+ ca.fd = psfa->psfaa_filedes;
+
+ error = close_nocancel(p, &ca, ival);
+ }
+ break;
+
+ case PSFA_INHERIT: {
+ struct fcntl_nocancel_args fcntla;
+
+ /*
+ * Check to see if the descriptor exists, and
+ * ensure it's -not- marked as close-on-exec.
+ *
+ * Attempting to "inherit" a guarded fd will
+ * result in a error.
+ */
+ fcntla.fd = psfa->psfaa_filedes;
+ fcntla.cmd = F_GETFD;
+ if ((error = fcntl_nocancel(p, &fcntla, ival)) != 0)
+ break;
+
+ if ((ival[0] & FD_CLOEXEC) == FD_CLOEXEC) {
+ fcntla.fd = psfa->psfaa_filedes;
+ fcntla.cmd = F_SETFD;
+ fcntla.arg = ival[0] & ~FD_CLOEXEC;
+ error = fcntl_nocancel(p, &fcntla, ival);
+ }
+
+ }
+ break;
+
+ default:
+ error = EINVAL;
+ break;
+ }
+
+ /* All file actions failures are considered fatal, per POSIX */
+
+ if (error) {
+ if (PSFA_OPEN == psfa->psfaa_type) {
+ DTRACE_PROC1(spawn__open__failure, uintptr_t,
+ psfa->psfaa_openargs.psfao_path);
+ } else {
+ DTRACE_PROC1(spawn__fd__failure, int, psfa->psfaa_filedes);
+ }
+ break;
+ }
+ }
+
+ if (error != 0 || (psa_flags & POSIX_SPAWN_CLOEXEC_DEFAULT) == 0)
+ return (error);
+
+ /*
+ * If POSIX_SPAWN_CLOEXEC_DEFAULT is set, behave (during
+ * this spawn only) as if "close on exec" is the default
+ * disposition of all pre-existing file descriptors. In this case,
+ * the list of file descriptors mentioned in the file actions
+ * are the only ones that can be inherited, so mark them now.
+ *
+ * The actual closing part comes later, in fdexec().
+ */
+ proc_fdlock(p);
+ for (action = 0; action < px_sfap->psfa_act_count; action++) {
+ _psfa_action_t *psfa = &px_sfap->psfa_act_acts[action];
+ int fd = psfa->psfaa_filedes;
+
+ switch (psfa->psfaa_type) {
+ case PSFA_DUP2:
+ fd = psfa->psfaa_openargs.psfao_oflag;
+ /*FALLTHROUGH*/
+ case PSFA_OPEN:
+ case PSFA_INHERIT:
+ *fdflags(p, fd) |= UF_INHERIT;
+ break;
+
+ case PSFA_CLOSE:
+ break;
+ }
+ }
+ proc_fdunlock(p);
+
+ return (0);
+}
+
+#if CONFIG_MACF
+/*
+ * exec_spawnattr_getmacpolicyinfo
+ */
+void *
+exec_spawnattr_getmacpolicyinfo(const void *macextensions, const char *policyname, size_t *lenp)
+{
+ const struct _posix_spawn_mac_policy_extensions *psmx = macextensions;
+ int i;
+
+ if (psmx == NULL)
+ return NULL;
+
+ for (i = 0; i < psmx->psmx_count; i++) {
+ const _ps_mac_policy_extension_t *extension = &psmx->psmx_extensions[i];
+ if (strncmp(extension->policyname, policyname, sizeof(extension->policyname)) == 0) {
+ if (lenp != NULL)
+ *lenp = extension->datalen;
+ return extension->datap;
+ }
+ }
+
+ if (lenp != NULL)
+ *lenp = 0;
+ return NULL;
+}
+
+static int
+spawn_copyin_macpolicyinfo(const struct user__posix_spawn_args_desc *px_args, _posix_spawn_mac_policy_extensions_t *psmxp)
+{
+ _posix_spawn_mac_policy_extensions_t psmx = NULL;
+ int error = 0;
+ int copycnt = 0;
+ int i = 0;
+
+ *psmxp = NULL;
+
+ if (px_args->mac_extensions_size < PS_MAC_EXTENSIONS_SIZE(1) ||
+ px_args->mac_extensions_size > PAGE_SIZE) {
+ error = EINVAL;
+ goto bad;
+ }
+
+ MALLOC(psmx, _posix_spawn_mac_policy_extensions_t, px_args->mac_extensions_size, M_TEMP, M_WAITOK);
+ if ((error = copyin(px_args->mac_extensions, psmx, px_args->mac_extensions_size)) != 0)
+ goto bad;
+
