about summary refs log tree commit diff
path: root/src/misc
Commit message (Collapse)AuthorAgeFilesLines
* getsubopt: don't include leading = in value stringSteven Barth2015-08-211-1/+1
| | | | | | | getsubopt incorrectly returns the delimiting = in the value string, this patch fixes it by increasing the pointer position by one. Signed-off-by: Steven Barth <cyrus@openwrt.org>
* handle loss of syslog socket connectionRich Felker2015-07-091-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | when traditional syslogd implementations are restarted, the old server socket ceases to exist and a new unix socket with the same pathname is created. when this happens, the default destination address associated with the client socket via connect is no longer valid, and attempts to send produce errors. this happens despite the socket being datagram type, and is in contrast to the behavior that would be seen with an IP datagram (UDP) socket. in order to avoid a situation where the application is unable to send further syslog messages without calling closelog, this patch makes syslog attempt to reconnect the socket when send returns an error indicating a lost connection. additionally, initial failure to connect the socket no longer results in the socket being closed. this ensures that an application which calls openlog to reserve the socket file descriptor will not run into a situation where transient connection failure (e.g. due to syslogd restart) prevents fd reservation. however, applications which may be unable to connect the socket later (e.g. due to chroot, restricted permissions, seccomp, etc.) will still fail to log if the syslog socket cannot be connected at openlog time or if it has to be reconnected later.
* add alternate backend support for getgrouplistJosiah Worcester2015-03-151-24/+0
| | | | | | | | | | | | | | | | | This completes the alternate backend support that was previously added to the getpw* and getgr* functions. Unlike those, though, it unconditionally queries nscd. Any groups from nscd that aren't in the /etc/groups file are added to the returned list, and any that are present in the file are ignored. The purpose of this behavior is to provide a view of the group database consistent with what is observed by the getgr* functions. If group memberships reported by nscd were honored when the corresponding group already has a definition in the /etc/groups file, the user's getgrouplist-based membership in the group would conflict with their non-membership in the reported gr_mem[] for the group. The changes made also make getgrouplist thread-safe and eliminate its clobbering of the global getgrent state.
* eliminate atomics in syslog setlogmask functionRich Felker2015-03-041-4/+6
|
* make all objects used with atomic operations volatileRich Felker2015-03-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the memory model we use internally for atomics permits plain loads of values which may be subject to concurrent modification without requiring that a special load function be used. since a compiler is free to make transformations that alter the number of loads or the way in which loads are performed, the compiler is theoretically free to break this usage. the most obvious concern is with atomic cas constructs: something of the form tmp=*p;a_cas(p,tmp,f(tmp)); could be transformed to a_cas(p,*p,f(*p)); where the latter is intended to show multiple loads of *p whose resulting values might fail to be equal; this would break the atomicity of the whole operation. but even more fundamental breakage is possible. with the changes being made now, objects that may be modified by atomics are modeled as volatile, and the atomic operations performed on them by other threads are modeled as asynchronous stores by hardware which happens to be acting on the request of another thread. such modeling of course does not itself address memory synchronization between cores/cpus, but that aspect was already handled. this all seems less than ideal, but it's the best we can do without mandating a C11 compiler and using the C11 model for atomics. in the case of pthread_once_t, the ABI type of the underlying object is not volatile-qualified. so we are assuming that accessing the object through a volatile-qualified lvalue via casts yields volatile access semantics. the language of the C standard is somewhat unclear on this matter, but this is an assumption the linux kernel also makes, and seems to be the correct interpretation of the standard.
* fix bad character checking in wordexpRich Felker2015-02-111-0/+1
| | | | | | | | | the character sequence '$((' was incorrectly interpreted as the opening of arithmetic even within single-quoted contexts, thereby suppressing the checks for bad characters after the closing quote. presently bad character checking is only performed when the WRDE_NOCMD is used; this patch only corrects checking in that case.
* simplify part of getopt_longRich Felker2015-01-211-13/+11
| | | | | | | as a result of commit e8e4e56a8ce1f3d7e4a027ff5478f2f8ea70c46b, the later code path for setting optarg to a null pointer is no longer necessary, and removing it eliminates an indention level and arguably makes the code more readable.
* always set optarg in getopt_longRich Felker2015-01-211-1/+1
| | | | | | | | | | | the standard getopt does not touch optarg unless processing an option with an argument. however, programs using the GNU getopt API, which we attempt to provide in getopt_long, expect optarg to be a null pointer after processing an option without an argument. before argument permutation support was added, such programs typically detected its absence and used their own replacement getopt_long, masking the discrepency in behavior.
