1/* Copyright (C) 1993-2023 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
8
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
13
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <https://www.gnu.org/licenses/>.
17
18 As a special exception, if you link the code in this file with
19 files compiled with a GNU compiler to produce an executable,
20 that does not cause the resulting executable to be covered by
21 the GNU Lesser General Public License. This exception does not
22 however invalidate any other reasons why the executable file
23 might be covered by the GNU Lesser General Public License.
24 This exception applies to code released by its copyright holders
25 in files containing the exception. */
26
27#include "libioP.h"
28#include <fcntl.h>
29#include <signal.h>
30#include <unistd.h>
31#include <stdlib.h>
32#include <shlib-compat.h>
33#include <not-cancel.h>
34#include <sys/types.h>
35#include <sys/wait.h>
36#include <spawn.h>
37#include <paths.h>
38
39struct _IO_proc_file
40{
41 struct _IO_FILE_plus file;
42 /* Following fields must match those in class procbuf (procbuf.h) */
43 pid_t pid;
44 struct _IO_proc_file *next;
45};
46typedef struct _IO_proc_file _IO_proc_file;
47
48static struct _IO_proc_file *proc_file_chain;
49
50#ifdef _IO_MTSAFE_IO
51static _IO_lock_t proc_file_chain_lock = _IO_lock_initializer;
52
53static void
54unlock (void *not_used)
55{
56 _IO_lock_unlock (proc_file_chain_lock);
57}
58#endif
59
60/* POSIX states popen shall ensure that any streams from previous popen()
61 calls that remain open in the parent process should be closed in the new
62 child process.
63 To avoid a race-condition between checking which file descriptors need to
64 be close (by transversing the proc_file_chain list) and the insertion of a
65 new one after a successful posix_spawn this function should be called
66 with proc_file_chain_lock acquired. */
67static int
68spawn_process (posix_spawn_file_actions_t *fa, FILE *fp, const char *command,
69 int do_cloexec, int pipe_fds[2], int parent_end, int child_end,
70 int child_pipe_fd)
71{
72 int err = 0;
73
74 for (struct _IO_proc_file *p = proc_file_chain; p; p = p->next)
75 {
76 int fd = _IO_fileno ((FILE *) p);
77
78 /* If any stream from previous popen() calls has fileno
79 child_pipe_fd, it has been already closed by the adddup2 action
80 above. */
81 if (fd != child_pipe_fd)
82 {
83 err = __posix_spawn_file_actions_addclose (fa, fd);
84 if (err != 0)
85 return err;
86 }
87 }
88
89 err = __posix_spawn (&((_IO_proc_file *) fp)->pid, _PATH_BSHELL, fa, 0,
90 (char *const[]){ (char*) "sh", (char*) "-c", (char*) "--",
91 (char *) command, NULL }, __environ);
92 if (err != 0)
93 return err;
94
95 __close_nocancel (pipe_fds[child_end]);
96
97 if (!do_cloexec)
98 /* Undo the effects of the pipe2 call which set the
99 close-on-exec flag. */
100 __fcntl (pipe_fds[parent_end], F_SETFD, 0);
101
102 _IO_fileno (fp) = pipe_fds[parent_end];
103
104 ((_IO_proc_file *) fp)->next = proc_file_chain;
105 proc_file_chain = (_IO_proc_file *) fp;
106
107 return 0;
108}
109
110FILE *
111_IO_new_proc_open (FILE *fp, const char *command, const char *mode)
112{
113 int read_or_write;
114 /* These are indexes for pipe_fds. */
115 int parent_end, child_end;
116 int pipe_fds[2];
117 int child_pipe_fd;
118 int err;
119
120 int do_read = 0;
121 int do_write = 0;
122 int do_cloexec = 0;
123 while (*mode != '\0')
124 switch (*mode++)
125 {
126 case 'r':
127 do_read = 1;
128 break;
129 case 'w':
130 do_write = 1;
131 break;
132 case 'e':
133 do_cloexec = 1;
134 break;
135 default:
136 errout:
137 __set_errno (EINVAL);
138 return NULL;
139 }
140
141 if ((do_read ^ do_write) == 0)
142 goto errout;
143
144 if (_IO_file_is_open (fp))
145 return NULL;
146
147 /* Atomically set the O_CLOEXEC flag for the pipe end used by the
148 child process (to avoid leaking the file descriptor in case of a
149 concurrent fork). This is later reverted in the child process.