+ if (PS_MAC_EXTENSIONS_SIZE(psmx->psmx_count) > px_args->mac_extensions_size) {
+ error = EINVAL;
+ goto bad;
+ }
+
+ for (i = 0; i < psmx->psmx_count; i++) {
+ _ps_mac_policy_extension_t *extension = &psmx->psmx_extensions[i];
+ if (extension->datalen == 0 || extension->datalen > PAGE_SIZE) {
+ error = EINVAL;
+ goto bad;
+ }
+ }
+
+ for (copycnt = 0; copycnt < psmx->psmx_count; copycnt++) {
+ _ps_mac_policy_extension_t *extension = &psmx->psmx_extensions[copycnt];
+ void *data = NULL;
+
+ MALLOC(data, void *, extension->datalen, M_TEMP, M_WAITOK);
+ if ((error = copyin(extension->data, data, extension->datalen)) != 0) {
+ FREE(data, M_TEMP);
+ goto bad;
+ }
+ extension->datap = data;
+ }
+
+ *psmxp = psmx;
+ return 0;
+
+bad:
+ if (psmx != NULL) {
+ for (i = 0; i < copycnt; i++)
+ FREE(psmx->psmx_extensions[i].datap, M_TEMP);
+ FREE(psmx, M_TEMP);
+ }
+ return error;
+}
+
+static void
+spawn_free_macpolicyinfo(_posix_spawn_mac_policy_extensions_t psmx)
+{
+ int i;
+
+ if (psmx == NULL)
+ return;
+ for (i = 0; i < psmx->psmx_count; i++)
+ FREE(psmx->psmx_extensions[i].datap, M_TEMP);
+ FREE(psmx, M_TEMP);
+}
+#endif /* CONFIG_MACF */
+
+/*
+ * posix_spawn
+ *
+ * Parameters: uap->pid Pointer to pid return area
+ * uap->fname File name to exec
+ * uap->argp Argument list
+ * uap->envp Environment list
+ *
+ * Returns: 0 Success
+ * EINVAL Invalid argument
+ * ENOTSUP Not supported
+ * ENOEXEC Executable file format error
+ * exec_activate_image:EINVAL Invalid argument
+ * exec_activate_image:EACCES Permission denied
+ * exec_activate_image:EINTR Interrupted function
+ * exec_activate_image:ENOMEM Not enough space
+ * exec_activate_image:EFAULT Bad address
+ * exec_activate_image:ENAMETOOLONG Filename too long
+ * exec_activate_image:ENOEXEC Executable file format error
+ * exec_activate_image:ETXTBSY Text file busy [misuse of error code]
+ * exec_activate_image:EBADEXEC The executable is corrupt/unknown
+ * exec_activate_image:???
+ * mac_execve_enter:???
+ *
+ * TODO: Expect to need __mac_posix_spawn() at some point...
+ * Handle posix_spawnattr_t
+ * Handle posix_spawn_file_actions_t
+ */
+int
+posix_spawn(proc_t ap, struct posix_spawn_args *uap, int32_t *retval)
+{
+ proc_t p = ap; /* quiet bogus GCC vfork() warning */
+ user_addr_t pid = uap->pid;
+ int ival[2]; /* dummy retval for setpgid() */
+ char *bufp = NULL;
+ struct image_params *imgp;
+ struct vnode_attr *vap;
+ struct vnode_attr *origvap;
+ struct uthread *uthread = 0; /* compiler complains if not set to 0*/
+ int error, sig;
+ char alt_p_comm[sizeof(p->p_comm)] = {0}; /* for PowerPC */
+ int is_64 = IS_64BIT_PROCESS(p);
+ struct vfs_context context;
+ struct user__posix_spawn_args_desc px_args;
+ struct _posix_spawnattr px_sa;
+ _posix_spawn_file_actions_t px_sfap = NULL;
+ _posix_spawn_port_actions_t px_spap = NULL;
+ struct __kern_sigaction vec;
+ boolean_t spawn_no_exec = FALSE;
+ boolean_t proc_transit_set = TRUE;
+ boolean_t exec_done = FALSE;
+ int portwatch_count = 0;
+ ipc_port_t * portwatch_ports = NULL;
+ vm_size_t px_sa_offset = offsetof(struct _posix_spawnattr, psa_ports);
+
+ /*
+ * Allocate a big chunk for locals instead of using stack since these
+ * structures are pretty big.
