1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "FileDescriptorShuffle.h"
#include "base/eintr_wrapper.h"
#include "mozilla/Assertions.h"
#include "mozilla/DebugOnly.h"
#include <algorithm>
#include <unistd.h>
#include <fcntl.h>
namespace mozilla {
namespace ipc {
// F_DUPFD_CLOEXEC is like F_DUPFD (see below) but atomically makes
// the new fd close-on-exec. This is useful to prevent accidental fd
// leaks into processes created by plain fork/exec, but IPC uses
// CloseSuperfluousFds so it's not essential.
//
// F_DUPFD_CLOEXEC is in POSIX 2008, but as of 2018 there are still
// some OSes that don't support it. (Specifically: Solaris 10 doesn't
// have it, and Android should have kernel support but doesn't define
// the constant until API 21 (Lollipop). We also don't use this for
// IPC child launching on Android, so there's no point in hard-coding
// the definitions like we do for Android in some other cases.)
#ifdef F_DUPFD_CLOEXEC
static const int kDupFdCmd = F_DUPFD_CLOEXEC;
#else
static const int kDupFdCmd = F_DUPFD;
#endif
// This implementation ensures that the *ranges* of the source and
// destination fds don't overlap, which is unnecessary but sufficient
// to avoid conflicts or identity mappings.
//
// In practice, the source fds will usually be large and the
// destination fds will all be relatively small, so there mostly won't
// be temporary fds. This approach has the advantage of being simple
// (and linear-time, but hopefully there aren't enough fds for that to
// matter).
bool FileDescriptorShuffle::Init(MappingRef aMapping) {
MOZ_ASSERT(mMapping.IsEmpty());
// Find the maximum destination fd; any source fds not greater than
// this will be duplicated.
int maxDst = STDERR_FILENO;
for (const auto& elem : aMapping) {
maxDst = std::max(maxDst, elem.second);
}
mMaxDst = maxDst;
#ifdef DEBUG
// Increase the limit to make sure the F_DUPFD case gets test coverage.
if (!aMapping.IsEmpty()) {
// Try to find a value that will create a nontrivial partition.
int fd0 = aMapping[0].first;
int fdn = aMapping.rbegin()->first;
maxDst = std::max(maxDst, (fd0 + fdn) / 2);
}
#endif
for (const auto& elem : aMapping) {
int src = elem.first;
// F_DUPFD is like dup() but allows placing a lower bound
// on the new fd, which is exactly what we want.
if (src <= maxDst) {
src = fcntl(src, kDupFdCmd, maxDst + 1);
if (src < 0) {
return false;
}
mTempFds.AppendElement(src);
}
MOZ_ASSERT(src > maxDst);
#ifdef DEBUG
// Check for accidentally mapping two different fds to the same
// destination. (This is O(n^2) time, but it shouldn't matter.)
for (const auto& otherElem : mMapping) {
MOZ_ASSERT(elem.second != otherElem.second);
}
#endif
mMapping.AppendElement(std::make_pair(src, elem.second));
}
return true;
}
bool FileDescriptorShuffle::MapsTo(int aFd) const {
// Prune fds that are too large to be a destination, rather than
// searching; this should be the common case.
if (aFd > mMaxDst) {
return false;
}
for (const auto& elem : mMapping) {
if (elem.second == aFd) {
return true;
}
}
return false;
}
FileDescriptorShuffle::~FileDescriptorShuffle() {
for (const auto& fd : mTempFds) {
mozilla::DebugOnly<int> rv = IGNORE_EINTR(close(fd));
MOZ_ASSERT(rv == 0);
}
}
} // namespace ipc
} // namespace mozilla
|
