mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-26 23:10:06 +00:00
882d6e17bc
This patch adds a way to close a range of file descriptors on posix_spawn as a new file action. The API is similar to the one provided by Solaris 11 [1], where the file action causes the all open file descriptors greater than or equal to input on to be closed when the new process is spawned. The function posix_spawn_file_actions_addclosefrom_np is safe to be implemented by iterating over /proc/self/fd, since the Linux spawni.c helper process does not use CLONE_FILES, so its has own file descriptor table and any failure (in /proc operation) aborts the process creation and returns an error to the caller. I am aware that this file action might be redundant to the current approach of POSIX in promoting O_CLOEXEC in more interfaces. However O_CLOEXEC is still not the default and for some specific usages, the caller needs to close all possible file descriptors to avoid them leaking. Some examples are CPython (discussed in BZ#10353) and OpenJDK jspawnhelper [2] (where OpenJDK spawns a helper process to exactly closes all file descriptors). Most likely any environment which calls functions that might open file descriptor under the hood and aim to use posix_spawn might face the same requirement. Checked on x86_64-linux-gnu and i686-linux-gnu on kernel 5.11 and 4.15. [1] https://docs.oracle.com/cd/E36784_01/html/E36874/posix-spawn-file-actions-addclosefrom-np-3c.html [2] https://github.com/openjdk/jdk/blob/master/src/java.base/unix/native/libjava/childproc.c#L82
100 lines
3.1 KiB
C
100 lines
3.1 KiB
C
/* Close a range of file descriptors. Linux version.
|
|
Copyright (C) 2021 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<https://www.gnu.org/licenses/>. */
|
|
|
|
#include <arch-fd_to_filename.h>
|
|
#include <dirent.h>
|
|
#include <not-cancel.h>
|
|
#include <stdbool.h>
|
|
|
|
/* Fallback code: iterates over /proc/self/fd, closing each file descriptor
|
|
that fall on the criteria. If DIRFD_FALLBACK is set, a failure on
|
|
/proc/self/fd open will trigger a fallback that tries to close a file
|
|
descriptor before proceed. */
|
|
_Bool
|
|
__closefrom_fallback (int from, _Bool dirfd_fallback)
|
|
{
|
|
bool ret = false;
|
|
|
|
int dirfd = __open_nocancel (FD_TO_FILENAME_PREFIX, O_RDONLY | O_DIRECTORY,
|
|
0);
|
|
if (dirfd == -1)
|
|
{
|
|
/* The closefrom should work even when process can't open new files. */
|
|
if (errno == ENOENT || !dirfd_fallback)
|
|
goto err;
|
|
|
|
for (int i = from; i < INT_MAX; i++)
|
|
{
|
|
int r = __close_nocancel (i);
|
|
if (r == 0 || (r == -1 && errno != EBADF))
|
|
break;
|
|
}
|
|
|
|
dirfd = __open_nocancel (FD_TO_FILENAME_PREFIX, O_RDONLY | O_DIRECTORY,
|
|
0);
|
|
if (dirfd == -1)
|
|
goto err;
|
|
}
|
|
|
|
char buffer[1024];
|
|
while (true)
|
|
{
|
|
ssize_t ret = __getdents64 (dirfd, buffer, sizeof (buffer));
|
|
if (ret == -1)
|
|
goto err;
|
|
else if (ret == 0)
|
|
break;
|
|
|
|
/* If any file descriptor is closed it resets the /proc/self position
|
|
read again from the start (to obtain any possible kernel update). */
|
|
bool closed = false;
|
|
char *begin = buffer, *end = buffer + ret;
|
|
while (begin != end)
|
|
{
|
|
unsigned short int d_reclen;
|
|
memcpy (&d_reclen, begin + offsetof (struct dirent64, d_reclen),
|
|
sizeof (d_reclen));
|
|
const char *dname = begin + offsetof (struct dirent64, d_name);
|
|
begin += d_reclen;
|
|
|
|
if (dname[0] == '.')
|
|
continue;
|
|
|
|
int fd = 0;
|
|
for (const char *s = dname; (unsigned int) (*s) - '0' < 10; s++)
|
|
fd = 10 * fd + (*s - '0');
|
|
|
|
if (fd == dirfd || fd < from)
|
|
continue;
|
|
|
|
/* We ignore close errors because EBADF, EINTR, and EIO means the
|
|
descriptor has been released. */
|
|
__close_nocancel (fd);
|
|
closed = true;
|
|
}
|
|
|
|
if (closed && __lseek (dirfd, 0, SEEK_SET) < 0)
|
|
goto err;
|
|
}
|
|
|
|
ret = true;
|
|
err:
|
|
__close_nocancel (dirfd);
|
|
return ret;
|
|
}
|