+ */
+ MALLOC(bufp, char *, (sizeof(*imgp) + sizeof(*vap) + sizeof(*origvap)), M_TEMP, M_WAITOK | M_ZERO);
+ imgp = (struct image_params *) bufp;
+ if (bufp == NULL) {
+ error = ENOMEM;
+ goto bad;
+ }
+ vap = (struct vnode_attr *) (bufp + sizeof(*imgp));
+ origvap = (struct vnode_attr *) (bufp + sizeof(*imgp) + sizeof(*vap));
+
+ /* Initialize the common data in the image_params structure */
+ imgp->ip_user_fname = uap->path;
+ imgp->ip_user_argv = uap->argv;
+ imgp->ip_user_envv = uap->envp;
+ imgp->ip_vattr = vap;
+ imgp->ip_origvattr = origvap;
+ imgp->ip_vfs_context = &context;
+ imgp->ip_flags = (is_64 ? IMGPF_WAS_64BIT : IMGPF_NONE);
+ imgp->ip_p_comm = alt_p_comm; /* for PowerPC */
+ imgp->ip_seg = (is_64 ? UIO_USERSPACE64 : UIO_USERSPACE32);
+ imgp->ip_mac_return = 0;
+
+ if (uap->adesc != USER_ADDR_NULL) {
+ if(is_64) {
+ error = copyin(uap->adesc, &px_args, sizeof(px_args));
+ } else {
+ struct user32__posix_spawn_args_desc px_args32;
+
+ error = copyin(uap->adesc, &px_args32, sizeof(px_args32));
+
+ /*
+ * Convert arguments descriptor from external 32 bit
+ * representation to internal 64 bit representation
+ */
+ px_args.attr_size = px_args32.attr_size;
+ px_args.attrp = CAST_USER_ADDR_T(px_args32.attrp);
+ px_args.file_actions_size = px_args32.file_actions_size;
+ px_args.file_actions = CAST_USER_ADDR_T(px_args32.file_actions);
+ px_args.port_actions_size = px_args32.port_actions_size;
+ px_args.port_actions = CAST_USER_ADDR_T(px_args32.port_actions);
+ px_args.mac_extensions_size = px_args32.mac_extensions_size;
+ px_args.mac_extensions = CAST_USER_ADDR_T(px_args32.mac_extensions);
+ }
+ if (error)
+ goto bad;
+
+ if (px_args.attr_size != 0) {
+ /*
+ * We are not copying the port_actions pointer,
+ * because we already have it from px_args.
+ * This is a bit fragile: <rdar://problem/16427422>
+ */
+
+ if ((error = copyin(px_args.attrp, &px_sa, px_sa_offset) != 0))
+ goto bad;
+
+ bzero( (void *)( (unsigned long) &px_sa + px_sa_offset), sizeof(px_sa) - px_sa_offset );
+
+ imgp->ip_px_sa = &px_sa;
+ }
+ if (px_args.file_actions_size != 0) {
+ /* Limit file_actions to allowed number of open files */
+ int maxfa = (p->p_limit ? p->p_rlimit[RLIMIT_NOFILE].rlim_cur : NOFILE);
+ if (px_args.file_actions_size < PSF_ACTIONS_SIZE(1) ||
+ px_args.file_actions_size > PSF_ACTIONS_SIZE(maxfa)) {
+ error = EINVAL;
+ goto bad;
+ }
+ MALLOC(px_sfap, _posix_spawn_file_actions_t, px_args.file_actions_size, M_TEMP, M_WAITOK);
+ if (px_sfap == NULL) {
+ error = ENOMEM;
+ goto bad;
+ }
+ imgp->ip_px_sfa = px_sfap;
+
+ if ((error = copyin(px_args.file_actions, px_sfap,
+ px_args.file_actions_size)) != 0)
+ goto bad;
+
+ /* Verify that the action count matches the struct size */
+ if (PSF_ACTIONS_SIZE(px_sfap->psfa_act_count) != px_args.file_actions_size) {
+ error = EINVAL;
+ goto bad;
+ }
+ }
+ if (px_args.port_actions_size != 0) {
+ /* Limit port_actions to one page of data */
+ if (px_args.port_actions_size < PS_PORT_ACTIONS_SIZE(1) ||
+ px_args.port_actions_size > PAGE_SIZE) {
+ error = EINVAL;
+ goto bad;
+ }
+
+ MALLOC(px_spap, _posix_spawn_port_actions_t,
+ px_args.port_actions_size, M_TEMP, M_WAITOK);
+ if (px_spap == NULL) {
+ error = ENOMEM;
+ goto bad;
+ }
+ imgp->ip_px_spa = px_spap;
+
+ if ((error = copyin(px_args.port_actions, px_spap,
+ px_args.port_actions_size)) != 0)
+ goto bad;
+
+ /* Verify that the action count matches the struct size */
+ if (PS_PORT_ACTIONS_SIZE(px_spap->pspa_count) != px_args.port_actions_size) {
+ error = EINVAL;
+ goto bad;
+ }
+ }
+#if CONFIG_MACF
+ if (px_args.mac_extensions_size != 0) {
+ if ((error = spawn_copyin_macpolicyinfo(&px_args, (_posix_spawn_mac_policy_extensions_t *)&imgp->ip_px_smpx)) != 0)
+ goto bad;
+ }
+#endif /* CONFIG_MACF */
+ }
+
+ /* set uthread to parent */
+ uthread = get_bsdthread_info(current_thread());
+
+ /*
+ * <rdar://6640530>; this does not result in a behaviour change
+ * relative to Leopard, so there should not be any existing code
+ * which depends on it.
+ */
+ if (uthread->uu_flag & UT_VFORK) {
+ error = EINVAL;
+ goto bad;
+ }
+
+ /*
+ * If we don't have the extension flag that turns "posix_spawn()"
+ * into "execve() with options", then we will be creating a new
+ * process which does not inherit memory from the parent process,
+ * which is one of the most expensive things about using fork()
+ * and execve().
+ */
+ if (imgp->ip_px_sa == NULL || !(px_sa.psa_flags & POSIX_SPAWN_SETEXEC)){
+
+ /*
+ * Set the new task's coalition, if it is requested.
