// Copyright 2012 Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above copyright
// notice, this list of conditions and the following disclaimer in the
// documentation and/or other materials provided with the distribution.
// * Neither the name of Google Inc. nor the names of its contributors
// may be used to endorse or promote products derived from this software
// without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#if defined(HAVE_CONFIG_H)
# include "config.h"
#endif
#include "run.h"
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <assert.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "defs.h"
#include "env.h"
#include "error.h"
#include "fs.h"
#include "text.h"
/// Path to the temporary work directory to use.
const char* kyua_run_tmpdir = KYUA_TMPDIR;
#undef KYUA_TMPDIR // We really want to use the variable, not the macro.
/// Whether we got a signal or not.
static volatile bool signal_fired = false;
/// Whether the process timed out or not.
static volatile bool process_timed_out = false;
/// If not -1, PID of the process to forcibly kill when we get a signal.
///
/// Must be protected by protect() and unprotect().
static volatile pid_t pid_to_kill = -1;
/// Whether we are holding signals or not.
static bool protected = false;
/// Magic exit code to denote an error while preparing the subprocess.
static const int exit_setup_child = 124;
/// Magic exit code to denote an error in exec(3) that we do not handle.
static const int exit_exec_unknown = 123;
/// Magic exit code to denote an EACCES error in exec(3).
static const int exit_exec_eacces = 122;
/// Magic exit code to denote an ENOENT error in exec(3).
static const int exit_exec_enoent = 121;
/// Area to save the original SIGHUP handler.
static struct sigaction old_sighup;
/// Area to save the original SIGINT handler.
static struct sigaction old_sigint;
/// Area to save the original SIGTERM handler.
static struct sigaction old_sigterm;
/// Area to save the original SIGALRM handler.
static struct sigaction old_sigalrm;
/// Area to save the original realtime timer.
static struct itimerval old_timer;
/// Masks or unmasks all the signals programmed by this module.
///
/// \param operation One of SIG_BLOCK or SIG_UNBLOCK.
static void
mask_handlers(const int operation)
{
sigset_t mask;
sigemptyset(&mask);
sigaddset(&mask, SIGALRM);
sigaddset(&mask, SIGINT);
sigaddset(&mask, SIGHUP);
sigaddset(&mask, SIGTERM);
const int ret = sigprocmask(operation, &mask, NULL);
assert(ret != -1);
}
/// Masks all signals programmed by this module.
static void
protect(void)
{
mask_handlers(SIG_BLOCK);
protected = true;
}
/// Unmasks all signals programmed by this module.
static void
unprotect(void)
{
protected = false;
mask_handlers(SIG_UNBLOCK);
}
/// Handler for signals that should abort execution.
///
/// When called the first time, this handler kills any running subprocess so
/// that the cleanup routines can proceed. Calling this a second time aborts
/// execution of the program.
///
/// \param unused_signo Number of the captured signal.
static void
cleanup_handler(const int KYUA_DEFS_UNUSED_PARAM(signo))
{
static const char* clean_message = "Signal caught; cleaning up...\n";
static const char* abort_message = "Double signal caught; aborting...\n";
protect();
if (!signal_fired) {
signal_fired = true;
if (write(STDERR_FILENO, clean_message, strlen(clean_message)) == -1) {
// Ignore.
}
if (pid_to_kill != -1) {
kill(pid_to_kill, SIGKILL);
pid_to_kill = -1;
}
unprotect();
} else {
if (write(STDERR_FILENO, abort_message, strlen(abort_message)) == -1) {
// Ignore.
}
if (pid_to_kill != -1) {
kill(pid_to_kill, SIGKILL);
pid_to_kill = -1;
}
abort();
}
}
/// Handler for signals that should terminate the active subprocess.
///
/// \param unused_signo Number of the captured signal.
static void
timeout_handler(const int KYUA_DEFS_UNUSED_PARAM(signo))
{
static const char* message = "Subprocess timed out; sending KILL "
"signal...\n";
protect();
process_timed_out = true;
if (write(STDERR_FILENO, message, strlen(message)) == -1) {
// Ignore.
}
if (pid_to_kill != -1) {
kill(pid_to_kill, SIGKILL);
pid_to_kill = -1;
}
unprotect();
}
/// Installs a signal handler.
