// Copyright 2012 Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
//   notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above copyright
//   notice, this list of conditions and the following disclaimer in the
//   documentation and/or other materials provided with the distribution.
// * Neither the name of Google Inc. nor the names of its contributors
//   may be used to endorse or promote products derived from this software
//   without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#if defined(HAVE_CONFIG_H)
#   include "config.h"
#endif

#include "run.h"

#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/wait.h>

#include <assert.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "defs.h"
#include "env.h"
#include "error.h"
#include "fs.h"
#include "text.h"


/// Path to the temporary work directory to use.
const char* kyua_run_tmpdir = KYUA_TMPDIR;
#undef KYUA_TMPDIR  // We really want to use the variable, not the macro.


/// Whether we got a signal or not.
static volatile bool signal_fired = false;


/// Whether the process timed out or not.
static volatile bool process_timed_out = false;


/// If not -1, PID of the process to forcibly kill when we get a signal.
///
/// Must be protected by protect() and unprotect().
static volatile pid_t pid_to_kill = -1;


/// Whether we are holding signals or not.
static bool protected = false;


/// Magic exit code to denote an error while preparing the subprocess.
static const int exit_setup_child = 124;
/// Magic exit code to denote an error in exec(3) that we do not handle.
static const int exit_exec_unknown = 123;
/// Magic exit code to denote an EACCES error in exec(3).
static const int exit_exec_eacces = 122;
/// Magic exit code to denote an ENOENT error in exec(3).
static const int exit_exec_enoent = 121;


/// Area to save the original SIGHUP handler.
static struct sigaction old_sighup;
/// Area to save the original SIGINT handler.
static struct sigaction old_sigint;
/// Area to save the original SIGTERM handler.
static struct sigaction old_sigterm;
/// Area to save the original SIGALRM handler.
static struct sigaction old_sigalrm;
/// Area to save the original realtime timer.
static struct itimerval old_timer;


/// Masks or unmasks all the signals programmed by this module.
///
/// \param operation One of SIG_BLOCK or SIG_UNBLOCK.
static void
mask_handlers(const int operation)
{
   sigset_t mask;
   sigemptyset(&mask);
   sigaddset(&mask, SIGALRM);
   sigaddset(&mask, SIGINT);
   sigaddset(&mask, SIGHUP);
   sigaddset(&mask, SIGTERM);
   const int ret = sigprocmask(operation, &mask, NULL);
   assert(ret != -1);
}


/// Masks all signals programmed by this module.
static void
protect(void)
{
   mask_handlers(SIG_BLOCK);
   protected = true;
}


/// Unmasks all signals programmed by this module.
static void
unprotect(void)
{
   protected = false;
   mask_handlers(SIG_UNBLOCK);
}


/// Handler for signals that should abort execution.
///
/// When called the first time, this handler kills any running subprocess so
/// that the cleanup routines can proceed.  Calling this a second time aborts
/// execution of the program.
///
/// \param unused_signo Number of the captured signal.
static void
cleanup_handler(const int KYUA_DEFS_UNUSED_PARAM(signo))
{
   static const char* clean_message = "Signal caught; cleaning up...\n";
   static const char* abort_message = "Double signal caught; aborting...\n";

   protect();
   if (!signal_fired) {
       signal_fired = true;
       if (write(STDERR_FILENO, clean_message, strlen(clean_message)) == -1) {
           // Ignore.
       }
       if (pid_to_kill != -1) {
           kill(pid_to_kill, SIGKILL);
           pid_to_kill = -1;
       }
       unprotect();
   } else {
       if (write(STDERR_FILENO, abort_message, strlen(abort_message)) == -1) {
           // Ignore.
       }
       if (pid_to_kill != -1) {
           kill(pid_to_kill, SIGKILL);
           pid_to_kill = -1;
       }
       abort();
   }
}


/// Handler for signals that should terminate the active subprocess.
///
/// \param unused_signo Number of the captured signal.
static void
timeout_handler(const int KYUA_DEFS_UNUSED_PARAM(signo))
{
   static const char* message = "Subprocess timed out; sending KILL "
       "signal...\n";

   protect();
   process_timed_out = true;
   if (write(STDERR_FILENO, message, strlen(message)) == -1) {
       // Ignore.
   }
   if (pid_to_kill != -1) {
       kill(pid_to_kill, SIGKILL);
       pid_to_kill = -1;
   }
   unprotect();
}