+ * TODO: privilege check - 15365900
+ */
+ coalition_t coal = COALITION_NULL;
+#if CONFIG_COALITIONS
+ if (imgp->ip_px_sa) {
+ uint64_t cid = px_sa.psa_coalitionid;
+ if (cid != 0) {
+#if COALITION_DEBUG
+ printf("%s: searching for coalition ID %llu\n", __func__, cid);
+#endif
+ coal = coalition_find_and_activate_by_id(cid);
+ if (coal == COALITION_NULL) {
+#if COALITION_DEBUG
+ printf("%s: could not find coalition ID %llu (perhaps it has been terminated or reaped)\n", __func__, cid);
+#endif
+ error = ESRCH;
+ goto bad;
+ }
+ }
+ }
+#endif /* CONFIG_COALITIONS */
+
+ error = fork1(p, &imgp->ip_new_thread, PROC_CREATE_SPAWN, coal);
+
+ if (error != 0) {
+ if (coal != COALITION_NULL) {
+#if CONFIG_COALITIONS
+ coalition_remove_active(coal);
+ coalition_release(coal);
+#endif /* CONFIG_COALITIONS */
+ }
+ goto bad;
+ }
+ imgp->ip_flags |= IMGPF_SPAWN; /* spawn w/o exec */
+ spawn_no_exec = TRUE; /* used in later tests */
+
+ if (coal != COALITION_NULL) {
+#if CONFIG_COALITIONS
+ coalition_remove_active(coal);
+ coalition_release(coal);
+#endif /* CONFIG_COALITIONS */
+ }
+ }
+
+ if (spawn_no_exec) {
+ p = (proc_t)get_bsdthreadtask_info(imgp->ip_new_thread);
+
+ /*
+ * We had to wait until this point before firing the
+ * proc:::create probe, otherwise p would not point to the
+ * child process.
+ */
+ DTRACE_PROC1(create, proc_t, p);
+ }
+ assert(p != NULL);
+
+ /* By default, the thread everyone plays with is the parent */
+ context.vc_thread = current_thread();
+ context.vc_ucred = p->p_ucred; /* XXX must NOT be kauth_cred_get() */
+
+ /*
+ * However, if we're not in the setexec case, redirect the context
+ * to the newly created process instead
+ */
+ if (spawn_no_exec)
+ context.vc_thread = imgp->ip_new_thread;
+
+ /*
+ * Post fdcopy(), pre exec_handle_sugid() - this is where we want
+ * to handle the file_actions. Since vfork() also ends up setting
+ * us into the parent process group, and saved off the signal flags,
+ * this is also where we want to handle the spawn flags.
+ */
+
+ /* Has spawn file actions? */
+ if (imgp->ip_px_sfa != NULL) {
+ /*
+ * The POSIX_SPAWN_CLOEXEC_DEFAULT flag
+ * is handled in exec_handle_file_actions().
+ */
+ if ((error = exec_handle_file_actions(imgp,
+ imgp->ip_px_sa != NULL ? px_sa.psa_flags : 0)) != 0)
+ goto bad;
+ }
+
+ /* Has spawn port actions? */
+ if (imgp->ip_px_spa != NULL) {
+ boolean_t is_adaptive = FALSE;
+ boolean_t portwatch_present = FALSE;
+
+ /* Will this process become adaptive? The apptype isn't ready yet, so we can't look there. */
+ if (imgp->ip_px_sa != NULL && px_sa.psa_apptype == POSIX_SPAWN_PROC_TYPE_DAEMON_ADAPTIVE)
+ is_adaptive = TRUE;
+
+ /*
+ * portwatch only:
+ * Allocate a place to store the ports we want to bind to the new task
+ * We can't bind them until after the apptype is set.
+ */
+ if (px_spap->pspa_count != 0 && is_adaptive) {
+ portwatch_count = px_spap->pspa_count;
+ MALLOC(portwatch_ports, ipc_port_t *, (sizeof(ipc_port_t) * portwatch_count), M_TEMP, M_WAITOK | M_ZERO);
+ } else {
+ portwatch_ports = NULL;
+ }
+
+ if ((error = exec_handle_port_actions(imgp,
+ imgp->ip_px_sa != NULL ? px_sa.psa_flags : 0, &portwatch_present, portwatch_ports)) != 0)
+ goto bad;
+
+ if (portwatch_present == FALSE && portwatch_ports != NULL) {
+ FREE(portwatch_ports, M_TEMP);
+ portwatch_ports = NULL;
+ portwatch_count = 0;
+ }
+ }
+
+ /* Has spawn attr? */
+ if (imgp->ip_px_sa != NULL) {
+ /*
+ * Set the process group ID of the child process; this has
+ * to happen before the image activation.
+ */
+ if (px_sa.psa_flags & POSIX_SPAWN_SETPGROUP) {
+ struct setpgid_args spga;
+ spga.pid = p->p_pid;
+ spga.pgid = px_sa.psa_pgroup;
+ /*
+ * Effectively, call setpgid() system call; works
+ * because there are no pointer arguments.