///
/// \param signo Number of the signal to program.
/// \param handler Handler for the signal.
/// \param [out] old_sa Pointer to the sigaction structure in which to save the
/// current signal handler data.
static void
setup_signal(const int signo, void (*handler)(const int),
struct sigaction* old_sa)
{
struct sigaction sa;
sa.sa_handler = handler;
sigemptyset(&sa.sa_mask);
sa.sa_flags = SA_RESTART;
const int ret = sigaction(signo, &sa, old_sa);
assert(ret != -1);
}
/// Installs a timer.
///
/// \param seconds Deadline for the timer.
/// \param [out] old_itimerval Pointer to the itimerval structure in which to
/// save the current timer data into.
static void
setup_timer(const int seconds, struct itimerval* old_itimerval)
{
struct itimerval new_timer;
new_timer.it_interval.tv_sec = 0;
new_timer.it_interval.tv_usec = 0;
new_timer.it_value.tv_sec = seconds;
new_timer.it_value.tv_usec = 0;
const int ret = setitimer(ITIMER_REAL, &new_timer, old_itimerval);
assert(ret != -1);
}
/// Resets the environment of the process to a known state.
///
/// \param work_directory Path to the work directory being used.
///
/// \return An error if there is a problem configuring the environment
/// variables, or OK if successful. Note that if this returns an error, we have
/// left the environment in an inconsistent state.
static kyua_error_t
prepare_environment(const char* work_directory)
{
kyua_error_t error;
// TODO(jmmv): It might be better to do the opposite: just pass a good known
// set of variables to the child (aka HOME, PATH, ...). But how do we
// determine this minimum set?
const char* to_unset[] = { "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE",
"LC_MESSAGES", "LC_MONETARY", "LC_NUMERIC",
"LC_TIME", NULL };
const char** iter;
for (iter = to_unset; *iter != NULL; ++iter) {
error = kyua_env_unset(*iter);
if (kyua_error_is_set(error))
return error;
}
error = kyua_env_set("HOME", work_directory);
if (kyua_error_is_set(error))
return error;
error = kyua_env_set("TZ", "UTC");
if (kyua_error_is_set(error))
return error;
error = kyua_env_set("__RUNNING_INSIDE_ATF_RUN", "internal-yes-value");
if (kyua_error_is_set(error))
return error;
assert(!kyua_error_is_set(error));
return error;
}
/// Resets all signals to their default handlers.
static void
reset_signals(void)
{
int signo;
for (signo = 1; signo <= LAST_SIGNO; ++signo) {
if (signo == SIGKILL || signo == SIGSTOP) {
// Don't attempt to reset immutable signals.
continue;
}
struct sigaction sa;
sa.sa_handler = SIG_DFL;
sigemptyset(&sa.sa_mask);
sa.sa_flags = 0;
(void)sigaction(signo, &sa, NULL);
}
}
/// Raises core size limit to its possible maximum.
///
/// This is a best-effort operation. There is no guarantee that the operation
/// will yield a large-enough limit to generate any possible core file.
static void
unlimit_core_size(void)
{
struct rlimit rl;
{
const int ret = getrlimit(RLIMIT_CORE, &rl);
assert(ret != -1);
}
rl.rlim_cur = rl.rlim_max;
const int ret = setrlimit(RLIMIT_CORE, &rl) != -1;
assert(ret != -1);
}
/// Cleans up the container process to run a new child.
///
/// If there is any error during the setup, the new process is terminated
/// with an error code.
///
/// \param run_params End-user parameters that describe how to isolate the
/// newly-created process.
static void
setup_child(const kyua_run_params_t* run_params)
{
setpgid(getpid(), getpid());
if (chdir(run_params->work_directory) == -1)
err(exit_setup_child, "chdir(%s) failed", run_params->work_directory);
unlimit_core_size();
reset_signals();
const kyua_error_t error = prepare_environment(run_params->work_directory);
if (kyua_error_is_set(error))
kyua_error_err(exit_setup_child, error, "Failed to configure the "
"environment");
(void)umask(0022);
if (run_params->unprivileged_group != getgid()) {
if (setgid(run_params->unprivileged_group) == -1)
err(exit_setup_child, "setgid(%ld) failed; uid is %ld and gid "
"is %ld", (long int)run_params->unprivileged_group,
(long int)getuid(), (long int)getgid());
}
if (run_params->unprivileged_user != getuid()) {
if (setuid(run_params->unprivileged_user) == -1)
err(exit_setup_child, "setuid(%ld) failed; uid is %ld and gid "
"is %ld", (long int)run_params->unprivileged_user,
(long int)getuid(), (long int)getgid());
}
}
/// Constructs a path to a work directory based on a template.
