + j->forkfd = 0; +} + +jobmgr_t +jobmgr_new(jobmgr_t jm, mach_port_t requestorport, mach_port_t transfer_port, bool sflag, const char *name) +{ + mach_msg_size_t mxmsgsz; + job_t bootstrapper = NULL; + jobmgr_t jmr; + + launchd_assert(offsetof(struct jobmgr_s, kqjobmgr_callback) == 0); + + if (jm && requestorport == MACH_PORT_NULL) { + jobmgr_log(jm, LOG_ERR, "Mach sub-bootstrap create request requires a requester port"); return NULL; } - j = job_new(p, bslabel, NULL, NULL, NULL, requestorport); + jmr = calloc(1, sizeof(struct jobmgr_s) + (name ? (strlen(name) + 1) : 128)); - if (j == NULL) + if (jmr == NULL) { return NULL; + } + + jmr->kqjobmgr_callback = jobmgr_callback; + strcpy(jmr->name_init, name ? name : "Under construction"); + + jmr->req_port = requestorport; - if (checkin_port != MACH_PORT_NULL) { - j->bs_port = checkin_port; - } else if (!launchd_assumes(launchd_mport_create_recv(&j->bs_port) == KERN_SUCCESS)) { + if ((jmr->parentmgr = jm)) { + SLIST_INSERT_HEAD(&jm->submgrs, jmr, sle); + } + + if (jm && !jobmgr_assumes(jmr, launchd_mport_notify_req(jmr->req_port, MACH_NOTIFY_DEAD_NAME) == KERN_SUCCESS)) { goto out_bad; } - sprintf(j->label, "%d", MACH_PORT_INDEX(j->bs_port)); + if (transfer_port != MACH_PORT_NULL) { + jobmgr_assumes(jmr, jm != NULL); + jmr->jm_port = transfer_port; + } else if (!jm && getpid() != 1) { + char *trusted_fd = getenv(LAUNCHD_TRUSTED_FD_ENV); + name_t service_buf; + + snprintf(service_buf, sizeof(service_buf), "com.apple.launchd.peruser.%u", getuid()); + + if (!jobmgr_assumes(jmr, bootstrap_check_in(bootstrap_port, service_buf, &jmr->jm_port) == 0)) { + goto out_bad; + } + + if (trusted_fd) { + int dfd, lfd = strtol(trusted_fd, NULL, 10); + + if ((dfd = dup(lfd)) >= 0) { + jobmgr_assumes(jmr, runtime_close(dfd) != -1); + jobmgr_assumes(jmr, runtime_close(lfd) != -1); + } + + unsetenv(LAUNCHD_TRUSTED_FD_ENV); + } + + /* cut off the Libc cache, we don't want to deadlock against ourself */ + inherited_bootstrap_port = bootstrap_port; + bootstrap_port = MACH_PORT_NULL; + launchd_assert(launchd_mport_notify_req(inherited_bootstrap_port, MACH_NOTIFY_DEAD_NAME) == KERN_SUCCESS); - if (!launchd_assumes(launchd_mport_request_callback(j->bs_port, j, true) == KERN_SUCCESS)) + /* We set this explicitly as we start each child */ + launchd_assert(launchd_set_bport(MACH_PORT_NULL) == KERN_SUCCESS); + } else if (!jobmgr_assumes(jmr, launchd_mport_create_recv(&jmr->jm_port) == KERN_SUCCESS)) { goto out_bad; + } - if (p) { - job_log(p, LOG_DEBUG, "Mach sub-bootstrap created: %s", j->label); + if (!name) { + sprintf(jmr->name_init, "%u", MACH_PORT_INDEX(jmr->jm_port)); } - return j; + /* Sigh... at the moment, MIG has maxsize == sizeof(reply union) */ + mxmsgsz = sizeof(union __RequestUnion__job_mig_protocol_vproc_subsystem); + if (job_mig_protocol_vproc_subsystem.maxsize > mxmsgsz) { + mxmsgsz = job_mig_protocol_vproc_subsystem.maxsize; + } + + if (!jm) { + jobmgr_assumes(jmr, kevent_mod(SIGTERM, EVFILT_SIGNAL, EV_ADD, 0, 0, jmr) != -1); + jobmgr_assumes(jmr, kevent_mod(SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, jmr) != -1); + jobmgr_assumes(jmr, kevent_mod(0, EVFILT_FS, EV_ADD, VQ_MOUNT|VQ_UNMOUNT|VQ_UPDATE, 0, jmr) != -1); + } + + if (name) { + bootstrapper = jobmgr_init_session(jmr, name, sflag); + } + + if (!bootstrapper || !bootstrapper->weird_bootstrap) { + if (!jobmgr_assumes(jmr, runtime_add_mport(jmr->jm_port, protocol_vproc_server, mxmsgsz) == KERN_SUCCESS)) { + goto out_bad; + } + } + + jobmgr_log(jmr, LOG_DEBUG, "Created job manager%s%s", jm ? " with parent: " : ".", jm ? jm->name : ""); + + if (bootstrapper) { + jobmgr_assumes(jmr, job_dispatch(bootstrapper, true) != NULL); + } + + if (jmr->parentmgr) { + runtime_add_ref(); + } + + return jmr; out_bad: - if (j) - job_remove(j); + if (jmr) { + jobmgr_remove(jmr); + } return NULL; } -void -job_delete_anything_with_port(struct jobcb *j, mach_port_t port) +job_t +jobmgr_init_session(jobmgr_t jm, const char *session_type, bool sflag) +{ + const char *bootstrap_tool[] = { "/bin/launchctl", "bootstrap", "-S", session_type, sflag ? "-s" : NULL, NULL }; + char thelabel[1000]; + job_t bootstrapper; + + snprintf(thelabel, sizeof(thelabel), "com.apple.launchctl.%s", session_type); + bootstrapper = job_new(jm, thelabel, NULL, bootstrap_tool); + if (jobmgr_assumes(jm, bootstrapper != NULL) && (jm->parentmgr || getuid())) { + char buf[100]; + + /* launchd-201: can't ssh in with AFP OD account (hangs) */ + snprintf(buf, sizeof(buf), "0x%X:0:0", getuid()); + envitem_new(bootstrapper, "__CF_USER_TEXT_ENCODING", buf, false); + bootstrapper->weird_bootstrap = true; + jobmgr_assumes(jm, job_setup_machport(bootstrapper)); + } + + jm->session_initialized = true; + + return bootstrapper; +} + +jobmgr_t +jobmgr_delete_anything_with_port(jobmgr_t jm, mach_port_t port) { struct machservice *ms, *next_ms; - struct jobcb *ji, *jn; + jobmgr_t jmi, jmn; /* Mach ports, unlike Unix descriptors, are reference counted. In other * words, when some program hands us a second or subsequent send right @@ -2583,48 +4628,59 @@ job_delete_anything_with_port(struct jobcb *j, mach_port_t port) * to use. */ - if (j->req_port == port) - return job_remove(j); + if (jm == root_jobmgr) { + if (port == inherited_bootstrap_port) { + launchd_assumes(launchd_mport_deallocate(port) == KERN_SUCCESS); + inherited_bootstrap_port = MACH_PORT_NULL; + + return jobmgr_shutdown(jm); + } + + LIST_FOREACH_SAFE(ms, &port_hash[HASH_PORT(port)], port_hash_sle, next_ms) { + if (ms->port == port) { + machservice_delete(ms->job, ms, true); + } + } + } - SLIST_FOREACH_SAFE(ji, &j->jobs, sle, jn) - job_delete_anything_with_port(ji, port); + SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) { + jobmgr_delete_anything_with_port(jmi, port); + } - SLIST_FOREACH_SAFE(ms, &j->machservices, sle, next_ms) { - if (ms->port == port) - machservice_delete(ms); + if (jm->req_port == port) { + jobmgr_log(jm, LOG_DEBUG, "Request port died: 0x%x", port); + return jobmgr_shutdown(jm); } + + return jm; } struct machservice * -job_lookup_service(struct jobcb *j, const char *name, bool check_parent) +jobmgr_lookup_service(jobmgr_t jm, const char *name, bool check_parent, pid_t target_pid) { struct machservice *ms; - struct jobcb *ji; - j = job_get_bs(j); - - SLIST_FOREACH(ji, &j->jobs, sle) { - if (ji->req_port) - continue; + if (target_pid) { + jobmgr_assumes(jm, !check_parent); + } - SLIST_FOREACH(ms, &ji->machservices, sle) { - if (strcmp(name, ms->name) == 0) + LIST_FOREACH(ms, &jm->ms_hash[hash_ms(name)], name_hash_sle) { + if ((target_pid && ms->per_pid && ms->job->p == target_pid) || (!target_pid && !ms->per_pid)) { + if (strcmp(name, ms->name) == 0) { return ms; + } } } - SLIST_FOREACH(ms, &j->machservices, sle) { - if (strcmp(name, ms->name) == 0) - return ms; - } - - if (j->parent == NULL) + if (jm->parentmgr == NULL) { return NULL; + } - if (!check_parent) + if (!check_parent) { return NULL; + } - return job_lookup_service(j->parent, name, true); + return jobmgr_lookup_service(jm->parentmgr, name, true, 0); } mach_port_t @@ -2633,7 +4689,7 @@ machservice_port(struct machservice *ms) return ms->port; } -struct jobcb * +job_t machservice_job(struct machservice *ms) { return ms->job; @@ -2658,42 +4714,53 @@ machservice_name(struct machservice *ms) } void -machservice_delete(struct machservice *ms) +machservice_delete(job_t j, struct machservice *ms, bool port_died) { - if (ms->recv) { - if (ms->isActive) { - /* FIXME we should cancel the notification */ - } else { - launchd_assumes(launchd_mport_close_recv(ms->port) == KERN_SUCCESS); - } + if (ms->debug_on_close) { + job_log(j, LOG_NOTICE, "About to enter kernel debugger because of Mach port: 0x%x", ms->port); + job_assumes(j, host_reboot(mach_host_self(), HOST_REBOOT_DEBUGGER) == KERN_SUCCESS); + } + + if (ms->recv && job_assumes(j, !ms->isActive)) { + job_assumes(j, launchd_mport_close_recv(ms->port) == KERN_SUCCESS); + } + + job_assumes(j, launchd_mport_deallocate(ms->port) == KERN_SUCCESS); + + if (ms->port == the_exception_server) { + the_exception_server = 0; } - launchd_assumes(launchd_mport_deallocate(ms->port) == KERN_SUCCESS); + job_log(j, LOG_INFO, "Mach service deleted%s: %s", port_died ? " (port died)" : "", ms->name); - job_log(ms->job, LOG_INFO, "Mach service deleted: %s", ms->name); + if (ms->special_port_num) { + SLIST_REMOVE(&special_ports, ms, machservice, special_port_sle); + } - SLIST_REMOVE(&ms->job->machservices, ms, machservice, sle); + SLIST_REMOVE(&j->machservices, ms, machservice, sle); + LIST_REMOVE(ms, name_hash_sle); + LIST_REMOVE(ms, port_hash_sle); free(ms); } void -machservice_watch(struct machservice *ms) +machservice_request_notifications(struct machservice *ms) { mach_msg_id_t which = MACH_NOTIFY_DEAD_NAME; ms->isActive = true; - if (ms->job->req_port == MACH_PORT_NULL) { + if (ms->recv) { which = MACH_NOTIFY_PORT_DESTROYED; job_checkin(ms->job); } - launchd_assumes(launchd_mport_notify_req(ms->port, which) == KERN_SUCCESS); + job_assumes(ms->job, launchd_mport_notify_req(ms->port, which) == KERN_SUCCESS); } -#define NELEM(x) (sizeof(x)/sizeof(x[0])) -#define END_OF(x) (&(x)[NELEM(x)]) +#define NELEM(x) (sizeof(x)/sizeof(x[0])) +#define END_OF(x) (&(x)[NELEM(x)]) char ** mach_cmd2argv(const char *string) @@ -2707,26 +4774,31 @@ mach_cmd2argv(const char *string) while (isspace(*cp)) cp++; term = (*cp == '"') ? *cp++ : '\0'; - if (nargs < NELEM(argv)) + if (nargs < NELEM(argv)) { argv[nargs++] = argp; + } while (*cp && (term ? *cp != term : !isspace(*cp)) && argp < END_OF(args)) { - if (*cp == '\\') + if (*cp == '\\') { cp++; + } *argp++ = *cp; - if (*cp) + if (*cp) { cp++; + } } *argp++ = '\0'; } argv[nargs] = NULL; - if (nargs == 0) + if (nargs == 0) { return NULL; + } argv_ret = malloc((nargs + 1) * sizeof(char *) + strlen(string) + 1); - if (!launchd_assumes(argv_ret != NULL)) + if (!launchd_assumes(argv_ret != NULL)) { return NULL; + } co = (char *)argv_ret + (nargs + 1) * sizeof(char *); @@ -2741,158 +4813,298 @@ mach_cmd2argv(const char *string) } void -job_checkin(struct jobcb *j) +job_checkin(job_t j) { j->checkedin = true; } bool -job_ack_port_destruction(struct jobcb *j, mach_port_t p) +job_ack_port_destruction(mach_port_t p) { - struct jobcb *ji; struct machservice *ms; - SLIST_FOREACH(ji, &j->jobs, sle) { - if (job_ack_port_destruction(ji, p)) - return true; - } - - SLIST_FOREACH(ms, &j->machservices, sle) { - if (ms->port == p) + LIST_FOREACH(ms, &port_hash[HASH_PORT(p)], port_hash_sle) { + if (ms->recv && (ms->port == p)) { break; + } } - if (ms == NULL) + if (!ms) { return false; + } ms->isActive = false; - if (ms->reset) - machservice_resetport(j, ms); + if (ms->reset) { + machservice_resetport(ms->job, ms); + } - job_log(j, LOG_DEBUG, "Receive right returned to us: %s", ms->name); + job_log(ms->job, LOG_DEBUG, "Receive right returned to us: %s", ms->name); + job_dispatch(ms->job, false); - job_dispatch(j); + root_jobmgr = jobmgr_do_garbage_collection(root_jobmgr); return true; } void -job_ack_no_senders(struct jobcb *j) +job_ack_no_senders(job_t j) { j->priv_port_has_senders = false; + job_assumes(j, launchd_mport_close_recv(j->j_port) == KERN_SUCCESS); + j->j_port = 0; + job_log(j, LOG_DEBUG, "No more senders on privileged Mach bootstrap port"); - job_dispatch(j); + job_dispatch(j, false); } -mach_port_t -job_get_reqport(struct jobcb *j) +jobmgr_t +job_get_bs(job_t j) { - j->transfer_bstrap = true; - gc_this_job = j; + if (job_assumes(j, j->mgr != NULL)) { + return j->mgr; + } - return j->req_port; + return NULL; } -mach_port_t -job_get_bsport(struct jobcb *j) +bool +job_is_anonymous(job_t j) { - return j->bs_port; + return j->anonymous; } -struct jobcb * -job_get_bs(struct jobcb *j) +void +job_force_sampletool(job_t j) { - if (j->req_port) - return j; + struct stat sb; + char logfile[PATH_MAX]; + char pidstr[100]; + char *sample_args[] = { "sample", pidstr, "1", "-mayDie", "-file", logfile, NULL }; + char *contents = NULL; + int logfile_fd = -1; + int console_fd = -1; + int wstatus; + pid_t sp; + + if (!debug_shutdown_hangs) { + return; + } + + snprintf(pidstr, sizeof(pidstr), "%u", j->p); + snprintf(logfile, sizeof(logfile), SHUTDOWN_LOG_DIR "/%s-%u.sample.txt", j->label, j->p); - if (launchd_assumes(j->parent != NULL)) - return j->parent; + if (!job_assumes(j, unlink(logfile) != -1 || errno == ENOENT)) { + goto out; + } - return NULL; -} + /* + * This will stall launchd for as long as the 'sample' tool runs. + * + * We didn't give the 'sample' tool a bootstrap port, so it therefore + * can't deadlock against launchd. + */ + if (!job_assumes(j, (errno = posix_spawnp(&sp, sample_args[0], NULL, NULL, sample_args, environ)) == 0)) { + goto out; + } -pid_t -job_get_pid(struct jobcb *j) -{ - return j->p; + job_log(j, LOG_DEBUG, "Waiting for 'sample' to finish."); + + if (!job_assumes(j, waitpid(sp, &wstatus, 0) != -1)) { + goto out; + } + + /* + * This won't work if the VFS or filesystems are sick: + * sync(); + */ + + if (!job_assumes(j, WIFEXITED(wstatus) && WEXITSTATUS(wstatus) == 0)) { + goto out; + } + + if (!job_assumes(j, (logfile_fd = open(logfile, O_RDONLY|O_NOCTTY)) != -1)) { + goto out; + } + + if (!job_assumes(j, (console_fd = open(_PATH_CONSOLE, O_WRONLY|O_APPEND|O_NOCTTY)) != -1)) { + goto out; + } + + if (!job_assumes(j, fstat(logfile_fd, &sb) != -1)) { + goto out; + } + + contents = malloc(sb.st_size); + + if (!job_assumes(j, contents != NULL)) { + goto out; + } + + if (!job_assumes(j, read(logfile_fd, contents, sb.st_size) == sb.st_size)) { + goto out; + } + + job_assumes(j, write(console_fd, contents, sb.st_size) == sb.st_size); + +out: + if (contents) { + free(contents); + } + + if (logfile_fd != -1) { + job_assumes(j, runtime_fsync(logfile_fd) != -1); + job_assumes(j, runtime_close(logfile_fd) != -1); + } + + if (console_fd != -1) { + job_assumes(j, runtime_close(console_fd) != -1); + } + + job_log(j, LOG_DEBUG, "Finished sampling."); } bool -semaphoreitem_new(struct jobcb *j, semaphore_reason_t why, const char *what) +semaphoreitem_new(job_t j, semaphore_reason_t why, const char *what) { struct semaphoreitem *si; size_t alloc_sz = sizeof(struct semaphoreitem); - if (what) + if (what) { alloc_sz += strlen(what) + 1; + } - if (!launchd_assumes(si = calloc(1, alloc_sz))) + if (!job_assumes(j, si = calloc(1, alloc_sz))) { return false; + } + si->fd = -1; si->why = why; - if (what) - strcpy(si->what, what); + if (what) { + strcpy(si->what_init, what); + } SLIST_INSERT_HEAD(&j->semaphores, si, sle); + semaphoreitem_runtime_mod_ref(si, true); + return true; } void -semaphoreitem_delete(struct jobcb *j, struct semaphoreitem *ri) +semaphoreitem_runtime_mod_ref(struct semaphoreitem *si, bool add) +{ + /* + * External events need to be tracked. + * Internal events do NOT need to be tracked. + */ + + switch (si->why) { + case SUCCESSFUL_EXIT: + case FAILED_EXIT: + case OTHER_JOB_ENABLED: + case OTHER_JOB_DISABLED: + case OTHER_JOB_ACTIVE: + case OTHER_JOB_INACTIVE: + return; + default: + break; + } + + if (add) { + runtime_add_ref(); + } else { + runtime_del_ref(); + } +} + +void +semaphoreitem_delete(job_t j, struct semaphoreitem *si) { - SLIST_REMOVE(&j->semaphores, ri, semaphoreitem, sle); + semaphoreitem_runtime_mod_ref(si, false); + + SLIST_REMOVE(&j->semaphores, si, semaphoreitem, sle); + + if (si->fd != -1) { + job_assumes(j, runtime_close(si->fd) != -1); + } - free(ri); + free(si); } void -semaphoreitem_setup_paths(launch_data_t obj, const char *key, void *context) +semaphoreitem_setup_dict_iter(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + struct semaphoreitem_dict_iter_context *sdic = context; semaphore_reason_t why; - why = launch_data_get_bool(obj) ? PATH_EXISTS : PATH_MISSING; + why = launch_data_get_bool(obj) ? sdic->why_true : sdic->why_false; - semaphoreitem_new(j, why, key); + semaphoreitem_new(sdic->j, why, key); } void semaphoreitem_setup(launch_data_t obj, const char *key, void *context) { - struct jobcb *j = context; + struct semaphoreitem_dict_iter_context sdic = { context, 0, 0 }; + job_t j = context; semaphore_reason_t why; - if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_NETWORKSTATE) == 0) { - why = launch_data_get_bool(obj) ? NETWORK_UP : NETWORK_DOWN; - semaphoreitem_new(j, why, NULL); - } else if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_SUCCESSFULEXIT) == 0) { - why = launch_data_get_bool(obj) ? SUCCESSFUL_EXIT : FAILED_EXIT; - semaphoreitem_new(j, why, NULL); - j->runatload = true; - } else if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_PATHSTATE) == 0 && - launch_data_get_type(obj) == LAUNCH_DATA_DICTIONARY) { - launch_data_dict_iterate(obj, semaphoreitem_setup_paths, j); + switch (launch_data_get_type(obj)) { + case LAUNCH_DATA_BOOL: + if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_NETWORKSTATE) == 0) { + why = launch_data_get_bool(obj) ? NETWORK_UP : NETWORK_DOWN; + semaphoreitem_new(j, why, NULL); + } else if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_SUCCESSFULEXIT) == 0) { + why = launch_data_get_bool(obj) ? SUCCESSFUL_EXIT : FAILED_EXIT; + semaphoreitem_new(j, why, NULL); + j->start_pending = true; + } else { + job_assumes(j, false); + } + break; + case LAUNCH_DATA_DICTIONARY: + if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_PATHSTATE) == 0) { + sdic.why_true = PATH_EXISTS; + sdic.why_false = PATH_MISSING; + } else if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_OTHERJOBACTIVE) == 0) { + sdic.why_true = OTHER_JOB_ACTIVE; + sdic.why_false = OTHER_JOB_INACTIVE; + } else if (strcasecmp(key, LAUNCH_JOBKEY_KEEPALIVE_OTHERJOBENABLED) == 0) { + sdic.why_true = OTHER_JOB_ENABLED; + sdic.why_false = OTHER_JOB_DISABLED; + } else { + job_assumes(j, false); + break; + } + + launch_data_dict_iterate(obj, semaphoreitem_setup_dict_iter, &sdic); + break; + default: + job_assumes(j, false); + break; } } void -job_dispatch_all_other_semaphores(struct jobcb *j, struct jobcb *nj) +jobmgr_dispatch_all_semaphores(jobmgr_t jm) { - struct jobcb *ji; + jobmgr_t jmi, jmn; + job_t ji, jn; - if (j == nj) - return; - if (!SLIST_EMPTY(&j->semaphores)) - job_dispatch(j); + SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) { + jobmgr_dispatch_all_semaphores(jmi); + } - SLIST_FOREACH(ji, &j->jobs, sle) - job_dispatch_all_other_semaphores(ji, nj); + LIST_FOREACH_SAFE(ji, &jm->jobs, sle, jn) { + if (!SLIST_EMPTY(&ji->semaphores)) { + job_dispatch(ji, false); + } + } } time_t @@ -2933,8 +5145,9 @@ cronemu_wday(int wday, int hour, int min) workingtm.tm_sec = 0; workingtm.tm_min++; - if (wday == 7) + if (wday == 7) { wday = 0; + } while (!(workingtm.tm_wday == wday && cronemu_hour(&workingtm, hour, min))) { workingtm.tm_mday++; @@ -2960,17 +5173,19 @@ cronemu_mon(struct tm *wtm, int mon, int mday, int hour, int min) workingtm.tm_min = 0; carrytest = workingtm.tm_mon; mktime(&workingtm); - if (carrytest != workingtm.tm_mon) + if (carrytest != workingtm.tm_mon) { return false; + } } *wtm = workingtm; return true; } - if (mon < wtm->tm_mon) + if (mon < wtm->tm_mon) { return false; + } - if (mon > wtm->tm_mon) { + if (mon > wtm->tm_mon) { wtm->tm_mon = mon; wtm->tm_mday = 1; wtm->tm_hour = 0; @@ -2993,17 +5208,19 @@ cronemu_mday(struct tm *wtm, int mday, int hour, int min) workingtm.tm_min = 0; carrytest = workingtm.tm_mday; mktime(&workingtm); - if (carrytest != workingtm.tm_mday) + if (carrytest != workingtm.tm_mday) { return false; + } } *wtm = workingtm; return true; } - if (mday < wtm->tm_mday) + if (mday < wtm->tm_mday) { return false; + } - if (mday > wtm->tm_mday) { + if (mday > wtm->tm_mday) { wtm->tm_mday = mday; wtm->tm_hour = 0; wtm->tm_min = 0; @@ -3024,15 +5241,17 @@ cronemu_hour(struct tm *wtm, int hour, int min) workingtm.tm_min = 0; carrytest = workingtm.tm_hour; mktime(&workingtm); - if (carrytest != workingtm.tm_hour) + if (carrytest != workingtm.tm_hour) { return false; + } } *wtm = workingtm; return true; } - if (hour < wtm->tm_hour) + if (hour < wtm->tm_hour) { return false; + } if (hour > wtm->tm_hour) { wtm->tm_hour = hour; @@ -3045,11 +5264,13 @@ cronemu_hour(struct tm *wtm, int hour, int min) bool cronemu_min(struct tm *wtm, int min) { - if (min == -1) + if (min == -1) { return true; + } - if (min < wtm->tm_min) + if (min < wtm->tm_min) { return false; + } if (min > wtm->tm_min) { wtm->tm_min = min; @@ -3057,3 +5278,1694 @@ cronemu_min(struct tm *wtm, int min) return true; } + +kern_return_t +job_mig_create_server(job_t j, cmd_t server_cmd, uid_t server_uid, boolean_t on_demand, mach_port_t *server_portp) +{ + struct ldcred ldc; + job_t js; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (unlikely(j->deny_job_creation)) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + runtime_get_caller_creds(&ldc); + + job_log(j, LOG_DEBUG, "Server create attempt: %s", server_cmd); + +#define LET_MERE_MORTALS_ADD_SERVERS_TO_PID1 + /* XXX - This code should go away once the per session launchd is integrated with the rest of the system */ +#ifdef LET_MERE_MORTALS_ADD_SERVERS_TO_PID1 + if (getpid() == 1) { + if (ldc.euid && server_uid && (ldc.euid != server_uid)) { + job_log(j, LOG_WARNING, "Server create: \"%s\": Will run as UID %d, not UID %d as they told us to", + server_cmd, ldc.euid, server_uid); + server_uid = ldc.euid; + } + } else +#endif + if (getuid()) { + if (server_uid != getuid()) { + job_log(j, LOG_WARNING, "Server create: \"%s\": As UID %d, we will not be able to switch to UID %d", + server_cmd, getuid(), server_uid); + } + server_uid = 0; /* zero means "do nothing" */ + } + + js = job_new_via_mach_init(j, server_cmd, server_uid, on_demand); + + if (js == NULL) { + return BOOTSTRAP_NO_MEMORY; + } + + *server_portp = js->j_port; + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_send_signal(job_t j, mach_port_t srp, name_t targetlabel, int sig) +{ + struct ldcred ldc; + job_t otherj; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + + if (ldc.euid != 0 && ldc.euid != getuid()) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (!(otherj = job_find(targetlabel))) { + return BOOTSTRAP_UNKNOWN_SERVICE; + } + + if (sig == VPROC_MAGIC_UNLOAD_SIGNAL) { + bool do_block = otherj->p; + + if (otherj->anonymous) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + job_remove(otherj); + + if (do_block) { + job_log(j, LOG_DEBUG, "Blocking MIG return of job_remove(): %s", otherj->label); + /* this is messy. We shouldn't access 'otherj' after job_remove(), but we check otherj->p first... */ + job_assumes(otherj, waiting4removal_new(otherj, srp)); + return MIG_NO_REPLY; + } else { + return 0; + } + } else if (otherj->p) { + job_assumes(j, runtime_kill(otherj->p, sig) != -1); + } + + return 0; +} + +kern_return_t +job_mig_log_forward(job_t j, vm_offset_t inval, mach_msg_type_number_t invalCnt) +{ + struct ldcred ldc; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (!job_assumes(j, j->per_user)) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + runtime_get_caller_creds(&ldc); + + return runtime_log_forward(ldc.euid, ldc.egid, inval, invalCnt); +} + +kern_return_t +job_mig_log_drain(job_t j, mach_port_t srp, vm_offset_t *outval, mach_msg_type_number_t *outvalCnt) +{ + struct ldcred ldc; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + + if (ldc.euid) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + return runtime_log_drain(srp, outval, outvalCnt); +} + +kern_return_t +job_mig_swap_complex(job_t j, vproc_gsk_t inkey, vproc_gsk_t outkey, + vm_offset_t inval, mach_msg_type_number_t invalCnt, + vm_offset_t *outval, mach_msg_type_number_t *outvalCnt) +{ + const char *action; + launch_data_t input_obj, output_obj; + size_t data_offset = 0; + size_t packed_size; + struct ldcred ldc; + + runtime_get_caller_creds(&ldc); + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (inkey && ldc.euid && ldc.euid != getuid()) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (inkey && outkey && !job_assumes(j, inkey == outkey)) { + return 1; + } + + if (inkey && outkey) { + action = "Swapping"; + } else if (inkey) { + action = "Setting"; + } else { + action = "Getting"; + } + + job_log(j, LOG_DEBUG, "%s key: %u", action, inkey ? inkey : outkey); + + *outvalCnt = 20 * 1024 * 1024; + mig_allocate(outval, *outvalCnt); + if (!job_assumes(j, *outval != 0)) { + return 1; + } + + if (invalCnt && !job_assumes(j, (input_obj = launch_data_unpack((void *)inval, invalCnt, NULL, 0, &data_offset, NULL)) != NULL)) { + goto out_bad; + } + + switch (outkey) { + case VPROC_GSK_ENVIRONMENT: + if (!job_assumes(j, (output_obj = launch_data_alloc(LAUNCH_DATA_DICTIONARY)))) { + goto out_bad; + } + jobmgr_export_env_from_other_jobs(j->mgr, output_obj); + if (!job_assumes(j, launch_data_pack(output_obj, (void *)*outval, *outvalCnt, NULL, NULL) != 0)) { + goto out_bad; + } + launch_data_free(output_obj); + break; + case VPROC_GSK_ALLJOBS: + if (!job_assumes(j, (output_obj = job_export_all()) != NULL)) { + goto out_bad; + } + ipc_revoke_fds(output_obj); + packed_size = launch_data_pack(output_obj, (void *)*outval, *outvalCnt, NULL, NULL); + if (!job_assumes(j, packed_size != 0)) { + goto out_bad; + } + launch_data_free(output_obj); + break; + case 0: + mig_deallocate(*outval, *outvalCnt); + *outval = 0; + *outvalCnt = 0; + break; + default: + goto out_bad; + } + + if (invalCnt) switch (inkey) { + case VPROC_GSK_ENVIRONMENT: + job_assumes(j, false); + break; + case 0: + break; + default: + goto out_bad; + } + + mig_deallocate(inval, invalCnt); + + return 0; + +out_bad: + if (*outval) { + mig_deallocate(*outval, *outvalCnt); + } + return 1; +} + +kern_return_t +job_mig_swap_integer(job_t j, vproc_gsk_t inkey, vproc_gsk_t outkey, int64_t inval, int64_t *outval) +{ + const char *action; + kern_return_t kr = 0; + struct ldcred ldc; + int oldmask; + + runtime_get_caller_creds(&ldc); + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (inkey && ldc.euid && ldc.euid != getuid()) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (inkey && outkey && !job_assumes(j, inkey == outkey)) { + return 1; + } + + if (inkey && outkey) { + action = "Swapping"; + } else if (inkey) { + action = "Setting"; + } else { + action = "Getting"; + } + + job_log(j, LOG_DEBUG, "%s key: %u", action, inkey ? inkey : outkey); + + switch (outkey) { + case VPROC_GSK_LAST_EXIT_STATUS: + *outval = j->last_exit_status; + break; + case VPROC_GSK_MGR_UID: + *outval = getuid(); + break; + case VPROC_GSK_MGR_PID: + *outval = getpid(); + break; + case VPROC_GSK_IS_MANAGED: + *outval = j->anonymous ? 0 : 1; + break; + case VPROC_GSK_BASIC_KEEPALIVE: + *outval = !j->ondemand; + break; + case VPROC_GSK_START_INTERVAL: + *outval = j->start_interval; + break; + case VPROC_GSK_IDLE_TIMEOUT: + *outval = j->timeout; + break; + case VPROC_GSK_EXIT_TIMEOUT: + *outval = j->exit_timeout; + break; + case VPROC_GSK_GLOBAL_LOG_MASK: + oldmask = runtime_setlogmask(LOG_UPTO(LOG_DEBUG)); + *outval = oldmask; + runtime_setlogmask(oldmask); + break; + case VPROC_GSK_GLOBAL_UMASK: + oldmask = umask(0); + *outval = oldmask; + umask(oldmask); + break; + case 0: + *outval = 0; + break; + default: + kr = 1; + break; + } + + switch (inkey) { + case VPROC_GSK_GLOBAL_ON_DEMAND: + kr = job_set_global_on_demand(j, (bool)inval) ? 0 : 1; + break; + case VPROC_GSK_BASIC_KEEPALIVE: + j->ondemand = !inval; + break; + case VPROC_GSK_START_INTERVAL: + if ((uint64_t)inval > UINT32_MAX) { + kr = 1; + } else if (inval) { + if (j->start_interval == 0) { + runtime_add_ref(); + } else { + /* Workaround 5225889 */ + job_assumes(j, kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_DELETE, 0, 0, j) != -1); + } + j->start_interval = inval; + job_assumes(j, kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, j->start_interval, j) != -1); + } else if (j->start_interval) { + job_assumes(j, kevent_mod((uintptr_t)&j->start_interval, EVFILT_TIMER, EV_DELETE, 0, 0, NULL) != -1); + if (j->start_interval != 0) { + runtime_del_ref(); + } + j->start_interval = 0; + } + break; + case VPROC_GSK_IDLE_TIMEOUT: + if ((unsigned int)inval > 0) { + j->timeout = inval; + } + break; + case VPROC_GSK_EXIT_TIMEOUT: + if ((unsigned int)inval > 0) { + j->exit_timeout = inval; + } + break; + case VPROC_GSK_GLOBAL_LOG_MASK: + runtime_setlogmask(inval); + break; + case VPROC_GSK_GLOBAL_UMASK: + umask(inval); + break; + case 0: + break; + default: + kr = 1; + break; + } + + return kr; +} + +kern_return_t +job_mig_post_fork_ping(job_t j, task_t child_task) +{ + struct machservice *ms; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + job_log(j, LOG_DEBUG, "Post fork ping."); + + job_setup_exception_port(j, child_task); + + SLIST_FOREACH(ms, &special_ports, special_port_sle) { + if (j->per_user && (ms->special_port_num != TASK_ACCESS_PORT)) { + /* The TASK_ACCESS_PORT funny business is to workaround 5325399. */ + continue; + } + + errno = task_set_special_port(child_task, ms->special_port_num, ms->port); + + if (errno) { + int desired_log_level = LOG_ERR; + + if (j->anonymous) { + /* 5338127 */ + + desired_log_level = LOG_WARNING; + + if (ms->special_port_num == TASK_SEATBELT_PORT) { + desired_log_level = LOG_DEBUG; + } + } + + job_log(j, desired_log_level, "Could not setup Mach task special port %u: %s", ms->special_port_num, mach_error_string(errno)); + } + } + + job_assumes(j, launchd_mport_deallocate(child_task) == KERN_SUCCESS); + + return 0; +} + +kern_return_t +job_mig_reboot2(job_t j, uint64_t flags) +{ + char who_started_the_reboot[2048] = ""; + struct kinfo_proc kp; + struct ldcred ldc; + pid_t pid_to_log; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (getpid() != 1) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + runtime_get_caller_creds(&ldc); + + if (ldc.euid) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + for (pid_to_log = ldc.pid; pid_to_log; pid_to_log = kp.kp_eproc.e_ppid) { + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid_to_log }; + size_t who_offset, len = sizeof(kp); + + if (!job_assumes(j, sysctl(mib, 4, &kp, &len, NULL, 0) != -1)) { + return 1; + } + + who_offset = strlen(who_started_the_reboot); + snprintf(who_started_the_reboot + who_offset, sizeof(who_started_the_reboot) - who_offset, + " %s[%u]%s", kp.kp_proc.p_comm, pid_to_log, kp.kp_eproc.e_ppid ? " ->" : ""); + } + + root_jobmgr->reboot_flags = (int)flags; + + launchd_shutdown(); + + job_log(j, LOG_DEBUG, "reboot2() initiated by:%s", who_started_the_reboot); + + return 0; +} + +kern_return_t +job_mig_getsocket(job_t j, name_t spr) +{ + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + ipc_server_init(); + + if (!sockpath) { + return BOOTSTRAP_NO_MEMORY; + } + + strncpy(spr, sockpath, sizeof(name_t)); + + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_log(job_t j, int pri, int err, logmsg_t msg) +{ + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if ((errno = err)) { + job_log_error(j, pri, "%s", msg); + } else { + job_log(j, pri, "%s", msg); + } + + return 0; +} + +void +ensure_root_bkgd_setup(void) +{ + if (background_jobmgr || getpid() != 1) { + return; + } + + if (!jobmgr_assumes(root_jobmgr, (background_jobmgr = jobmgr_new(root_jobmgr, mach_task_self(), MACH_PORT_NULL, false, VPROCMGR_SESSION_BACKGROUND)) != NULL)) { + return; + } + + background_jobmgr->req_port = 0; + jobmgr_assumes(root_jobmgr, launchd_mport_make_send(background_jobmgr->jm_port) == KERN_SUCCESS); +} + +kern_return_t +job_mig_lookup_per_user_context(job_t j, uid_t which_user, mach_port_t *up_cont) +{ + struct ldcred ldc; + job_t ji; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + job_log(j, LOG_DEBUG, "Looking up per user launchd for UID: %u", which_user); + + runtime_get_caller_creds(&ldc); + + if (getpid() != 1) { + job_log(j, LOG_ERR, "Only PID 1 supports per user launchd lookups."); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (ldc.euid || ldc.uid) { + which_user = ldc.euid ? ldc.euid : ldc.uid; + } + + *up_cont = MACH_PORT_NULL; + + if (which_user == 0) { + ensure_root_bkgd_setup(); + + *up_cont = background_jobmgr->jm_port; + + return 0; + } + + LIST_FOREACH(ji, &root_jobmgr->jobs, sle) { + if (!ji->per_user) { + continue; + } + if (ji->mach_uid != which_user) { + continue; + } + if (SLIST_EMPTY(&ji->machservices)) { + continue; + } + if (!SLIST_FIRST(&ji->machservices)->per_user_hack) { + continue; + } + break; + } + + if (ji == NULL) { + struct machservice *ms; + char lbuf[1024]; + + job_log(j, LOG_DEBUG, "Creating per user launchd job for UID: %u", which_user); + + sprintf(lbuf, "com.apple.launchd.peruser.%u", which_user); + + ji = job_new(root_jobmgr, lbuf, "/sbin/launchd", NULL); + + if (ji == NULL) { + return BOOTSTRAP_NO_MEMORY; + } + + ji->mach_uid = which_user; + ji->per_user = true; + + if ((ms = machservice_new(ji, lbuf, up_cont, false)) == NULL) { + job_remove(ji); + return BOOTSTRAP_NO_MEMORY; + } + + ms->per_user_hack = true; + ms->hide = true; + + ji = job_dispatch(ji, false); + } else { + job_log(j, LOG_DEBUG, "Per user launchd job found for UID: %u", which_user); + } + + if (job_assumes(j, ji != NULL)) { + *up_cont = machservice_port(SLIST_FIRST(&ji->machservices)); + } + + return 0; +} + +kern_return_t +job_mig_check_in(job_t j, name_t servicename, mach_port_t *serviceportp) +{ + static pid_t last_warned_pid = 0; + struct machservice *ms; + struct ldcred ldc; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + + ms = jobmgr_lookup_service(j->mgr, servicename, true, 0); + + if (ms == NULL) { + job_log(j, LOG_DEBUG, "Check-in of Mach service failed. Unknown: %s", servicename); + return BOOTSTRAP_UNKNOWN_SERVICE; + } + if (machservice_job(ms) != j) { + if (last_warned_pid != ldc.pid) { + job_log(j, LOG_NOTICE, "Check-in of Mach service failed. PID %d is not privileged: %s", + ldc.pid, servicename); + last_warned_pid = ldc.pid; + } + return BOOTSTRAP_NOT_PRIVILEGED; + } + if (machservice_active(ms)) { + job_log(j, LOG_WARNING, "Check-in of Mach service failed. Already active: %s", servicename); + return BOOTSTRAP_SERVICE_ACTIVE; + } + + machservice_request_notifications(ms); + + job_log(j, LOG_INFO, "Check-in of service: %s", servicename); + + *serviceportp = machservice_port(ms); + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_register2(job_t j, name_t servicename, mach_port_t serviceport, uint64_t flags) +{ + struct machservice *ms; + struct ldcred ldc; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + +#if 0 + job_log(j, LOG_APPLEONLY, "bootstrap_register() is deprecated. Service: %s", servicename); +#endif + + job_log(j, LOG_DEBUG, "%sMach service registration attempt: %s", flags & BOOTSTRAP_PER_PID_SERVICE ? "Per PID " : "", servicename); + + /* 5641783 for the embedded hack */ +#if !TARGET_OS_EMBEDDED + /* + * From a per-user/session launchd's perspective, SecurityAgent (UID + * 92) is a rogue application (not our UID, not root and not a child of + * us). We'll have to reconcile this design friction at a later date. + */ + if (j->anonymous && job_get_bs(j)->parentmgr == NULL && ldc.uid != 0 && ldc.uid != getuid() && ldc.uid != 92) { + if (getpid() == 1) { + return VPROC_ERR_TRY_PER_USER; + } else { + return BOOTSTRAP_NOT_PRIVILEGED; + } + } +#endif + + ms = jobmgr_lookup_service(j->mgr, servicename, false, flags & BOOTSTRAP_PER_PID_SERVICE ? ldc.pid : 0); + + if (ms) { + if (machservice_job(ms) != j) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + if (machservice_active(ms)) { + job_log(j, LOG_DEBUG, "Mach service registration failed. Already active: %s", servicename); + return BOOTSTRAP_SERVICE_ACTIVE; + } + job_checkin(j); + machservice_delete(j, ms, false); + } + + if (serviceport != MACH_PORT_NULL) { + if ((ms = machservice_new(j, servicename, &serviceport, flags & BOOTSTRAP_PER_PID_SERVICE ? true : false))) { + machservice_request_notifications(ms); + } else { + return BOOTSTRAP_NO_MEMORY; + } + } + + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_look_up2(job_t j, name_t servicename, mach_port_t *serviceportp, mach_msg_type_name_t *ptype, pid_t target_pid, uint64_t flags) +{ + struct machservice *ms; + struct ldcred ldc; + kern_return_t kr; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + + /* 5641783 for the embedded hack */ +#if !TARGET_OS_EMBEDDED + if (getpid() == 1 && j->anonymous && job_get_bs(j)->parentmgr == NULL && ldc.uid != 0 && ldc.euid != 0) { + return VPROC_ERR_TRY_PER_USER; + } +#endif + + if (!mspolicy_check(j, servicename, flags & BOOTSTRAP_PER_PID_SERVICE)) { + job_log(j, LOG_NOTICE, "Policy denied Mach service lookup: %s", servicename); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (flags & BOOTSTRAP_PER_PID_SERVICE) { + ms = jobmgr_lookup_service(j->mgr, servicename, false, target_pid); + } else { + ms = jobmgr_lookup_service(j->mgr, servicename, true, 0); + } + + if (ms && machservice_hidden(ms) && !machservice_active(ms)) { + ms = NULL; + } else if (ms && ms->per_user_hack) { + ms = NULL; + } + + if (ms) { + launchd_assumes(machservice_port(ms) != MACH_PORT_NULL); + job_log(j, LOG_DEBUG, "%sMach service lookup: %s", flags & BOOTSTRAP_PER_PID_SERVICE ? "Per PID " : "", servicename); +#if 0 + /* After Leopard ships, we should enable this */ + if (j->lastlookup == ms && j->lastlookup_gennum == ms->gen_num && !j->per_user) { + ms->bad_perf_cnt++; + job_log(j, LOG_APPLEONLY, "Performance opportunity: Number of bootstrap_lookup(... \"%s\" ...) calls that should have been cached: %llu", + servicename, ms->bad_perf_cnt); + } + j->lastlookup = ms; + j->lastlookup_gennum = ms->gen_num; +#endif + *serviceportp = machservice_port(ms); + *ptype = MACH_MSG_TYPE_COPY_SEND; + kr = BOOTSTRAP_SUCCESS; + } else if (!