+ */
+ if((error = setpgid(p, &spga, ival)) != 0)
+ goto bad;
+ }
+
+ /*
+ * Reset UID/GID to parent's RUID/RGID; This works only
+ * because the operation occurs *after* the vfork() and
+ * before the call to exec_handle_sugid() by the image
+ * activator called from exec_activate_image(). POSIX
+ * requires that any setuid/setgid bits on the process
+ * image will take precedence over the spawn attributes
+ * (re)setting them.
+ *
+ * The use of p_ucred is safe, since we are acting on the
+ * new process, and it has no threads other than the one
+ * we are creating for it.
+ */
+ if (px_sa.psa_flags & POSIX_SPAWN_RESETIDS) {
+ kauth_cred_t my_cred = p->p_ucred;
+ kauth_cred_t my_new_cred = kauth_cred_setuidgid(my_cred, kauth_cred_getruid(my_cred), kauth_cred_getrgid(my_cred));
+ if (my_new_cred != my_cred) {
+ p->p_ucred = my_new_cred;
+ /* update cred on proc */
+ PROC_UPDATE_CREDS_ONPROC(p);
+ }
+ }
+
+ /*
+ * Disable ASLR for the spawned process.
+ */
+ /*
+ * But only do so if we are not embedded; embedded allows for a
+ * boot-arg (-disable_aslr) to deal with this (which itself is
+ * only honored on DEVELOPMENT or DEBUG builds of xnu).
+ */
+ if (px_sa.psa_flags & _POSIX_SPAWN_DISABLE_ASLR)
+ OSBitOrAtomic(P_DISABLE_ASLR, &p->p_flag);
+
+ /*
+ * Forcibly disallow execution from data pages for the spawned process
+ * even if it would otherwise be permitted by the architecture default.
+ */
+ if (px_sa.psa_flags & _POSIX_SPAWN_ALLOW_DATA_EXEC)
+ imgp->ip_flags |= IMGPF_ALLOW_DATA_EXEC;
+ }
+
+ /*
+ * Disable ASLR during image activation. This occurs either if the
+ * _POSIX_SPAWN_DISABLE_ASLR attribute was found above or if
+ * P_DISABLE_ASLR was inherited from the parent process.
+ */
+ if (p->p_flag & P_DISABLE_ASLR)
+ imgp->ip_flags |= IMGPF_DISABLE_ASLR;
+
+ /*
+ * Clear transition flag so we won't hang if exec_activate_image() causes
+ * an automount (and launchd does a proc sysctl to service it).
+ *
+ * <rdar://problem/6848672>, <rdar://problem/5959568>.
+ */
+ if (spawn_no_exec) {
+ proc_transend(p, 0);
+ proc_transit_set = 0;
+ }
+
+#if MAC_SPAWN /* XXX */
+ if (uap->mac_p != USER_ADDR_NULL) {
+ error = mac_execve_enter(uap->mac_p, imgp);
+ if (error)
+ goto bad;
+ }
+#endif
+
+ /*
+ * Activate the image
+ */
+ error = exec_activate_image(imgp);
+
+ if (error == 0) {
+ /* process completed the exec */
+ exec_done = TRUE;
+ } else if (error == -1) {
+ /* Image not claimed by any activator? */
+ error = ENOEXEC;
+ }
+
+ /*
+ * If we have a spawn attr, and it contains signal related flags,
+ * the we need to process them in the "context" of the new child
+ * process, so we have to process it following image activation,
+ * prior to making the thread runnable in user space. This is
+ * necessitated by some signal information being per-thread rather
+ * than per-process, and we don't have the new allocation in hand
+ * until after the image is activated.
+ */
+ if (!error && imgp->ip_px_sa != NULL) {
+ thread_t child_thread = current_thread();
+ uthread_t child_uthread = uthread;
+
+ /*
+ * If we created a new child thread, then the thread and
+ * uthread are different than the current ones; otherwise,
+ * we leave them, since we are in the exec case instead.
+ */
+ if (spawn_no_exec) {
+ child_thread = imgp->ip_new_thread;
+ child_uthread = get_bsdthread_info(child_thread);
+ }
+
+ /*
+ * Mask a list of signals, instead of them being unmasked, if
+ * they were unmasked in the parent; note that some signals
+ * are not maskable.
+ */
+ if (px_sa.psa_flags & POSIX_SPAWN_SETSIGMASK)
+ child_uthread->uu_sigmask = (px_sa.psa_sigmask & ~sigcantmask);
+ /*
+ * Default a list of signals instead of ignoring them, if
+ * they were ignored in the parent. Note that we pass
+ * spawn_no_exec to setsigvec() to indicate that we called
+ * fork1() and therefore do not need to call proc_signalstart()
+ * internally.
+ */
+ if (px_sa.psa_flags & POSIX_SPAWN_SETSIGDEF) {
+ vec.sa_handler = SIG_DFL;
+ vec.sa_tramp = 0;
+ vec.sa_mask = 0;
+ vec.sa_flags = 0;
+ for (sig = 0; sig < NSIG; sig++)
+ if (px_sa.psa_sigdefault & (1 << sig)) {
+ error = setsigvec(p, child_thread, sig + 1, &vec, spawn_no_exec);
+ }
+ }
+
+ /*
+ * Activate the CPU usage monitor, if requested. This is done via a task-wide, per-thread CPU
+ * usage limit, which will generate a resource exceeded exception if any one thread exceeds the
+ * limit.