* for multithreaded set*id/setrlimit, handle case where callback does not runRich Felker2015-01-151-3/+3
| | | | | | | | in the current version of __synccall, the callback is always run, so failure to handle this case did not matter. however, the upcoming overhaul of __synccall will have failure cases, in which case the callback does not run and errno is already set. the changes being committed now are in preparation for that.
* increase syslog message limit from 256 to 1024Rich Felker2015-01-131-1/+1
| | | | | this addresses alpine linux issue #3692 and brings the syslog message length limit in alignment with uclibc's implementation.
* fix regression in getopt_long support for non-option argumentsRich Felker2015-01-111-7/+6
| | | | | | | | | | | | | | | | commit b72cd07f176b876aa51864d93aa8101477b1d732 added support for a this feature in getopt, but it was later broken in the case where getopt_long is used as a side effect of the changes made in commit 91184c4f16b143107fa9935edebe5d2b20bd70d8, which prevented the underlying getopt call from seeing the leading '-' or '+' character in optstring. this commit changes the logic in the getopt_long core to check for a leading colon, possibly after the leading '-' or '+', without depending on the latter having been skipped by the caller. a minor incorrectness in the return value for one error condition in getopt_long is also fixed when opterr has been set to zero but optstring has no leading ':'.
* check for connect failure in syslog log openingRich Felker2015-01-091-2/+6
| | | | | | | based on patch by Dima Krasner, with minor improvements for code size. connect can fail if there is no listening syslogd, in which case a useless socket was kept open, preventing subsequent syslog call from attempting to connect again.
* overhaul forkpty function using new login_ttyRich Felker2014-12-211-26/+45
| | | | | | | | | | | | | | | | | based on discussion with and patches by Felix Janda. these changes started as an effort to factor forkpty in terms of login_tty, which returns an error and skips fd reassignment and closing if setting the controlling terminal failed. the previous forkpty code was unable to handle errors in the child, and did not attempt to; it just silently ignored them. but this would have been unacceptable when switching to using login_tty, since the child would start with the wrong stdin, stdout, and stderr and thereby clobber the parent's files. the new code uses the same technique as the posix_spawn implementation to convey any possible error in the child to the parent so that the parent can report failure to the caller. it is also safe against thread cancellation and against signal delivery in the child prior to the determination of success.
* block pthread cancellation in openpty functionRich Felker2014-12-201-9/+14
| | | | | | | being a nonstandard function, this isn't strictly necessary, but it's inexpensive and avoids unpleasant surprises. eventually I would like all functions in libc to be safe against cancellation, either ignoring it or acting on it cleanly.
* don't write openpty results until success is determinedRich Felker2014-12-201-10/+12
| | | | | | not only is this semantically more correct; it also reduces code size slightly by eliminating the need for the compiler to assume the possibility of aliasing.
* add login_tty functionFelix Janda2014-12-201-0/+14
|
* set optopt in getopt_longRich Felker2014-12-201-0/+1
| | | | | | this is undocumented but possibly expected behavior of GNU getopt_long, and useful when error message printing has been suppressed.
* add error message printing to getopt_long and make related improvementsRich Felker2014-12-202-6/+32
| | | | | some related changes are also made to getopt, and the return value of getopt_long in the case of missing arguments is fixed.
* support translation for getopt error messagesRich Felker2014-12-201-0/+2
|
* fix stderr locking and ferror semantics in getopt message printingRich Felker2014-12-191-12/+16
| | | | | | | | | | if writing the error message fails, POSIX requires that ferror(stderr) be set. and as a function that operates on a stdio stream, getopt is required to lock the stream it uses, stderr. fwrite calls are used instead of fprintf since there is a demand from some users not to pull in heavy stdio machinery via getopt. this mimics the original code using write.
* simplify getopt_long argv permutation loop logicRich Felker2014-12-131-3/+1
|
* fix handling of "--" with getopt_long argv permutationRich Felker2014-12-131-1/+0
| | | | | | if argv permutation is used, the option terminator "--" should be moved before any skipped non-option arguments rather than being left in the argv tail where the caller will see and interpret it.
* accept null longopts pointer in getopt_longRich Felker2014-12-111-1/+1
| | | | | this is an undocumented feature of GNU getopt_long that the BSD version also mimics, and is reportedly needed by some programs.
* fix getopt handling of initial '+' in optstringRich Felker2014-12-101-1/+1
| | | | | | | in the case where an initial '+' was passed in optstring (a getopt_long feature to suppress argv permutation), getopt would fail to see a possible subsequent ':', resulting in incorrect handling of missing arguments.