(flags & BOOTSTRAP_PER_PID_SERVICE) && (inherited_bootstrap_port != MACH_PORT_NULL)) { + job_log(j, LOG_DEBUG, "Mach service lookup forwarded: %s", servicename); + *ptype = MACH_MSG_TYPE_MOVE_SEND; + kr = bootstrap_look_up(inherited_bootstrap_port, servicename, serviceportp); + } else if (getpid() == 1 && j->anonymous && ldc.euid >= 500 && strcasecmp(job_get_bs(j)->name, VPROCMGR_SESSION_LOGINWINDOW) == 0) { + /* + * 5240036 Should start background session when a lookup of CCacheServer occurs + * + * This is a total hack. We sniff out loginwindow session, and attempt to guess what it is up to. + * If we find a EUID that isn't root, we force it over to the per-user context. + */ + return VPROC_ERR_TRY_PER_USER; + } else { + job_log(j, LOG_DEBUG, "%sMach service lookup failed: %s", flags & BOOTSTRAP_PER_PID_SERVICE ? "Per PID " : "", servicename); + kr = BOOTSTRAP_UNKNOWN_SERVICE; + } + + return kr; +} + +kern_return_t +job_mig_parent(job_t j, mach_port_t *parentport, mach_msg_type_name_t *pptype) +{ + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + job_log(j, LOG_DEBUG, "Requested parent bootstrap port"); + jobmgr_t jm = j->mgr; + + *pptype = MACH_MSG_TYPE_MAKE_SEND; + + if (jobmgr_parent(jm)) { + *parentport = jobmgr_parent(jm)->jm_port; + } else if (MACH_PORT_NULL == inherited_bootstrap_port) { + *parentport = jm->jm_port; + } else { + *pptype = MACH_MSG_TYPE_COPY_SEND; + *parentport = inherited_bootstrap_port; + } + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_info(job_t j, name_array_t *servicenamesp, unsigned int *servicenames_cnt, + bootstrap_status_array_t *serviceactivesp, unsigned int *serviceactives_cnt) +{ + name_array_t service_names = NULL; + bootstrap_status_array_t service_actives = NULL; + unsigned int cnt = 0, cnt2 = 0; + struct machservice *ms; + jobmgr_t jm; + job_t ji; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + jm = j->mgr; + + LIST_FOREACH(ji, &jm->jobs, sle) { + SLIST_FOREACH(ms, &ji->machservices, sle) { + if (!ms->per_pid) { + cnt++; + } + } + } + + if (cnt == 0) { + goto out; + } + + mig_allocate((vm_address_t *)&service_names, cnt * sizeof(service_names[0])); + if (!launchd_assumes(service_names != NULL)) { + goto out_bad; + } + + mig_allocate((vm_address_t *)&service_actives, cnt * sizeof(service_actives[0])); + if (!launchd_assumes(service_actives != NULL)) { + goto out_bad; + } + + LIST_FOREACH(ji, &jm->jobs, sle) { + SLIST_FOREACH(ms, &ji->machservices, sle) { + if (!ms->per_pid) { + strlcpy(service_names[cnt2], machservice_name(ms), sizeof(service_names[0])); + service_actives[cnt2] = machservice_status(ms); + cnt2++; + } + } + } + + launchd_assumes(cnt == cnt2); + +out: + *servicenamesp = service_names; + *serviceactivesp = service_actives; + *servicenames_cnt = *serviceactives_cnt = cnt; + + return BOOTSTRAP_SUCCESS; + +out_bad: + if (service_names) { + mig_deallocate((vm_address_t)service_names, cnt * sizeof(service_names[0])); + } + if (service_actives) { + mig_deallocate((vm_address_t)service_actives, cnt * sizeof(service_actives[0])); + } + + return BOOTSTRAP_NO_MEMORY; +} + +void +job_reparent_hack(job_t j, const char *where) +{ + jobmgr_t jmi, jmi2; + + ensure_root_bkgd_setup(); + + /* NULL is only passed for our custom API for LaunchServices. If that is the case, we do magic. */ + if (where == NULL) { + if (strcasecmp(j->mgr->name, VPROCMGR_SESSION_LOGINWINDOW) == 0) { + where = VPROCMGR_SESSION_LOGINWINDOW; + } else { + where = VPROCMGR_SESSION_AQUA; + } + } + + if (strcasecmp(j->mgr->name, where) == 0) { + return; + } + + SLIST_FOREACH(jmi, &root_jobmgr->submgrs, sle) { + if (jmi->shutting_down) { + continue; + } else if (strcasecmp(jmi->name, where) == 0) { + goto jm_found; + } else if (strcasecmp(jmi->name, VPROCMGR_SESSION_BACKGROUND) == 0 && getpid() == 1) { + SLIST_FOREACH(jmi2, &jmi->submgrs, sle) { + if (strcasecmp(jmi2->name, where) == 0) { + jmi = jmi2; + goto jm_found; + } + } + } + } + +jm_found: + if (job_assumes(j, jmi != NULL)) { + struct machservice *msi; + + SLIST_FOREACH(msi, &j->machservices, sle) { + LIST_REMOVE(msi, name_hash_sle); + } + + LIST_REMOVE(j, sle); + LIST_INSERT_HEAD(&jmi->jobs, j, sle); + j->mgr = jmi; + + SLIST_FOREACH(msi, &j->machservices, sle) { + LIST_INSERT_HEAD(&j->mgr->ms_hash[hash_ms(msi->name)], msi, name_hash_sle); + } + } +} + +kern_return_t +job_mig_move_subset(job_t j, mach_port_t target_subset, name_t session_type) +{ + mach_msg_type_number_t l2l_i, l2l_port_cnt = 0; + mach_port_array_t l2l_ports = NULL; + mach_port_t reqport, rcvright; + kern_return_t kr = 1; + launch_data_t out_obj_array = NULL; + struct ldcred ldc; + jobmgr_t jmr = NULL; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + + if (target_subset == MACH_PORT_NULL) { + job_t j2; + + if (j->mgr->session_initialized) { + if (ldc.uid == 0 && getpid() == 1) { + if (strcmp(j->mgr->name, VPROCMGR_SESSION_LOGINWINDOW) == 0) { + job_t ji, jn; + + LIST_FOREACH_SAFE(ji, &j->mgr->jobs, sle, jn) { + if (!ji->anonymous) { + job_remove(ji); + } + } + + ensure_root_bkgd_setup(); + + SLIST_REMOVE(&j->mgr->parentmgr->submgrs, j->mgr, jobmgr_s, sle); + j->mgr->parentmgr = background_jobmgr; + SLIST_INSERT_HEAD(&j->mgr->parentmgr->submgrs, j->mgr, sle); + + /* + * We really should wait for all the jobs to die before proceeding. See 5351245 for more info. + * + * We have hacked around this in job_find() by ignoring jobs that are pending removal. + */ + + } else if (strcmp(j->mgr->name, VPROCMGR_SESSION_AQUA) == 0) { + job_log(j, LOG_DEBUG, "Tried to move the Aqua session."); + return 0; + } else if (strcmp(j->mgr->name, VPROCMGR_SESSION_BACKGROUND) == 0) { + job_log(j, LOG_DEBUG, "Tried to move the background session."); + return 0; + } else { + job_log(j, LOG_ERR, "Tried to initialize an already setup session!"); + kr = BOOTSTRAP_NOT_PRIVILEGED; + goto out; + } + } else { + job_log(j, LOG_ERR, "Tried to initialize an already setup session!"); + kr = BOOTSTRAP_NOT_PRIVILEGED; + goto out; + } + } else if (ldc.uid == 0 && getpid() == 1 && strcmp(session_type, VPROCMGR_SESSION_STANDARDIO) == 0) { + ensure_root_bkgd_setup(); + + SLIST_REMOVE(&j->mgr->parentmgr->submgrs, j->mgr, jobmgr_s, sle); + j->mgr->parentmgr = background_jobmgr; + SLIST_INSERT_HEAD(&j->mgr->parentmgr->submgrs, j->mgr, sle); + } else if (strcmp(session_type, VPROCMGR_SESSION_LOGINWINDOW) == 0) { + jobmgr_t jmi; + + /* + * 5330262 + * + * We're working around LoginWindow and the WindowServer. + * + * In practice, there is only one LoginWindow session. Unfortunately, for certain + * scenarios, the WindowServer spawns loginwindow, and in those cases, it frequently + * spawns a replacement loginwindow session before cleaning up the previous one. + * + * We're going to use the creation of a new LoginWindow context as a clue that the + * previous LoginWindow context is on the way out and therefore we should just + * kick-start the shutdown of it. + */ + + SLIST_FOREACH(jmi, &root_jobmgr->submgrs, sle) { + if (jmi->shutting_down) { + continue; + } else if (strcasecmp(jmi->name, session_type) == 0) { + jobmgr_shutdown(jmi); + break; + } + } + } + + jobmgr_log(j->mgr, LOG_DEBUG, "Renaming to: %s", session_type); + strcpy(j->mgr->name_init, session_type); + + if (job_assumes(j, (j2 = jobmgr_init_session(j->mgr, session_type, false)))) { + job_assumes(j, job_dispatch(j2, true)); + } + + kr = 0; + goto out; + } else if (job_mig_intran2(root_jobmgr, target_subset, ldc.pid)) { + job_log(j, LOG_ERR, "Moving a session to ourself is bogus."); + + kr = BOOTSTRAP_NOT_PRIVILEGED; + goto out; + } + + job_log(j, LOG_DEBUG, "Move subset attempt: 0x%x", target_subset); + + errno = kr = _vproc_grab_subset(target_subset, &reqport, &rcvright, &out_obj_array, &l2l_ports, &l2l_port_cnt); + + if (!job_assumes(j, kr == 0)) { + goto out; + } + + launchd_assert(launch_data_array_get_count(out_obj_array) == l2l_port_cnt); + + if (!job_assumes(j, (jmr = jobmgr_new(j->mgr, reqport, rcvright, false, session_type)) != NULL)) { + kr = BOOTSTRAP_NO_MEMORY; + goto out; + } + + for (l2l_i = 0; l2l_i < l2l_port_cnt; l2l_i++) { + launch_data_t tmp, obj_at_idx; + struct machservice *ms; + job_t j_for_service; + const char *serv_name; + pid_t target_pid; + bool