+ *
+ * Userland gives us interval in seconds, and the kernel SPI expects nanoseconds.
+ */
+ if (px_sa.psa_cpumonitor_percent != 0) {
+ /*
+ * Always treat a CPU monitor activation coming from spawn as entitled. Requiring
+ * an entitlement to configure the monitor a certain way seems silly, since
+ * whomever is turning it on could just as easily choose not to do so.
+ *
+ * XXX - Ignore the parameters that we get from userland. The spawnattr method of
+ * activating the monitor always gets the system default parameters. Once we have
+ * an explicit spawn SPI for configuring the defaults, we can revert this to
+ * respect the params passed in from userland.
+ */
+ error = proc_set_task_ruse_cpu(p->task,
+ TASK_POLICY_RESOURCE_ATTRIBUTE_NOTIFY_EXC,
+ PROC_POLICY_CPUMON_DEFAULTS, 0,
+ 0, TRUE);
+ }
+ }
+
+bad:
+
+ if (error == 0) {
+ /* reset delay idle sleep status if set */
+ if ((p->p_flag & P_DELAYIDLESLEEP) == P_DELAYIDLESLEEP)
+ OSBitAndAtomic(~((uint32_t)P_DELAYIDLESLEEP), &p->p_flag);
+ /* upon successful spawn, re/set the proc control state */
+ if (imgp->ip_px_sa != NULL) {
+ switch (px_sa.psa_pcontrol) {
+ case POSIX_SPAWN_PCONTROL_THROTTLE:
+ p->p_pcaction = P_PCTHROTTLE;
+ break;
+ case POSIX_SPAWN_PCONTROL_SUSPEND:
+ p->p_pcaction = P_PCSUSP;
+ break;
+ case POSIX_SPAWN_PCONTROL_KILL:
+ p->p_pcaction = P_PCKILL;
+ break;
+ case POSIX_SPAWN_PCONTROL_NONE:
+ default:
+ p->p_pcaction = 0;
+ break;
+ };
+ }
+ exec_resettextvp(p, imgp);
+
+#if CONFIG_MEMORYSTATUS && CONFIG_JETSAM
+ /* Has jetsam attributes? */
+ if (imgp->ip_px_sa != NULL && (px_sa.psa_jetsam_flags & POSIX_SPAWN_JETSAM_SET)) {
+ memorystatus_update(p, px_sa.psa_priority, 0, (px_sa.psa_jetsam_flags & POSIX_SPAWN_JETSAM_USE_EFFECTIVE_PRIORITY),
+ TRUE, px_sa.psa_high_water_mark, (px_sa.psa_jetsam_flags & POSIX_SPAWN_JETSAM_HIWATER_BACKGROUND),
+ (px_sa.psa_jetsam_flags & POSIX_SPAWN_JETSAM_MEMLIMIT_FATAL));
+ }
+#endif
+ }
+
+ /*
+ * If we successfully called fork1(), we always need to do this;
+ * we identify this case by noting the IMGPF_SPAWN flag. This is
+ * because we come back from that call with signals blocked in the
+ * child, and we have to unblock them, but we want to wait until
+ * after we've performed any spawn actions. This has to happen
+ * before check_for_signature(), which uses psignal.
+ */
+ if (spawn_no_exec) {
+ if (proc_transit_set)
+ proc_transend(p, 0);
+
+ /*
+ * Drop the signal lock on the child which was taken on our
+ * behalf by forkproc()/cloneproc() to prevent signals being
+ * received by the child in a partially constructed state.
+ */
+ proc_signalend(p, 0);
+
+ /* flag the 'fork' has occurred */
+ proc_knote(p->p_pptr, NOTE_FORK | p->p_pid);
+ /* then flag exec has occurred */
+ /* notify only if it has not failed due to FP Key error */
+ if ((p->p_lflag & P_LTERM_DECRYPTFAIL) == 0)
+ proc_knote(p, NOTE_EXEC);
+ } else {
+ /* reset the importance attribute from our previous life */
+ task_importance_reset(p->task);
+
+ /* reset atm context from task */
+ task_atm_reset(p->task);
+ }
+
+ /*
+ * Apply the spawnattr policy, apptype (which primes the task for importance donation),
+ * and bind any portwatch ports to the new task.
+ * This must be done after the exec so that the child's thread is ready,
+ * and after the in transit state has been released, because priority is
+ * dropped here so we need to be prepared for a potentially long preemption interval
+ *
+ * TODO: Consider splitting this up into separate phases
+ */
+ if (error == 0 && imgp->ip_px_sa != NULL) {
+ struct _posix_spawnattr *psa = (struct _posix_spawnattr *) imgp->ip_px_sa;
+
+ exec_handle_spawnattr_policy(p, psa->psa_apptype, psa->psa_qos_clamp,
+ portwatch_ports, portwatch_count);
+ }
+
+ /* Apply the main thread qos */
+ if (error == 0) {
+ thread_t main_thread = (imgp->ip_new_thread != NULL) ? imgp->ip_new_thread : current_thread();
+
+ task_set_main_thread_qos(p->task, main_thread);
+ }
+
+ /*
+ * Release any ports we kept around for binding to the new task
+ * We need to release the rights even if the posix_spawn has failed.
