提交 a0473a0c 编写于 作者: R Rich Felker

remove explicit locking to prevent __synccall setuid during posix_spawn

for the duration of the vm-sharing clone used by posix_spawn, all
signals are blocked in the parent process, including
implementation-internal signals. since __synccall cannot do anything
until successfully signaling all threads, the fact that signals are
blocked automatically yields the necessary safety.

aside from debloating and general simplification, part of the
motivation for removing the explicit lock is to simplify the
synchronization logic of __synccall in hopes that it can be made
async-signal-safe, which is needed to make setuid and setgid, which
depend on __synccall, conform to the standard. whether this will be
possible remains to be seen.
上级 43653c12
......@@ -10,12 +10,6 @@
#include "fdop.h"
#include "libc.h"
static void dummy_0()
{
}
weak_alias(dummy_0, __acquire_ptc);
weak_alias(dummy_0, __release_ptc);
struct args {
int p[2];
sigset_t oldmask;
......@@ -144,10 +138,6 @@ int __posix_spawnx(pid_t *restrict res, const char *restrict path,
args.envp = envp;
pthread_sigmask(SIG_BLOCK, SIGALL_SET, &args.oldmask);
/* This lock prevents setuid/setgid operations while the parent
* is sharing memory with the child. Situations where processes
* with different permissions share VM are fundamentally unsafe. */
__acquire_ptc();
pid = __clone(child, stack+sizeof stack, CLONE_VM|SIGCHLD, &args);
close(args.p[1]);
......@@ -158,9 +148,6 @@ int __posix_spawnx(pid_t *restrict res, const char *restrict path,
ec = -pid;
}
/* At this point, the child has either exited or successfully
* performed exec, so the lock may be released. */
__release_ptc();
close(args.p[0]);
if (!ec) *res = pid;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册