///
/// \param template Template of the work directory to create. Should be a
/// basename and must include the XXXXXX placeholder string. The directory
/// is created within the temporary directory specified by the TMPDIR
/// environment variable or the builtin value in kyua_run_tmpdir.
/// \param [out] work_directory Pointer to a dynamically-allocated string
/// containing the full path to the work directory. The caller is
/// responsible for releasing this string.
///
/// \return An error if there is a problem (most likely OOM), or OK otherwise.
static kyua_error_t
build_work_directory_path(const char* template, char** work_directory)
{
assert(strstr(template, "XXXXXX") != NULL);
const char* tmpdir = getenv("TMPDIR");
if (tmpdir == NULL)
return kyua_text_printf(work_directory, "%s/%s", kyua_run_tmpdir,
template);
else
return kyua_text_printf(work_directory, "%s/%s", tmpdir, template);
}
/// Initializes the run_params parameters with default values.
///
/// \param [out] run_params The object to initialize.
void
kyua_run_params_init(kyua_run_params_t* run_params)
{
run_params->timeout_seconds = 60;
run_params->unprivileged_user = getuid();
run_params->unprivileged_group = getgid();
run_params->work_directory = ".";
}
/// Executes a program and exits if there is a problem.
///
/// This routine is supposed to be used in conjunction with kyua_run_fork and
/// kyua_run_wait so that the various return codes of the exec system call are
/// properly propagated to the parent process.
///
/// \param program Path to the program to run.
/// \param args Arguments to the program.
void
kyua_run_exec(const char* program, const char* const* args)
{
(void)execvp(program, KYUA_DEFS_UNCONST(args));
switch (errno) {
case EACCES:
exit(exit_exec_eacces);
case ENOENT:
exit(exit_exec_enoent);
default:
err(exit_exec_unknown, "execvp failed");
}
}
/// Forks and isolates the child process.
///
/// The created subprocess must be waited for with kyua_run_wait().
///
/// \param run_params Parameters that describe how to isolate the newly-created
/// process.
/// \param [out] out_pid The PID of the child in the parent, or 0 in the child.
/// The value left here should only be accessed if this function does not
/// return an error.
///
/// \return An error object if fork(2) fails.
kyua_error_t
kyua_run_fork(const kyua_run_params_t* run_params, pid_t* const out_pid)
{
protect();
pid_t pid = fork();
if (pid == -1) {
unprotect();
*out_pid = pid; // Not necessary, but avoid mistakes in the caller.
return kyua_libc_error_new(errno, "fork failed");
} else if (pid == 0) {
unprotect();
setup_child(run_params);
*out_pid = pid;
return kyua_error_ok();
} else {
pid_to_kill = pid;
unprotect();
setup_signal(SIGALRM, timeout_handler, &old_sigalrm);
process_timed_out = false;
setup_timer(run_params->timeout_seconds, &old_timer);
*out_pid = pid;
return kyua_error_ok();
}
}
/// Waits for a process started via kyua_run_fork.
///
/// \param pid The PID of the child to wait for.
/// \param [out] status The exit status of the awaited process.
/// \param [out] timed_out Whether the process timed out or not.
///
/// \return An error if the process failed due to an problem in kyua_run_exec.