+ */
+ if (portwatch_ports != NULL) {
+ for (int i = 0; i < portwatch_count; i++) {
+ ipc_port_t port = NULL;
+ if ((port = portwatch_ports[i]) != NULL) {
+ ipc_port_release_send(port);
+ }
+ }
+ FREE(portwatch_ports, M_TEMP);
+ portwatch_ports = NULL;
+ portwatch_count = 0;
+ }
+
+ /*
+ * We have to delay operations which might throw a signal until after
+ * the signals have been unblocked; however, we want that to happen
+ * after exec_resettextvp() so that the textvp is correct when they
+ * fire.
+ */
+ if (error == 0) {
+ error = check_for_signature(p, imgp);
+
+ /*
+ * Pay for our earlier safety; deliver the delayed signals from
+ * the incomplete spawn process now that it's complete.
+ */
+ if (imgp != NULL && spawn_no_exec && (p->p_lflag & P_LTRACED)) {
+ psignal_vfork(p, p->task, imgp->ip_new_thread, SIGTRAP);
+ }
+ }
+
+
+ if (imgp != NULL) {
+ if (imgp->ip_vp)
+ vnode_put(imgp->ip_vp);
+ if (imgp->ip_scriptvp)
+ vnode_put(imgp->ip_scriptvp);
+ if (imgp->ip_strings)
+ execargs_free(imgp);
+ if (imgp->ip_px_sfa != NULL)
+ FREE(imgp->ip_px_sfa, M_TEMP);
+ if (imgp->ip_px_spa != NULL)
+ FREE(imgp->ip_px_spa, M_TEMP);
+
+#if CONFIG_MACF
+ if (imgp->ip_px_smpx != NULL)
+ spawn_free_macpolicyinfo(imgp->ip_px_smpx);
+ if (imgp->ip_execlabelp)
+ mac_cred_label_free(imgp->ip_execlabelp);
+ if (imgp->ip_scriptlabelp)
+ mac_vnode_label_free(imgp->ip_scriptlabelp);
+#endif
+ }
+
+#if CONFIG_DTRACE
+ if (spawn_no_exec) {
+ /*
+ * In the original DTrace reference implementation,
+ * posix_spawn() was a libc routine that just
+ * did vfork(2) then exec(2). Thus the proc::: probes
+ * are very fork/exec oriented. The details of this
+ * in-kernel implementation of posix_spawn() is different
+ * (while producing the same process-observable effects)
+ * particularly w.r.t. errors, and which thread/process
+ * is constructing what on behalf of whom.
+ */
+ if (error) {
+ DTRACE_PROC1(spawn__failure, int, error);
+ } else {
+ DTRACE_PROC(spawn__success);
+ /*
+ * Some DTrace scripts, e.g. newproc.d in
+ * /usr/bin, rely on the the 'exec-success'
+ * probe being fired in the child after the
+ * new process image has been constructed
+ * in order to determine the associated pid.
+ *
+ * So, even though the parent built the image
+ * here, for compatibility, mark the new thread
+ * so 'exec-success' fires on it as it leaves
+ * the kernel.
+ */
+ dtrace_thread_didexec(imgp->ip_new_thread);
+ }
+ } else {
+ if (error) {
+ DTRACE_PROC1(exec__failure, int, error);
+ } else {
+ DTRACE_PROC(exec__success);
+ }
+ }
+
+ if ((dtrace_proc_waitfor_hook = dtrace_proc_waitfor_exec_ptr) != NULL)
+ (*dtrace_proc_waitfor_hook)(p);
+#endif
+
+ /* Return to both the parent and the child? */
+ if (imgp != NULL && spawn_no_exec) {
+ /*
+ * If the parent wants the pid, copy it out
+ */
+ if (pid != USER_ADDR_NULL)
+ (void)suword(pid, p->p_pid);
+ retval[0] = error;
+
+ /*
+ * If we had an error, perform an internal reap ; this is
+ * entirely safe, as we have a real process backing us.
+ */
+ if (error) {
+ proc_list_lock();
+ p->p_listflag |= P_LIST_DEADPARENT;
+ proc_list_unlock();
+ proc_lock(p);
+ /* make sure no one else has killed it off... */
+ if (p->p_stat != SZOMB && p->exit_thread == NULL) {
+ p->exit_thread = current_thread();
+ proc_unlock(p);
+ exit1(p, 1, (int *)NULL);
+ if (exec_done == FALSE) {
+ task_deallocate(get_threadtask(imgp->ip_new_thread));
+ thread_deallocate(imgp->ip_new_thread);
+ }
+ } else {
+ /* someone is doing it for us; just skip it */
+ proc_unlock(p);
+ }
+ } else {
+
+ /*
+ * Return to the child
+ *
+ * Note: the image activator earlier dropped the
+ * task/thread references to the newly spawned
+ * process; this is OK, since we still have suspended
+ * queue references on them, so we should be fine
+ * with the delayed resume of the thread here.