/// Installs a signal handler.
///
/// \param signo Number of the signal to program.
/// \param handler Handler for the signal.
/// \param [out] old_sa Pointer to the sigaction structure in which to save the
///     current signal handler data.
static void
setup_signal(const int signo, void (*handler)(const int),
            struct sigaction* old_sa)
{
   struct sigaction sa;
   sa.sa_handler = handler;
   sigemptyset(&sa.sa_mask);
   sa.sa_flags = SA_RESTART;

   const int ret = sigaction(signo, &sa, old_sa);
   assert(ret != -1);
}


/// Installs a timer.
///
/// \param seconds Deadline for the timer.
/// \param [out] old_itimerval Pointer to the itimerval structure in which to
///     save the current timer data into.
static void
setup_timer(const int seconds, struct itimerval* old_itimerval)
{
   struct itimerval new_timer;
   new_timer.it_interval.tv_sec = 0;
   new_timer.it_interval.tv_usec = 0;
   new_timer.it_value.tv_sec = seconds;
   new_timer.it_value.tv_usec = 0;
   const int ret = setitimer(ITIMER_REAL, &new_timer, old_itimerval);
   assert(ret != -1);
}


/// Resets the environment of the process to a known state.
///
/// \param work_directory Path to the work directory being used.
///
/// \return An error if there is a problem configuring the environment
/// variables, or OK if successful.  Note that if this returns an error, we have
/// left the environment in an inconsistent state.
static kyua_error_t
prepare_environment(const char* work_directory)
{
   kyua_error_t error;

   // TODO(jmmv): It might be better to do the opposite: just pass a good known
   // set of variables to the child (aka HOME, PATH, ...).  But how do we
   // determine this minimum set?

   const char* to_unset[] = { "LANG", "LC_ALL", "LC_COLLATE", "LC_CTYPE",
                              "LC_MESSAGES", "LC_MONETARY", "LC_NUMERIC",
                              "LC_TIME", NULL };
   const char** iter;
   for (iter = to_unset; *iter != NULL; ++iter) {
       error = kyua_env_unset(*iter);
       if (kyua_error_is_set(error))
           return error;
   }

   error = kyua_env_set("HOME", work_directory);
   if (kyua_error_is_set(error))
       return error;

   error = kyua_env_set("TZ", "UTC");
   if (kyua_error_is_set(error))
       return error;

   error = kyua_env_set("__RUNNING_INSIDE_ATF_RUN", "internal-yes-value");
   if (kyua_error_is_set(error))
       return error;

   assert(!kyua_error_is_set(error));
   return error;
}


/// Resets all signals to their default handlers.
static void
reset_signals(void)
{
   int signo;

   for (signo = 1; signo <= LAST_SIGNO; ++signo) {
       if (signo == SIGKILL || signo == SIGSTOP) {
           // Don't attempt to reset immutable signals.
           continue;
       }

       struct sigaction sa;
       sa.sa_handler = SIG_DFL;
       sigemptyset(&sa.sa_mask);
       sa.sa_flags = 0;
       (void)sigaction(signo, &sa, NULL);
   }
}


/// Raises core size limit to its possible maximum.
///
/// This is a best-effort operation.  There is no guarantee that the operation
/// will yield a large-enough limit to generate any possible core file.
static void
unlimit_core_size(void)
{
   struct rlimit rl;
   {
       const int ret = getrlimit(RLIMIT_CORE, &rl);
       assert(ret != -1);
   }
   rl.rlim_cur = rl.rlim_max;
   const int ret = setrlimit(RLIMIT_CORE, &rl) != -1;
   assert(ret != -1);
}


/// Cleans up the container process to run a new child.
///
/// If there is any error during the setup, the new process is terminated
/// with an error code.
///
/// \param run_params End-user parameters that describe how to isolate the
///     newly-created process.
static void
setup_child(const kyua_run_params_t* run_params)
{
   setpgid(getpid(), getpid());

   if (chdir(run_params->work_directory) == -1)
       err(exit_setup_child, "chdir(%s) failed", run_params->work_directory);

   unlimit_core_size();
   reset_signals();

   const kyua_error_t error = prepare_environment(run_params->work_directory);
   if (kyua_error_is_set(error))
       kyua_error_err(exit_setup_child, error, "Failed to configure the "
                      "environment");