/// However, note that the wait for the process itself is expected to have been
/// successful.
kyua_error_t
kyua_run_wait(const pid_t pid, int* status, bool* timed_out)
{
int tmp_status;
const pid_t waited_pid = waitpid(pid, &tmp_status, 0);
assert(pid == waited_pid);
protect();
(void)setitimer(ITIMER_REAL, &old_timer, NULL);
(void)sigaction(SIGALRM, &old_sigalrm, NULL);
pid_to_kill = -1;
unprotect();
killpg(pid, SIGKILL);
if (WIFEXITED(tmp_status)) {
if (WEXITSTATUS(tmp_status) == exit_setup_child) {
return kyua_generic_error_new("Failed to isolate subprocess; "
"see stderr for details");
} else if (WEXITSTATUS(tmp_status) == exit_exec_eacces) {
return kyua_libc_error_new(EACCES, "execvp failed");
} else if (WEXITSTATUS(tmp_status) == exit_exec_enoent) {
return kyua_libc_error_new(ENOENT, "execvp failed");
} else if (WEXITSTATUS(tmp_status) == exit_exec_unknown) {
return kyua_generic_error_new("execvp failed; see stderr for "
"details");
} else {
// Fall-through.
}
}
*status = tmp_status;
*timed_out = process_timed_out;
return kyua_error_ok();
}
/// Creates a temporary directory for use by a subprocess.
///
/// The temporary directory must be deleted with kyua_run_work_directory_leave.
///
/// \param template Template of the work directory to create. Should be a
/// basename and must include the XXXXXX placeholder string. The directory
/// is created within the temporary directory specified by the TMPDIR
/// environment variable or the builtin value.
/// \param uid User to set the owner of the directory to.
/// \param gid Group to set the owner of the directory to.
/// \param [out] out_work_directory Updated with a pointer to a dynamic string
/// holding the path to the created work directory. This must be passed as
/// is to kyua_run_work_directory_leave, which takes care of freeing the
/// memory.
///
/// \return An error code if there is a problem creating the directory.
kyua_error_t
kyua_run_work_directory_enter(const char* template, const uid_t uid,
const gid_t gid, char** out_work_directory)
{
kyua_error_t error = kyua_error_ok();
signal_fired = false;
setup_signal(SIGHUP, cleanup_handler, &old_sighup);
setup_signal(SIGINT, cleanup_handler, &old_sigint);
setup_signal(SIGTERM, cleanup_handler, &old_sigterm);
char* work_directory;
error = build_work_directory_path(template, &work_directory);
if (kyua_error_is_set(error))
goto err_signals;
if (mkdtemp(work_directory) == NULL) {
error = kyua_libc_error_new(errno, "mkdtemp(%s) failed",
work_directory);
goto err_work_directory_variable;
}
if (uid != getuid() || gid != getgid()) {
if (chown(work_directory, uid, gid) == -1) {
error = kyua_libc_error_new(errno,
"chown(%s, %ld, %ld) failed; uid is %ld and gid is %ld",
work_directory, (long int)uid, (long int)gid,
(long int)getuid(), (long int)getgid());
goto err_work_directory_file;
}
}
*out_work_directory = work_directory;
assert(!kyua_error_is_set(error));
goto out;
err_work_directory_file:
(void)rmdir(work_directory);
err_work_directory_variable:
free(work_directory);
err_signals:
(void)sigaction(SIGTERM, &old_sigterm, NULL);
(void)sigaction(SIGINT, &old_sigint, NULL);
(void)sigaction(SIGHUP, &old_sighup, NULL);
out:
return error;
}
/// Deletes a temporary directory created by kyua_run_work_directory_enter().
///
/// \param [in,out] work_directory The pointer to the work_directory string as
/// originally returned by kyua_run_work_directory_leave(). This is
/// explicitly invalidated by this function to clearly denote that this
/// performs the memory releasing.
///
/// \return An error code if the cleanup of the directory fails. Note that any
/// intermediate errors during the cleanup are sent to stderr.
kyua_error_t
kyua_run_work_directory_leave(char** work_directory)
{
kyua_error_t error = kyua_fs_cleanup(*work_directory);
free(*work_directory);
*work_directory = NULL;
(void)sigaction(SIGTERM, &old_sigterm, NULL);
(void)sigaction(SIGHUP, &old_sighup, NULL);
(void)sigaction(SIGINT, &old_sigint, NULL);
// At this point, we have cleaned up the work directory and we could
// (should?) re-deliver the signal to ourselves so that we terminated with
// the right code. However, we just let this return and allow the caller
// code to perform any other cleanups instead.
return error;
}