+ */
+ (void)thread_resume(imgp->ip_new_thread);
+ }
+ }
+ if (bufp != NULL) {
+ FREE(bufp, M_TEMP);
+ }
+
+ return(error);
+}
+
+
+/*
+ * execve
+ *
+ * Parameters: uap->fname File name to exec
+ * uap->argp Argument list
+ * uap->envp Environment list
+ *
+ * Returns: 0 Success
+ * __mac_execve:EINVAL Invalid argument
+ * __mac_execve:ENOTSUP Invalid argument
+ * __mac_execve:EACCES Permission denied
+ * __mac_execve:EINTR Interrupted function
+ * __mac_execve:ENOMEM Not enough space
+ * __mac_execve:EFAULT Bad address
+ * __mac_execve:ENAMETOOLONG Filename too long
+ * __mac_execve:ENOEXEC Executable file format error
+ * __mac_execve:ETXTBSY Text file busy [misuse of error code]
+ * __mac_execve:???
+ *
+ * TODO: Dynamic linker header address on stack is copied via suword()
+ */
+/* ARGSUSED */
+int
+execve(proc_t p, struct execve_args *uap, int32_t *retval)
+{
+ struct __mac_execve_args muap;
+ int err;
+
+ memoryshot(VM_EXECVE, DBG_FUNC_NONE);
+
+ muap.fname = uap->fname;
+ muap.argp = uap->argp;
+ muap.envp = uap->envp;
+ muap.mac_p = USER_ADDR_NULL;
+ err = __mac_execve(p, &muap, retval);
+
+ return(err);
+}
+
+/*
+ * __mac_execve
+ *
+ * Parameters: uap->fname File name to exec
+ * uap->argp Argument list
+ * uap->envp Environment list
+ * uap->mac_p MAC label supplied by caller
+ *
+ * Returns: 0 Success
+ * EINVAL Invalid argument
+ * ENOTSUP Not supported
+ * ENOEXEC Executable file format error
+ * exec_activate_image:EINVAL Invalid argument
+ * exec_activate_image:EACCES Permission denied
+ * exec_activate_image:EINTR Interrupted function
+ * exec_activate_image:ENOMEM Not enough space
+ * exec_activate_image:EFAULT Bad address
+ * exec_activate_image:ENAMETOOLONG Filename too long
+ * exec_activate_image:ENOEXEC Executable file format error
+ * exec_activate_image:ETXTBSY Text file busy [misuse of error code]
+ * exec_activate_image:EBADEXEC The executable is corrupt/unknown
+ * exec_activate_image:???
+ * mac_execve_enter:???
+ *
+ * TODO: Dynamic linker header address on stack is copied via suword()
+ */
+int
+__mac_execve(proc_t p, struct __mac_execve_args *uap, int32_t *retval)
+{
+ char *bufp = NULL;
+ struct image_params *imgp;
+ struct vnode_attr *vap;
+ struct vnode_attr *origvap;
+ int error;
+ char alt_p_comm[sizeof(p->p_comm)] = {0}; /* for PowerPC */
+ int is_64 = IS_64BIT_PROCESS(p);
+ struct vfs_context context;
+ struct uthread *uthread;
+
+ context.vc_thread = current_thread();
+ context.vc_ucred = kauth_cred_proc_ref(p); /* XXX must NOT be kauth_cred_get() */
+
+ /* Allocate a big chunk for locals instead of using stack since these
+ * structures a pretty big.
+ */
+ MALLOC(bufp, char *, (sizeof(*imgp) + sizeof(*vap) + sizeof(*origvap)), M_TEMP, M_WAITOK | M_ZERO);
+ imgp = (struct image_params *) bufp;
+ if (bufp == NULL) {
+ error = ENOMEM;
+ goto exit_with_error;
+ }
+ vap = (struct vnode_attr *) (bufp + sizeof(*imgp));
+ origvap = (struct vnode_attr *) (bufp + sizeof(*imgp) + sizeof(*vap));
+
+ /* Initialize the common data in the image_params structure */
+ imgp->ip_user_fname = uap->fname;
+ imgp->ip_user_argv = uap->argp;
+ imgp->ip_user_envv = uap->envp;
+ imgp->ip_vattr = vap;
+ imgp->ip_origvattr = origvap;
+ imgp->ip_vfs_context = &context;
+ imgp->ip_flags = (is_64 ? IMGPF_WAS_64BIT : IMGPF_NONE) | ((p->p_flag & P_DISABLE_ASLR) ? IMGPF_DISABLE_ASLR : IMGPF_NONE);
+ imgp->ip_p_comm = alt_p_comm; /* for PowerPC */
+ imgp->ip_seg = (is_64 ? UIO_USERSPACE64 : UIO_USERSPACE32);
+ imgp->ip_mac_return = 0;
projects / apple / xnu.git / blobdiff