diff options
Diffstat (limited to 'nptl')
-rw-r--r-- | nptl/Makefile | 1 | ||||
-rw-r--r-- | nptl/Versions | 1 | ||||
-rw-r--r-- | nptl/allocatestack.c | 209 | ||||
-rw-r--r-- | nptl/nptl-init.c | 49 | ||||
-rw-r--r-- | nptl/nptl_setxid.c | 279 | ||||
-rw-r--r-- | nptl/pthreadP.h | 4 |
6 files changed, 284 insertions, 259 deletions
diff --git a/nptl/Makefile b/nptl/Makefile index 6b81fe6c58..3625a09f29 100644 --- a/nptl/Makefile +++ b/nptl/Makefile @@ -47,6 +47,7 @@ routines = \ lowlevellock \ nptl_deallocate_tsd \ nptl_nthreads \ + nptl_setxid \ old_pthread_cond_broadcast \ old_pthread_cond_destroy \ old_pthread_cond_init \ diff --git a/nptl/Versions b/nptl/Versions index 2c2c5c2078..bb9f5e4ca7 100644 --- a/nptl/Versions +++ b/nptl/Versions @@ -147,6 +147,7 @@ libc { __mutex_aconf; __nptl_deallocate_tsd; __nptl_nthreads; + __nptl_setxid_sighandler; __pthread_attr_copy; __pthread_attr_destroy; __pthread_attr_init; diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c index 00fddbd409..f1270c3109 100644 --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -953,215 +953,6 @@ __reclaim_stacks (void) } -static void -setxid_mark_thread (struct xid_command *cmdp, struct pthread *t) -{ - int ch; - - /* Wait until this thread is cloned. */ - if (t->setxid_futex == -1 - && ! atomic_compare_and_exchange_bool_acq (&t->setxid_futex, -2, -1)) - do - futex_wait_simple (&t->setxid_futex, -2, FUTEX_PRIVATE); - while (t->setxid_futex == -2); - - /* Don't let the thread exit before the setxid handler runs. */ - t->setxid_futex = 0; - - do - { - ch = t->cancelhandling; - - /* If the thread is exiting right now, ignore it. */ - if ((ch & EXITING_BITMASK) != 0) - { - /* Release the futex if there is no other setxid in - progress. */ - if ((ch & SETXID_BITMASK) == 0) - { - t->setxid_futex = 1; - futex_wake (&t->setxid_futex, 1, FUTEX_PRIVATE); - } - return; - } - } - while (atomic_compare_and_exchange_bool_acq (&t->cancelhandling, - ch | SETXID_BITMASK, ch)); -} - - -static void -setxid_unmark_thread (struct xid_command *cmdp, struct pthread *t) -{ - int ch; - - do - { - ch = t->cancelhandling; - if ((ch & SETXID_BITMASK) == 0) - return; - } - while (atomic_compare_and_exchange_bool_acq (&t->cancelhandling, - ch & ~SETXID_BITMASK, ch)); - - /* Release the futex just in case. */ - t->setxid_futex = 1; - futex_wake (&t->setxid_futex, 1, FUTEX_PRIVATE); -} - - -static int -setxid_signal_thread (struct xid_command *cmdp, struct pthread *t) -{ - if ((t->cancelhandling & SETXID_BITMASK) == 0) - return 0; - - int val; - pid_t pid = __getpid (); - val = INTERNAL_SYSCALL_CALL (tgkill, pid, t->tid, SIGSETXID); - - /* If this failed, it must have had not started yet or else exited. */ - if (!INTERNAL_SYSCALL_ERROR_P (val)) - { - atomic_increment (&cmdp->cntr); - return 1; - } - else - return 0; -} - -/* Check for consistency across set*id system call results. The abort - should not happen as long as all privileges changes happen through - the glibc wrappers. ERROR must be 0 (no error) or an errno - code. */ -void -attribute_hidden -__nptl_setxid_error (struct xid_command *cmdp, int error) -{ - do - { - int olderror = cmdp->error; - if (olderror == error) - break; - if (olderror != -1) - { - /* Mismatch between current and previous results. Save the - error value to memory so that is not clobbered by the - abort function and preserved in coredumps. */ - volatile int xid_err __attribute__((unused)) = error; - abort (); - } - } - while (atomic_compare_and_exchange_bool_acq (&cmdp->error, error, -1)); -} - -int -attribute_hidden -__nptl_setxid (struct xid_command *cmdp) -{ - int signalled; - int result; - lll_lock (GL (dl_stack_cache_lock), LLL_PRIVATE); - - __xidcmd = cmdp; - cmdp->cntr = 0; - cmdp->error = -1; - - struct pthread *self = THREAD_SELF; - - /* Iterate over the list with system-allocated threads first. */ - list_t *runp; - list_for_each (runp, &GL (dl_stack_used)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - setxid_mark_thread (cmdp, t); - } - - /* Now the list with threads using user-allocated stacks. */ - list_for_each (runp, &GL (dl_stack_user)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - setxid_mark_thread (cmdp, t); - } - - /* Iterate until we don't succeed in signalling anyone. That means - we have gotten all running threads, and their children will be - automatically correct once started. */ - do - { - signalled = 0; - - list_for_each (runp, &GL (dl_stack_used)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - signalled += setxid_signal_thread (cmdp, t); - } - - list_for_each (runp, &GL (dl_stack_user)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - signalled += setxid_signal_thread (cmdp, t); - } - - int cur = cmdp->cntr; - while (cur != 0) - { - futex_wait_simple ((unsigned int *) &cmdp->cntr, cur, - FUTEX_PRIVATE); - cur = cmdp->cntr; - } - } - while (signalled != 0); - - /* Clean up flags, so that no thread blocks during exit waiting - for a signal which will never come. */ - list_for_each (runp, &GL (dl_stack_used)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - setxid_unmark_thread (cmdp, t); - } - - list_for_each (runp, &GL (dl_stack_user)) - { - struct pthread *t = list_entry (runp, struct pthread, list); - if (t == self) - continue; - - setxid_unmark_thread (cmdp, t); - } - - /* This must be last, otherwise the current thread might not have - permissions to send SIGSETXID syscall to the other threads. */ - result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3, - cmdp->id[0], cmdp->id[1], cmdp->id[2]); - int error = 0; - if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result))) - { - error = INTERNAL_SYSCALL_ERRNO (result); - __set_errno (error); - result = -1; - } - __nptl_setxid_error (cmdp, error); - - lll_unlock (GL (dl_stack_cache_lock), LLL_PRIVATE); - return result; -} - static inline void __attribute__((always_inline)) init_one_static_tls (struct pthread *curp, struct link_map *map) { diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c index 48eb2e5118..28e1aebe72 100644 --- a/nptl/nptl-init.c +++ b/nptl/nptl-init.c @@ -52,7 +52,6 @@ static const char nptl_version[] __attribute_used__ = VERSION; #ifdef SHARED static const struct pthread_functions pthread_functions = { - .ptr__nptl_setxid = __nptl_setxid, }; # define ptr_pthread_functions &pthread_functions #else @@ -106,52 +105,6 @@ sigcancel_handler (int sig, siginfo_t *si, void *ctx) } -struct xid_command *__xidcmd attribute_hidden; - -/* We use the SIGSETXID signal in the setuid, setgid, etc. implementations to - tell each thread to call the respective setxid syscall on itself. This is - the handler. */ -static void -sighandler_setxid (int sig, siginfo_t *si, void *ctx) -{ - int result; - - /* Safety check. It would be possible to call this function for - other signals and send a signal from another process. This is not - correct and might even be a security problem. Try to catch as - many incorrect invocations as possible. */ - if (sig != SIGSETXID - || si->si_pid != __getpid () - || si->si_code != SI_TKILL) - return; - - result = INTERNAL_SYSCALL_NCS (__xidcmd->syscall_no, 3, __xidcmd->id[0], - __xidcmd->id[1], __xidcmd->id[2]); - int error = 0; - if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result))) - error = INTERNAL_SYSCALL_ERRNO (result); - __nptl_setxid_error (__xidcmd, error); - - /* Reset the SETXID flag. */ - struct pthread *self = THREAD_SELF; - int flags, newval; - do - { - flags = THREAD_GETMEM (self, cancelhandling); - newval = THREAD_ATOMIC_CMPXCHG_VAL (self, cancelhandling, - flags & ~SETXID_BITMASK, flags); - } - while (flags != newval); - - /* And release the futex. */ - self->setxid_futex = 1; - futex_wake (&self->setxid_futex, 1, FUTEX_PRIVATE); - - if (atomic_decrement_val (&__xidcmd->cntr) == 0) - futex_wake ((unsigned int *) &__xidcmd->cntr, 1, FUTEX_PRIVATE); -} - - /* When