   (void)umask(0022);

   if (run_params->unprivileged_group != getgid()) {
       if (setgid(run_params->unprivileged_group) == -1)
           err(exit_setup_child, "setgid(%ld) failed; uid is %ld and gid "
               "is %ld", (long int)run_params->unprivileged_group,
               (long int)getuid(), (long int)getgid());
   }
   if (run_params->unprivileged_user != getuid()) {
       if (setuid(run_params->unprivileged_user) == -1)
           err(exit_setup_child, "setuid(%ld) failed; uid is %ld and gid "
               "is %ld", (long int)run_params->unprivileged_user,
               (long int)getuid(), (long int)getgid());
   }
}


/// Constructs a path to a work directory based on a template.
///
/// \param template Template of the work directory to create.  Should be a
///      basename and must include the XXXXXX placeholder string.  The directory
///      is created within the temporary directory specified by the TMPDIR
///      environment variable or the builtin value in kyua_run_tmpdir.
/// \param [out] work_directory Pointer to a dynamically-allocated string
///      containing the full path to the work directory.  The caller is
///      responsible for releasing this string.
///
/// \return An error if there is a problem (most likely OOM), or OK otherwise.
static kyua_error_t
build_work_directory_path(const char* template, char** work_directory)
{
   assert(strstr(template, "XXXXXX") != NULL);

   const char* tmpdir = getenv("TMPDIR");
   if (tmpdir == NULL)
       return kyua_text_printf(work_directory, "%s/%s", kyua_run_tmpdir,
                               template);
   else
       return kyua_text_printf(work_directory, "%s/%s", tmpdir, template);
}


/// Initializes the run_params parameters with default values.
///
/// \param [out] run_params The object to initialize.
void
kyua_run_params_init(kyua_run_params_t* run_params)
{
   run_params->timeout_seconds = 60;
   run_params->unprivileged_user = getuid();
   run_params->unprivileged_group = getgid();
   run_params->work_directory = ".";
}


/// Executes a program and exits if there is a problem.
///
/// This routine is supposed to be used in conjunction with kyua_run_fork and
/// kyua_run_wait so that the various return codes of the exec system call are
/// properly propagated to the parent process.
///
/// \param program Path to the program to run.
/// \param args Arguments to the program.
void
kyua_run_exec(const char* program, const char* const* args)
{
   (void)execvp(program, KYUA_DEFS_UNCONST(args));
   switch (errno) {
   case EACCES:
       exit(exit_exec_eacces);
   case ENOENT:
       exit(exit_exec_enoent);
   default:
       err(exit_exec_unknown, "execvp failed");
   }
}


/// Forks and isolates the child process.
///
/// The created subprocess must be waited for with kyua_run_wait().
///
/// \param run_params Parameters that describe how to isolate the newly-created
///     process.
/// \param [out] out_pid The PID of the child in the parent, or 0 in the child.
///     The value left here should only be accessed if this function does not
///     return an error.
///
/// \return An error object if fork(2) fails.
kyua_error_t
kyua_run_fork(const kyua_run_params_t* run_params, pid_t* const out_pid)
{
   protect();
   pid_t pid = fork();
   if (pid == -1) {
       unprotect();
       *out_pid = pid;  // Not necessary, but avoid mistakes in the caller.
       return kyua_libc_error_new(errno, "fork failed");
   } else if (pid == 0) {
       unprotect();
       setup_child(run_params);
       *out_pid = pid;
       return kyua_error_ok();
   } else {
       pid_to_kill = pid;
       unprotect();

       setup_signal(SIGALRM, timeout_handler, &old_sigalrm);
       process_timed_out = false;
       setup_timer(run_params->timeout_seconds, &old_timer);

       *out_pid = pid;
       return kyua_error_ok();
   }
}


/// Waits for a process started via kyua_run_fork.
///
/// \param pid The PID of the child to wait for.
/// \param [out] status The exit status of the awaited process.
/// \param [out] timed_out Whether the process timed out or not.
///
/// \return An error if the process failed due to an problem in kyua_run_exec.
/// However, note that the wait for the process itself is expected to have been
/// successful.
kyua_error_t
kyua_run_wait(const pid_t pid, int* status, bool* timed_out)
{
   int tmp_status;
   const pid_t waited_pid = waitpid(pid, &tmp_status, 0);
   assert(pid == waited_pid);

   protect();
   (void)setitimer(ITIMER_REAL, &old_timer, NULL);
   (void)sigaction(SIGALRM, &old_sigalrm, NULL);
   pid_to_kill = -1;
   unprotect();