serv_perpid; + + job_assumes(j, obj_at_idx = launch_data_array_get_index(out_obj_array, l2l_i)); + job_assumes(j, tmp = launch_data_dict_lookup(obj_at_idx, TAKE_SUBSET_PID)); + target_pid = (pid_t)launch_data_get_integer(tmp); + job_assumes(j, tmp = launch_data_dict_lookup(obj_at_idx, TAKE_SUBSET_PERPID)); + serv_perpid = launch_data_get_bool(tmp); + job_assumes(j, tmp = launch_data_dict_lookup(obj_at_idx, TAKE_SUBSET_NAME)); + serv_name = launch_data_get_string(tmp); + + j_for_service = jobmgr_find_by_pid(jmr, target_pid, true); + + if (!j_for_service) { + /* The PID probably exited */ + job_assumes(j, launchd_mport_deallocate(l2l_ports[l2l_i]) == KERN_SUCCESS); + continue; + } + + if ((ms = machservice_new(j_for_service, serv_name, &l2l_ports[l2l_i], serv_perpid))) { + machservice_request_notifications(ms); + } + } + + kr = 0; + +out: + if (out_obj_array) { + launch_data_free(out_obj_array); + } + + if (l2l_ports) { + mig_deallocate((vm_address_t)l2l_ports, l2l_port_cnt * sizeof(l2l_ports[0])); + } + + if (kr == 0) { + if (target_subset) { + job_assumes(j, launchd_mport_deallocate(target_subset) == KERN_SUCCESS); + } + } else if (jmr) { + jobmgr_shutdown(jmr); + } + + return kr; +} + +kern_return_t +job_mig_take_subset(job_t j, mach_port_t *reqport, mach_port_t *rcvright, + vm_offset_t *outdata, mach_msg_type_number_t *outdataCnt, + mach_port_array_t *portsp, unsigned int *ports_cnt) +{ + launch_data_t tmp_obj, tmp_dict, outdata_obj_array = NULL; + mach_port_array_t ports = NULL; + unsigned int cnt = 0, cnt2 = 0; + size_t packed_size; + struct machservice *ms; + jobmgr_t jm; + job_t ji; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + jm = j->mgr; + + if (getpid() != 1) { + job_log(j, LOG_ERR, "Only the system launchd will transfer Mach sub-bootstraps."); + return BOOTSTRAP_NOT_PRIVILEGED; + } else if (jobmgr_parent(jm) == NULL) { + job_log(j, LOG_ERR, "Root Mach bootstrap cannot be transferred."); + return BOOTSTRAP_NOT_PRIVILEGED; + } else if (strcasecmp(jm->name, VPROCMGR_SESSION_AQUA) == 0) { + job_log(j, LOG_ERR, "Cannot transfer a setup GUI session."); + return BOOTSTRAP_NOT_PRIVILEGED; + } else if (!j->anonymous) { + job_log(j, LOG_ERR, "Only the anonymous job can transfer Mach sub-bootstraps."); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + job_log(j, LOG_DEBUG, "Transferring sub-bootstrap to the per session launchd."); + + outdata_obj_array = launch_data_alloc(LAUNCH_DATA_ARRAY); + if (!job_assumes(j, outdata_obj_array)) { + goto out_bad; + } + + *outdataCnt = 20 * 1024 * 1024; + mig_allocate(outdata, *outdataCnt); + if (!job_assumes(j, *outdata != 0)) { + return 1; + } + + LIST_FOREACH(ji, &j->mgr->jobs, sle) { + if (!ji->anonymous) { + continue; + } + SLIST_FOREACH(ms, &ji->machservices, sle) { + cnt++; + } + } + + mig_allocate((vm_address_t *)&ports, cnt * sizeof(ports[0])); + if (!launchd_assumes(ports != NULL)) { + goto out_bad; + } + + LIST_FOREACH(ji, &j->mgr->jobs, sle) { + if (!ji->anonymous) { + continue; + } + + SLIST_FOREACH(ms, &ji->machservices, sle) { + if (job_assumes(j, (tmp_dict = launch_data_alloc(LAUNCH_DATA_DICTIONARY)))) { + job_assumes(j, launch_data_array_set_index(outdata_obj_array, tmp_dict, cnt2)); + } else { + goto out_bad; + } + + if (job_assumes(j, (tmp_obj = launch_data_new_string(machservice_name(ms))))) { + job_assumes(j, launch_data_dict_insert(tmp_dict, tmp_obj, TAKE_SUBSET_NAME)); + } else { + goto out_bad; + } + + if (job_assumes(j, (tmp_obj = launch_data_new_integer((ms->job->p))))) { + job_assumes(j, launch_data_dict_insert(tmp_dict, tmp_obj, TAKE_SUBSET_PID)); + } else { + goto out_bad; + } + + if (job_assumes(j, (tmp_obj = launch_data_new_bool((ms->per_pid))))) { + job_assumes(j, launch_data_dict_insert(tmp_dict, tmp_obj, TAKE_SUBSET_PERPID)); + } else { + goto out_bad; + } + + ports[cnt2] = machservice_port(ms); + + /* Increment the send right by one so we can shutdown the jobmgr cleanly */ + jobmgr_assumes(jm, (errno = mach_port_mod_refs(mach_task_self(), ports[cnt2], MACH_PORT_RIGHT_SEND, 1)) == 0); + cnt2++; + } + } + + launchd_assumes(cnt == cnt2); + + packed_size = launch_data_pack(outdata_obj_array, (void *)*outdata, *outdataCnt, NULL, NULL); + if (!job_assumes(j, packed_size != 0)) { + goto out_bad; + } + + launch_data_free(outdata_obj_array); + + *portsp = ports; + *ports_cnt = cnt; + + *reqport = jm->req_port; + *rcvright = jm->jm_port; + + jm->req_port = 0; + jm->jm_port = 0; + + workaround_5477111 = j; + + jobmgr_shutdown(jm); + + return BOOTSTRAP_SUCCESS; + +out_bad: + if (outdata_obj_array) { + launch_data_free(outdata_obj_array); + } + if (*outdata) { + mig_deallocate(*outdata, *outdataCnt); + } + if (ports) { + mig_deallocate((vm_address_t)ports, cnt * sizeof(ports[0])); + } + + return BOOTSTRAP_NO_MEMORY; +} + +kern_return_t +job_mig_subset(job_t j, mach_port_t requestorport, mach_port_t *subsetportp) +{ + int bsdepth = 0; + jobmgr_t jmr; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + jmr = j->mgr; + + while ((jmr = jobmgr_parent(jmr)) != NULL) { + bsdepth++; + } + + /* Since we use recursion, we need an artificial depth for subsets */ + if (bsdepth > 100) { + job_log(j, LOG_ERR, "Mach sub-bootstrap create request failed. Depth greater than: %d", bsdepth); + return BOOTSTRAP_NO_MEMORY; + } + + if ((jmr = jobmgr_new(j->mgr, requestorport, MACH_PORT_NULL, false, NULL)) == NULL) { + if (requestorport == MACH_PORT_NULL) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + return BOOTSTRAP_NO_MEMORY; + } + + *subsetportp = jmr->jm_port; + return BOOTSTRAP_SUCCESS; +} + +kern_return_t +job_mig_create_service(job_t j, name_t servicename, mach_port_t *serviceportp) +{ + struct machservice *ms; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (job_prog(j)[0] == '\0') { + job_log(j, LOG_ERR, "Mach service creation requires a target server: %s", servicename); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (!j->legacy_mach_job) { + job_log(j, LOG_ERR, "bootstrap_create_service() is only allowed against legacy Mach jobs: %s", servicename); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + ms = jobmgr_lookup_service(j->mgr, servicename, false, 0); + if (ms) { + job_log(j, LOG_DEBUG, "Mach service creation attempt for failed. Already exists: %s", servicename); + return BOOTSTRAP_NAME_IN_USE; + } + + job_checkin(j); + + *serviceportp = MACH_PORT_NULL; + ms = machservice_new(j, servicename, serviceportp, false); + + if (!launchd_assumes(ms != NULL)) { + goto out_bad; + } + + return BOOTSTRAP_SUCCESS; + +out_bad: + launchd_assumes(launchd_mport_close_recv(*serviceportp) == KERN_SUCCESS); + return BOOTSTRAP_NO_MEMORY; +} + +kern_return_t +job_mig_embedded_wait(job_t j, name_t targetlabel, integer_t *waitstatus) +{ + job_t otherj; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (unlikely(!(otherj = job_find(targetlabel)))) { + return BOOTSTRAP_UNKNOWN_SERVICE; + } + + *waitstatus = j->last_exit_status; + + return 0; +} + +kern_return_t +job_mig_embedded_kickstart(job_t j, name_t targetlabel, pid_t *out_pid, mach_port_t *out_name_port) +{ + struct ldcred ldc; + kern_return_t kr; + job_t otherj; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (unlikely(!