using __thread for this, we do it in libc so as not to give libpthread its own TLS segment just for this. */ extern void **__libc_dl_error_tsd (void) __attribute__ ((const)); @@ -183,7 +136,7 @@ __pthread_initialize_minimal_internal (void) (void) __libc_sigaction (SIGCANCEL, &sa, NULL); /* Install the handle to change the threads' uid/gid. */ - sa.sa_sigaction = sighandler_setxid; + sa.sa_sigaction = __nptl_setxid_sighandler; sa.sa_flags = SA_SIGINFO | SA_RESTART; (void) __libc_sigaction (SIGSETXID, &sa, NULL); diff --git a/nptl/nptl_setxid.c b/nptl/nptl_setxid.c new file mode 100644 index 0000000000..2f35772411 --- /dev/null +++ b/nptl/nptl_setxid.c @@ -0,0 +1,279 @@ +/* Copyright (C) 2002-2021 Free Software Foundation, Inc. + This file is part of the GNU C Library. + Contributed by Ulrich Drepper <drepper@redhat.com>, 2002. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <futex-internal.h> +#include <ldsodefs.h> +#include <list.h> +#include <lowlevellock.h> +#include <pthreadP.h> +#include <unistd.h> + +/* Check for consistency across set*id system call results. The abort + should not happen as long as all privileges changes happen through + the glibc wrappers. ERROR must be 0 (no error) or an errno + code. */ +static void +setxid_error (struct xid_command *cmdp, int error) +{ + do + { + int olderror = cmdp->error; + if (olderror == error) + break; + if (olderror != -1) + { + /* Mismatch between current and previous results. Save the + error value to memory so that is not clobbered by the + abort function and preserved in coredumps. */ + volatile int xid_err __attribute__ ((unused)) = error; + abort (); + } + } + while (atomic_compare_and_exchange_bool_acq (&cmdp->error, error, -1)); +} + +/* Set by __nptl_setxid and used by __nptl_setxid_sighandler. */ +static struct xid_command *xidcmd; + +/* We use the SIGSETXID signal in the setuid, setgid, etc. implementations to + tell each thread to call the respective setxid syscall on itself. This is + the handler. */ +void +__nptl_setxid_sighandler (int sig, siginfo_t *si, void *ctx) +{ + int result; + + /* Safety check. It would be possible to call this function for + other signals and send a signal from another process. This is not + correct and might even be a security problem. Try to catch as + many incorrect invocations as possible. */ + if (sig != SIGSETXID + || si->si_pid != __getpid () + || si->si_code != SI_TKILL) + return; + + result = INTERNAL_SYSCALL_NCS (xidcmd->syscall_no, 3, xidcmd->id[0], + xidcmd->id[1], xidcmd->id[2]); + int error = 0; + if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result))) + error = INTERNAL_SYSCALL_ERRNO (result); + setxid_error (xidcmd, error); + + /* Reset the SETXID flag. */ + struct pthread *self = THREAD_SELF; + int flags, newval; + do + { + flags = THREAD_GETMEM (self, cancelhandling); + newval = THREAD_ATOMIC_CMPXCHG_VAL (self, cancelhandling, + flags & ~SETXID_BITMASK, flags); + } + while (flags != newval); + + /* And release the futex. */ + self->setxid_futex = 1; + futex_wake (&self->setxid_futex, 1, FUTEX_PRIVATE); + + if (atomic_decrement_val (&xidcmd->cntr) == 0) + futex_wake ((unsigned int *) &xidcmd->cntr, 1, FUTEX_PRIVATE); +} +libc_hidden_def (__nptl_setxid_sighandler) + +static void +setxid_mark_thread (struct xid_command *cmdp, struct pthread *t) +{ + int ch; + + /* Wait until this thread is cloned. */ + if (t->setxid_futex == -1 + && ! atomic_compare_and_exchange_bool_acq (&t->setxid_futex, -2, -1)) + do + futex_wait_simple (&t->setxid_futex, -2, FUTEX_PRIVATE); + while (t->setxid_futex == -2); + + /* Don't let the thread exit before the setxid handler runs. */ + t->setxid_futex = 0; + + do + { + ch = t->cancelhandling; + + /* If the thread is exiting right now, ignore it. */ + if ((ch & EXITING_BITMASK) != 0) + { + /* Release the futex if there is no other setxid in + progress. */ + if ((ch & SETXID_BITMASK) == 0) + { + t->setxid_futex = 1; + futex_wake (&t->setxid_futex, 1, FUTEX_PRIVATE); + } + return; + } + } + while (atomic_compare_and_exchange_bool_acq (&t->cancelhandling, + ch | SETXID_BITMASK, ch)); +} + + +static void +setxid_unmark_thread (struct xid_command *cmdp, struct pthread *t) +{ + int ch; + + do + { + ch = t->cancelhandling; + if ((ch & SETXID_BITMASK) == 0) + return; + } + while (atomic_compare_and_exchange_bool_acq (&t->cancelhandling, + ch & ~SETXID_BITMASK, ch)); + + /* Release the futex just in case. */ + t->setxid_futex = 1; + futex_wake (&t->setxid_futex, 1, FUTEX_PRIVATE); +} + + +static int +setxid_signal_thread (struct xid_command *cmdp, struct pthread *t) +{ + if ((t->cancelhandling & SETXID_BITMASK) == 0) + return 0; + + int val; + pid_t pid = __getpid (); + val = INTERNAL_SYSCALL_CALL (tgkill, pid, t->tid, SIGSETXID); + + /* If this failed, it must have had not started yet or else exited. */ + if (!INTERNAL_SYSCALL_ERROR_P (val)) + { + atomic_increment (&cmdp->cntr); + return 1; + } + else + return 0; +} + +int +attribute_hidden +__nptl_setxid (struct xid_command *cmdp) +{ + int signalled; + int result; + lll_lock (GL (dl_stack_cache_lock), LLL_PRIVATE); + + xidcmd = cmdp; + cmdp->cntr = 0; + cmdp->error = -1; + + struct pthread *self = THREAD_SELF; + + /* Iterate over the list with system-allocated threads first. */ + list_t *runp; + list_for_each (runp, &GL (dl_stack_used)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + setxid_mark_thread (cmdp, t); + } + + /* Now the list with threads using user-allocated stacks. */ + list_for_each (runp, &GL (dl_stack_user)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + setxid_mark_thread (cmdp, t); + } + + /* Iterate until we don't succeed in signalling anyone. That means + we have gotten all running threads, and their children will be + automatically correct once started. */ + do + { + signalled = 0; + + list_for_each (runp, &GL (dl_stack_used)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + signalled += setxid_signal_thread (cmdp, t); + } + + list_for_each (runp, &GL (dl_stack_user)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + signalled += setxid_signal_thread (cmdp, t); + } + + int cur = cmdp->cntr; + while (cur != 0) + { + futex_wait_simple ((unsigned int *) &cmdp->cntr, cur, + FUTEX_PRIVATE); + cur = cmdp->cntr; + } + } + while (signalled != 0); + + /* Clean up flags, so that no thread blocks during exit waiting + for a signal which will never come. */ + list_for_each (runp, &GL (dl_stack_used)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + setxid_unmark_thread (cmdp, t); + } + + list_for_each (runp, &GL (dl_stack_user)) + { + struct pthread *t = list_entry (runp, struct pthread, list); + if (t == self) + continue; + + setxid_unmark_thread (cmdp, t); + } + + /* This must be last, otherwise the current thread might not have + permissions to send SIGSETXID syscall to the other threads. */ + result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3, + cmdp->id[0], cmdp->id[1], cmdp->id[2]); + int error = 0; + if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result))) + { + error = INTERNAL_SYSCALL_ERRNO (result); + __set_errno (error); + result = -1; + } + setxid_error (cmdp, error); + + lll_unlock (GL (dl_stack_cache_lock), LLL_PRIVATE); + return result; +} diff --git a/nptl/pthreadP.h b/nptl/pthreadP.h index 14f2bd9535..e091b2ed5e 100644 --- a/nptl/pthreadP.h +++ b/nptl/pthreadP.h @@ -701,8 +701,8 @@ extern void _pthread_cleanup_pop_restore (struct _pthread_cleanup_buffer *buffer extern void __nptl_deallocate_tsd (void); libc_hidden_proto (__nptl_deallocate_tsd) -extern void __nptl_setxid_error (struct xid_command *cmdp, int error) - attribute_hidden; +void __nptl_setxid_sighandler (int sig, siginfo_t *si, void *ctx); +libc_hidden_proto (__nptl_setxid_sighandler) extern int __nptl_setxid (struct xid_command *cmdp) attribute_hidden; extern void __nptl_stacks_freeres (void) attribute_hidden; |