* support abbreviated options in getopt_longRich Felker2014-12-101-7/+18
|
* support options after non-option arguments in getopt_long (argv permutation)Rich Felker2014-12-101-0/+39
|
* fix getopt handling of ':' modifier for multibyte option charactersRich Felker2014-12-041-4/+9
| | | | | | | | | the previous hard-coded offsets of +1 and +2 contained a hidden assumption that the option character matched was single-byte, despite this implementation of getopt attempting to support multibyte option characters. this patch reworks the matching logic to leave the final index pointing just past the matched character so that fixed offsets can be used to check for ':'.
* add support for non-option arguments extension to getoptGianluca Anzolin2014-12-022-4/+20
| | | | | | | this is a GNU extension, activated by including '-' as the first character of the options string, whereby non-option arguments are processed as if they were arguments to an option character '\1' rather than ending option processing.
* getopt: fix optional argument processingFelix Fietkau2014-11-151-2/+2
| | | | | | | Processing an option character with optional argument fails if the option is last on the command line. This happens because the if (optind >= argc) check runs first before testing for optional argument.
* make endmntent function handle null argumentTimo Teräs2014-08-081-1/+1
| | | | | The function originates from SunOS 4.x in which the null argument is allowed. glibc also handles this case.
* implement ffsl and ffsll functionsRich Felker2014-07-312-0/+14
| | | | | | per the resolution of Austin Group issue #617, these are accepted for XSI option in POSIX future and thus I'm treating them as standard functions.
* add issetugid function to check for elevated privilegeBrent Cook2014-07-191-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this function provides a way for third-party library code to use the same logic that's used internally in libc for suppressing untrusted input/state (e.g. the environment) when the application is running with privleges elevated by the setuid or setgid bit or some other mechanism. its semantics are intended to match the openbsd function by the same name. there was some question as to whether this function is necessary: getauxval(AT_SECURE) was proposed as an alternative. however, this has several drawbacks. the most obvious is that it asks programmers to be aware of an implementation detail of ELF-based systems (the aux vector) rather than simply the semantic predicate to be checked. and trying to write a safe, reliable version of issetugid in terms of getauxval is difficult. for example, early versions of the glibc getauxval did not report ENOENT, which could lead to false negatives if AT_SECURE was not present in the aux vector (this could probably only happen when running on non-linux kernels under linux emulation, since glibc does not support linux versions old enough to lack AT_SECURE). as for musl, getauxval has always properly reported errors, but prior to commit 7bece9c2095ee81f14b1088f6b0ba2f37fecb283, the musl implementation did not emulate AT_SECURE if missing, which would result in a false positive. since musl actually does partially support kernels that lack AT_SECURE, this was problematic. the intent is that library authors will use issetugid if its availability is detected at build time, and only fall back to the unreliable alternatives on systems that lack it. patch by Brent Cook. commit message/rationale by Rich Felker.
* provide getauxval(AT_SECURE) even if it is missing from the aux vectorRich Felker2014-07-171-0/+1
| | | | | | | | | | | | | this could happen on 2.4-series linux kernels that predate AT_SECURE and possibly on other kernels that are emulating the linux syscall API but not providing AT_SECURE in the aux vector at startup. in principle applications should be checking errno anyway, but this does not really work. to be secure, the caller would have to treat ENOENT (indeterminate result) as possibly-suid and thereby disable functionality in the typical non-suid usage case. and since glibc only runs on kernels that provide AT_SECURE, applications written to the glibc getauxval API might simply assume it succeeds.
* implement the LOG_CONS option in syslogRich Felker2014-07-111-1/+9
| | | | | | | this was previously a no-op, somewhat intentionally, because I failed to understand that it only has an effect when sending to the logging facility fails and thus is not the nuisance that it would be if always sent output to the console.
* suppress early syslog return when log socket cannot be openedRich Felker2014-07-111-4/+1
| | | | | | | this behavior is no longer valid in general, and was never necessary. if the LOG_PERROR option is set, output to stderr could still succeed. also, when the LOG_CONS option is added, it will need syslog to proceed even if opening the log socket fails.
* implement the LOG_PERROR option in syslogRich Felker2014-07-111-2/+4
| | | | | | | | | | | | | | this is a nonstandard feature, but easy and inexpensive to add. since the corresponding macro has always been defined in our syslog.h, it makes sense to actually support it. applications may reasonably be using the presence of the macro to assume that the feature is supported. the behavior of omitting the 'header' part of the log message does not seem to be well-documented, but matches other implementations (at least glibc) which have this option. based on a patch by Clément Vasseur, but simplified using %n.