(otherj = job_find(targetlabel)))) { + return BOOTSTRAP_UNKNOWN_SERVICE; + } + + runtime_get_caller_creds(&ldc); + + if (ldc.euid != 0 && ldc.euid != geteuid() +#if TARGET_OS_EMBEDDED + && j->username && otherj->username + && strcmp(j->username, otherj->username) != 0 +#endif + ) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + otherj = job_dispatch(otherj, true); + + if (!job_assumes(j, otherj && otherj->p)) { + return BOOTSTRAP_NO_MEMORY; + } + + kr = task_name_for_pid(mach_task_self(), otherj->p, out_name_port); + if (!job_assumes(j, kr == 0)) { + return kr; + } + + *out_pid = otherj->p; + + return 0; +} + +kern_return_t +job_mig_wait(job_t j, mach_port_t srp, integer_t *waitstatus) +{ + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } +#if 0 + struct ldcred ldc; + runtime_get_caller_creds(&ldc); +#endif + return job_handle_mpm_wait(j, srp, waitstatus); +} + +kern_return_t +job_mig_uncork_fork(job_t j) +{ + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (!j->stall_before_exec) { + job_log(j, LOG_WARNING, "Attempt to uncork a job that isn't in the middle of a fork()."); + return 1; + } + + job_uncork_fork(j); + j->stall_before_exec = false; + return 0; +} + +kern_return_t +job_mig_set_service_policy(job_t j, pid_t target_pid, uint64_t flags, name_t target_service) +{ + struct ldcred ldc; + job_t target_j; + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + runtime_get_caller_creds(&ldc); + +#if TARGET_OS_EMBEDDED + if( ldc.euid ) { + return BOOTSTRAP_NOT_PRIVILEGED; + } +#else + if( ldc.euid && (ldc.euid != getuid()) ) { + int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, target_pid }; + struct kinfo_proc kp; + size_t len = sizeof(kp); + + job_assumes(j, sysctl(mib, 4, &kp, &len, NULL, 0) != -1); + job_assumes(j, len == sizeof(kp)); + + uid_t kp_euid = kp.kp_eproc.e_ucred.cr_uid; + uid_t kp_uid = kp.kp_eproc.e_pcred.p_ruid; + + if( ldc.euid == kp_euid ) { + job_log(j, LOG_DEBUG, "Working around rdar://problem/5982485 and allowing job to set policy for PID %u.", target_pid); + } else { + job_log(j, LOG_ERR, "Denied Mach service policy update requested by UID/EUID %u/%u against PID %u with UID/EUID %u/%u due to mismatched credentials.", ldc.uid, ldc.euid, target_pid, kp_uid, kp_euid); + + return BOOTSTRAP_NOT_PRIVILEGED; + } + } +#endif + + if (!job_assumes(j, (target_j = jobmgr_find_by_pid(j->mgr, target_pid, true)) != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (SLIST_EMPTY(&j->mspolicies)) { + job_log(j, LOG_DEBUG, "Setting policy on job \"%s\" for Mach service: %s", target_j->label, target_service); + if (target_service[0]) { + job_assumes(j, mspolicy_new(target_j, target_service, flags & BOOTSTRAP_ALLOW_LOOKUP, flags & BOOTSTRAP_PER_PID_SERVICE, false)); + } else { + target_j->deny_unknown_mslookups = !(flags & BOOTSTRAP_ALLOW_LOOKUP); + target_j->deny_job_creation = (bool)(flags & BOOTSTRAP_DENY_JOB_CREATION); + } + } else { + job_log(j, LOG_WARNING, "Jobs that have policies assigned to them may not set policies."); + return BOOTSTRAP_NOT_PRIVILEGED; + } + + return 0; +} + +kern_return_t +job_mig_spawn(job_t j, vm_offset_t indata, mach_msg_type_number_t indataCnt, pid_t *child_pid, mach_port_t *obsvr_port) +{ + launch_data_t input_obj = NULL; + size_t data_offset = 0; + struct ldcred ldc; + job_t jr; + +#if TARGET_OS_EMBEDDED + return BOOTSTRAP_NOT_PRIVILEGED; +#endif + + runtime_get_caller_creds(&ldc); + + if (!launchd_assumes(j != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (unlikely(j->deny_job_creation)) { + return BOOTSTRAP_NOT_PRIVILEGED; + } + + if (getpid() == 1 && ldc.euid && ldc.uid) { + job_log(j, LOG_DEBUG, "Punting spawn to per-user-context"); + return VPROC_ERR_TRY_PER_USER; + } + + if (!job_assumes(j, indataCnt != 0)) { + return 1; + } + + if (!job_assumes(j, (input_obj = launch_data_unpack((void *)indata, indataCnt, NULL, 0, &data_offset, NULL)) != NULL)) { + return 1; + } + + jr = jobmgr_import2(j->mgr, input_obj); + + if (!job_assumes(j, jr != NULL)) { + switch (errno) { + case EEXIST: + return BOOTSTRAP_NAME_IN_USE; + default: + return BOOTSTRAP_NO_MEMORY; + } + } + + job_reparent_hack(jr, NULL); + + if (getpid() == 1) { + jr->mach_uid = ldc.uid; + } + + jr->unload_at_exit = true; + jr->wait4pipe_eof = true; + jr->abandon_pg = true; + jr->stall_before_exec = jr->wait4debugger; + jr->wait4debugger = false; + + jr = job_dispatch(jr, true); + + if (!job_assumes(j, jr != NULL)) { + return BOOTSTRAP_NO_MEMORY; + } + + if (!job_assumes(jr, jr->p)) { + job_remove(jr); + return BOOTSTRAP_NO_MEMORY; + } + + if (!job_setup_machport(jr)) { + job_remove(jr); + return BOOTSTRAP_NO_MEMORY; + } + + job_log(jr, LOG_DEBUG, "Spawned by PID %u: %s", j->p, j->label); + + *child_pid = jr->p; + *obsvr_port = jr->j_port; + + mig_deallocate(indata, indataCnt); + + return BOOTSTRAP_SUCCESS; +} + +void +jobmgr_init(bool sflag) +{ + const char *root_session_type = getpid() == 1 ? VPROCMGR_SESSION_SYSTEM : VPROCMGR_SESSION_BACKGROUND; + + launchd_assert((root_jobmgr = jobmgr_new(NULL, MACH_PORT_NULL, MACH_PORT_NULL, sflag, root_session_type)) != NULL); +} + +size_t +our_strhash(const char *s) +{ + size_t c, r = 5381; + + /* djb2 + * This algorithm was first reported by Dan Bernstein many years ago in comp.lang.c + */ + + while ((c = *s++)) { + r = ((r << 5) + r) + c; /* hash*33 + c */ + } + + return r; +} + +size_t +hash_label(const char *label) +{ + return our_strhash(label) % LABEL_HASH_SIZE; +} + +size_t +hash_ms(const char *msstr) +{ + return our_strhash(msstr) % MACHSERVICE_HASH_SIZE; +} + +bool +mspolicy_copy(job_t j_to, job_t j_from) +{ + struct mspolicy *msp; + + SLIST_FOREACH(msp, &j_from->mspolicies, sle) { + if (!mspolicy_new(j_to, msp->name, msp->allow, msp->per_pid, true)) { + return false; + } + } + + return true; +} + +bool +mspolicy_new(job_t j, const char *name, bool allow, bool pid_local, bool skip_check) +{ + struct mspolicy *msp; + + if (!skip_check) SLIST_FOREACH(msp, &j->mspolicies, sle) { + if (msp->per_pid != pid_local) { + continue; + } else if (strcmp(msp->name, name) == 0) { + return false; + } + } + + if ((msp = calloc(1, sizeof(struct mspolicy) + strlen(name) + 1)) == NULL) { + return false; + } + + strcpy((char *)msp->name, name); + msp->per_pid = pid_local; + msp->allow = allow; + + SLIST_INSERT_HEAD(&j->mspolicies, msp, sle); + + return true; +} + +void +mspolicy_setup(launch_data_t obj, const char *key, void *context) +{ + job_t j = context; + + if (launch_data_get_type(obj) != LAUNCH_DATA_BOOL) { + job_log(j, LOG_WARNING, "Invalid object type for Mach service policy key: %s", key); + return; + } + + job_assumes(j, mspolicy_new(j, key, launch_data_get_bool(obj), false, false)); +} + +bool +mspolicy_check(job_t j, const char *name, bool pid_local) +{ + struct mspolicy *mspi; + + SLIST_FOREACH(mspi, &j->mspolicies, sle) { + if (mspi->per_pid != pid_local) { + continue; + } else if (strcmp(mspi->name, name) != 0) { + continue; + } + return mspi->allow; + } + + return !j->deny_unknown_mslookups; +} + +void +mspolicy_delete(job_t j, struct mspolicy *msp) +{ + SLIST_REMOVE(&j->mspolicies, msp, mspolicy, sle); + + free(msp); +} + +bool +waiting4removal_new(job_t j, mach_port_t rp) +{ + struct waiting_for_removal *w4r; + + if (!job_assumes(j, (w4r = malloc(sizeof(struct waiting_for_removal))) != NULL)) { + return false; + } + + w4r->reply_port = rp; + + SLIST_INSERT_HEAD(&j->removal_watchers, w4r, sle); + + return true; +} + +void +waiting4removal_delete(job_t j, struct waiting_for_removal *w4r) +{ + job_assumes(j, job_mig_send_signal_reply(w4r->reply_port, 0) == 0); + + SLIST_REMOVE(&j->removal_watchers, w4r, waiting_for_removal, sle); + + free(w4r); +} + +size_t +get_kern_max_proc(void) +{ + int mib[] = { CTL_KERN, KERN_MAXPROC }; + int max = 100; + size_t max_sz = sizeof(max); + + launchd_assumes(sysctl(mib, 2, &max, &max_sz, NULL, 0) != -1); + + return max; +} + +void +do_file_init(void) +{ + struct stat sb; + + launchd_assert(mach_timebase_info(&tbi) == 0); + + if (stat("/AppleInternal", &sb) == 0) { + do_apple_internal_magic = true; + } +}