150 When popen returns, the parent pipe end can be O_CLOEXEC or not,
151 depending on the 'e' open mode, but there is only one flag which
152 controls both descriptors. The parent end is adjusted below,
153 after creating the child process. (In the child process, the
154 parent end should be closed on execve, so O_CLOEXEC remains set
155 there.) */
156 if (__pipe2 (pipe_fds, O_CLOEXEC) < 0)
157 return NULL;
158
159 if (do_read)
160 {
161 parent_end = 0;
162 child_end = 1;
163 read_or_write = _IO_NO_WRITES;
164 child_pipe_fd = 1;
165 }
166 else
167 {
168 parent_end = 1;
169 child_end = 0;
170 read_or_write = _IO_NO_READS;
171 child_pipe_fd = 0;
172 }
173
174 posix_spawn_file_actions_t fa;
175 /* posix_spawn_file_actions_init does not fail. */
176 __posix_spawn_file_actions_init (&fa);
177
178 /* The descriptor is already the one the child will use. In this case
179 it must be moved to another one otherwise, there is no safe way to
180 remove the close-on-exec flag in the child without creating a FD leak
181 race in the parent. */
182 if (pipe_fds[child_end] == child_pipe_fd)
183 {
184 int tmp = __fcntl (child_pipe_fd, F_DUPFD_CLOEXEC, 0);
185 if (tmp < 0)
186 goto spawn_failure;
187 __close_nocancel (pipe_fds[child_end]);
188 pipe_fds[child_end] = tmp;
189 }
190
191 err = __posix_spawn_file_actions_adddup2 (&fa, pipe_fds[child_end],
192 child_pipe_fd);
193 if (err != 0)
194 goto spawn_failure;
195
196#ifdef _IO_MTSAFE_IO
197 _IO_cleanup_region_start_noarg (unlock);
198 _IO_lock_lock (proc_file_chain_lock);
199#endif
200 err = spawn_process (&fa, fp, command, do_cloexec, pipe_fds, parent_end,
201 child_end, child_pipe_fd);
202#ifdef _IO_MTSAFE_IO
203 _IO_lock_unlock (proc_file_chain_lock);
204 _IO_cleanup_region_end (0);
205#endif
206
207 __posix_spawn_file_actions_destroy (&fa);
208
209 if (err != 0)
210 {
211 __set_errno (err);
212 spawn_failure:
213 __close_nocancel (pipe_fds[child_end]);
214 __close_nocancel (pipe_fds[parent_end]);
215 return NULL;
216 }
217
218 _IO_mask_flags (fp, read_or_write, _IO_NO_READS|_IO_NO_WRITES);
219 return fp;
220}
221
222FILE *
223_IO_new_popen (const char *command, const char *mode)
224{
225 struct locked_FILE
226 {
227 struct _IO_proc_file fpx;
228#ifdef _IO_MTSAFE_IO
229 _IO_lock_t lock;
230#endif
231 } *new_f;
232 FILE *fp;
233
234 new_f = (struct locked_FILE *) malloc (sizeof (struct locked_FILE));
235 if (new_f == NULL)
236 return NULL;
237#ifdef _IO_MTSAFE_IO
238 new_f->fpx.file.file._lock = &new_f->lock;
239#endif
240 fp = &new_f->fpx.file.file;
241 _IO_init_internal (fp, 0);
242 _IO_JUMPS (&new_f->fpx.file) = &_IO_proc_jumps;
243 _IO_new_file_init_internal (&new_f->fpx.file);
244 if (_IO_new_proc_open (fp, command, mode) != NULL)
245 return (FILE *) &new_f->fpx.file;
246 _IO_un_link (&new_f->fpx.file);
247 free (new_f);
248 return NULL;
249}
250
251int
252_IO_new_proc_close (FILE *fp)
253{
254 /* This is not name-space clean. FIXME! */
255 int wstatus;
256 _IO_proc_file **ptr = &proc_file_chain;
257 pid_t wait_pid;
258 int status = -1;
259
260 /* Unlink from proc_file_chain. */
261#ifdef _IO_MTSAFE_IO
262 _IO_cleanup_region_start_noarg (unlock);
263 _IO_lock_lock (proc_file_chain_lock);
264#endif
265 for ( ; *ptr != NULL; ptr = &(*ptr)->next)
266 {
267 if (*ptr == (_IO_proc_file *) fp)
268 {
269 *ptr = (*ptr)->next;
270 status = 0;
271 break;
272 }
273 }
274#ifdef _IO_MTSAFE_IO
275 _IO_lock_unlock (proc_file_chain_lock);
276 _IO_cleanup_region_end (0);
277#endif
278
279 if (status < 0 || __close_nocancel (_IO_fileno(fp)) < 0)
280 return -1;
281 /* POSIX.2 Rationale: "Some historical implementations either block
282 or ignore the signals SIGINT, SIGQUIT, and SIGHUP while waiting
283 for the child process to terminate. Since this behavior is not
284 described in POSIX.2, such implementations are not conforming." */
285 do
286 {
287 int state;
288 __pthread_setcancelstate (PTHREAD_CANCEL_DISABLE, &state);
289 wait_pid = __waitpid (((_IO_proc_file *) fp)->pid, &wstatus, 0);
290 __pthread_setcancelstate (state, NULL);
291 }
292 while (wait_pid == -1 && errno == EINTR);
293 if (wait_pid == -1)
294 return -1;
295 return wstatus;
296}
297
298strong_alias (_IO_new_popen, __new_popen)
299versioned_symbol (libc, _IO_new_popen, _IO_popen, GLIBC_2_1);
300versioned_symbol (libc, __new_popen, popen, GLIBC_2_1);
301versioned_symbol (libc, _IO_new_proc_open, _IO_proc_open, GLIBC_2_1);
302versioned_symbol (libc, _IO_new_proc_close, _IO_proc_close, GLIBC_2_1);
303