   killpg(pid, SIGKILL);

   if (WIFEXITED(tmp_status)) {
       if (WEXITSTATUS(tmp_status) == exit_setup_child) {
           return kyua_generic_error_new("Failed to isolate subprocess; "
                                         "see stderr for details");
       } else if (WEXITSTATUS(tmp_status) == exit_exec_eacces) {
           return kyua_libc_error_new(EACCES, "execvp failed");
       } else if (WEXITSTATUS(tmp_status) == exit_exec_enoent) {
           return kyua_libc_error_new(ENOENT, "execvp failed");
       } else if (WEXITSTATUS(tmp_status) == exit_exec_unknown) {
           return kyua_generic_error_new("execvp failed; see stderr for "
                                         "details");
       } else {
           // Fall-through.
       }
   }
   *status = tmp_status;
   *timed_out = process_timed_out;
   return kyua_error_ok();
}


/// Creates a temporary directory for use by a subprocess.
///
/// The temporary directory must be deleted with kyua_run_work_directory_leave.
///
/// \param template Template of the work directory to create.  Should be a
///      basename and must include the XXXXXX placeholder string.  The directory
///      is created within the temporary directory specified by the TMPDIR
///      environment variable or the builtin value.
/// \param uid User to set the owner of the directory to.
/// \param gid Group to set the owner of the directory to.
/// \param [out] out_work_directory Updated with a pointer to a dynamic string
///      holding the path to the created work directory.  This must be passed as
///      is to kyua_run_work_directory_leave, which takes care of freeing the
///      memory.
///
/// \return An error code if there is a problem creating the directory.
kyua_error_t
kyua_run_work_directory_enter(const char* template, const uid_t uid,
                             const gid_t gid, char** out_work_directory)
{
   kyua_error_t error = kyua_error_ok();

   signal_fired = false;
   setup_signal(SIGHUP, cleanup_handler, &old_sighup);
   setup_signal(SIGINT, cleanup_handler, &old_sigint);
   setup_signal(SIGTERM, cleanup_handler, &old_sigterm);

   char* work_directory;
   error = build_work_directory_path(template, &work_directory);
   if (kyua_error_is_set(error))
       goto err_signals;

   if (mkdtemp(work_directory) == NULL) {
       error = kyua_libc_error_new(errno, "mkdtemp(%s) failed",
                                   work_directory);
       goto err_work_directory_variable;
   }

   if (uid != getuid() || gid != getgid()) {
       if (chown(work_directory, uid, gid) == -1) {
           error = kyua_libc_error_new(errno,
               "chown(%s, %ld, %ld) failed; uid is %ld and gid is %ld",
               work_directory, (long int)uid, (long int)gid,
               (long int)getuid(), (long int)getgid());
           goto err_work_directory_file;
       }
   }

   *out_work_directory = work_directory;
   assert(!kyua_error_is_set(error));
   goto out;

err_work_directory_file:
   (void)rmdir(work_directory);
err_work_directory_variable:
   free(work_directory);
err_signals:
   (void)sigaction(SIGTERM, &old_sigterm, NULL);
   (void)sigaction(SIGINT, &old_sigint, NULL);
   (void)sigaction(SIGHUP, &old_sighup, NULL);
out:
   return error;
}


/// Deletes a temporary directory created by kyua_run_work_directory_enter().
///
/// \param [in,out] work_directory The pointer to the work_directory string as
///     originally returned by kyua_run_work_directory_leave().  This is
///     explicitly invalidated by this function to clearly denote that this
///     performs the memory releasing.
///
/// \return An error code if the cleanup of the directory fails.  Note that any
/// intermediate errors during the cleanup are sent to stderr.
kyua_error_t
kyua_run_work_directory_leave(char** work_directory)
{
   kyua_error_t error = kyua_fs_cleanup(*work_directory);

   free(*work_directory);
   *work_directory = NULL;

   (void)sigaction(SIGTERM, &old_sigterm, NULL);
   (void)sigaction(SIGHUP, &old_sighup, NULL);
   (void)sigaction(SIGINT, &old_sigint, NULL);

   // At this point, we have cleaned up the work directory and we could
   // (should?)  re-deliver the signal to ourselves so that we terminated with
   // the right code.  However, we just let this return and allow the caller
   // code to perform any other cleanups instead.

   return error;
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.