* fix the %m specifier in syslogClément Vasseur2014-07-111-0/+3
| | | | | | errno must be saved upon vsyslog entry, otherwise its value could be changed by some libc function before reaching the %m handler in vsnprintf.
* implement fmtmsg functionRich Felker2014-06-211-0/+90
| | | | | contributed by Isaac Dunham. this seems to be the last interface that was missing for complete POSIX 2008 base + XSI coverage.
* support optional-argument extension to getopt via double-colonRich Felker2014-06-111-2/+5
| | | | | | | this extension is not incompatible with the standard behavior of the function, not expensive, and avoids requiring a replacement getopt with full GNU extensions for a few important apps including busybox's sed with the -i option.
* fix for broken kernel side RLIM_INFINITY on mipsSzabolcs Nagy2014-05-302-2/+18
| | | | | | | | | | | | | | | | | | | | On 32 bit mips the kernel uses -1UL/2 to mark RLIM_INFINITY (and this is the definition in the userspace api), but since it is in the middle of the valid range of limits and limits are often compared with relational operators, various kernel side logic is broken if larger than -1UL/2 limits are used. So we truncate the limits to -1UL/2 in get/setrlimit and prlimit. Even if the kernel side logic consistently treated -1UL/2 as greater than any other limit value, there wouldn't be any clean workaround that allowed using large limits: * using -1UL/2 as RLIM_INFINITY in userspace would mean different infinity value for get/setrlimt and prlimit (where infinity is always -1ULL) and userspace logic could break easily (just like the kernel is broken now) and more special case code would be needed for mips. * translating -1UL/2 kernel side value to -1ULL in userspace would mean that -1UL/2 limit cannot be set (eg. -1UL/2+1 had to be passed to the kernel instead).
* support kernels with no SYS_open syscall, only SYS_openatRich Felker2014-05-241-1/+1
| | | | | | | | | | open is handled specially because it is used from so many places, in so many variants (2 or 3 arguments, setting errno or not, and cancellable or not). trying to do it as a function would not only increase bloat, but would also risk subtle breakage. this is the first step towards supporting "new" archs where linux lacks "old" syscalls.
* add getauxval functionRich Felker2014-04-071-0/+12
| | | | | | | in a sense this implementation is incomplete since it doesn't provide the HWCAP_* macros for use with AT_HWCAP, which is perhaps the most important intended usage case for getauxval. they will be added at a later time.
* use syscall_arg_t for arguments in public syscall() functionRich Felker2014-03-181-7/+7
| | | | | | | on x32, this change allows programs which use syscall() with pointers or 64-bit values as arguments to work correctly, i.e. without truncation or incorrect sign extension. on all other supported archs, syscall_arg_t is defined as long, so this change is a no-op.
* fix negated error codes from ptsname_rRich Felker2014-03-171-1/+1
| | | | | | the incorrect error codes also made their way into errno when __ptsname_r was called by plain ptsname, which reports errors via errno rather than a return value.
* fix nftw FTW_MOUNT flagRich Felker2014-02-011-2/+1
| | | | | the incorrect check for crossing device boundaries was preventing nftw from traversing anything except the initially provided pathname.
* optimize get_current_dir_name to reduce stack bloatRich Felker2013-12-131-3/+1
| | | | | | | | our getcwd already (as an extension) supports allocation of a buffer when the buffer argument is a null pointer, so there's no need to duplicate the allocation logic in this wrapper function. duplicating it is actually harmful in that it doubles the stack usage from PATH_MAX to 2*PATH_MAX.
* include cleanups: remove unused headers and add feature test macrosSzabolcs Nagy2013-12-127-10/+3
|
* fix and refactor child reaping logic in wordexpRich Felker2013-11-221-6/+16
| | | | | | loop condition was incorrect and confusing and caused an infinite loop when (broken) applications reaped the pid from a signal handler or another thread before wordexp's call to waitpid could do so.
* fix fd leak and case where fd 1 is already closed in wordexpRich Felker2013-11-221-4/+4
|
* fix resource exhaustion and zero-word cases in wordexpRich Felker2013-11-221-8/+18
| | | | | | | | | | | | | when WRDE_NOSPACE is returned, the we_wordv and we_wordc members must be valid, because the interface contract allows them to return partial results. in the case of zero results (due either to resource exhaustion or a zero-word input) the we_wordv array still should contain a terminating null pointer and the initial we_offs null pointers. this is impossible on resource exhaustion, so a correct application must presumably check for a null pointer in we_wordv; POSIX however seems to ignore the issue. the previous code may have crashed under this situation.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-01 13:53:32 +0000