2023-12-04 20:45:46 +00:00
|
|
|
/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
|
2023-12-08 03:11:56 +00:00
|
|
|
│ vi: set et ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi │
|
2023-12-04 20:45:46 +00:00
|
|
|
╞══════════════════════════════════════════════════════════════════════════════╡
|
|
|
|
│ Copyright 2023 Justine Alexandra Roberts Tunney │
|
|
|
|
│ │
|
|
|
|
│ Permission to use, copy, modify, and/or distribute this software for │
|
|
|
|
│ any purpose with or without fee is hereby granted, provided that the │
|
|
|
|
│ above copyright notice and this permission notice appear in all copies. │
|
|
|
|
│ │
|
|
|
|
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │
|
|
|
|
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │
|
|
|
|
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │
|
|
|
|
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │
|
|
|
|
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │
|
|
|
|
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │
|
|
|
|
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
|
|
|
|
│ PERFORMANCE OF THIS SOFTWARE. │
|
|
|
|
╚─────────────────────────────────────────────────────────────────────────────*/
|
|
|
|
#include "libc/calls/calls.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/calls/metalfile.internal.h"
|
2024-01-04 16:25:37 +00:00
|
|
|
#include "libc/calls/syscall-nt.internal.h"
|
2024-01-01 15:23:23 +00:00
|
|
|
#include "libc/calls/syscall-sysv.internal.h"
|
2024-01-04 16:25:37 +00:00
|
|
|
#include "libc/calls/syscall_support-sysv.internal.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/dce.h"
|
|
|
|
#include "libc/limits.h"
|
|
|
|
#include "libc/runtime/runtime.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/serialize.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/stdio/stdio.h"
|
|
|
|
#include "libc/str/str.h"
|
2024-01-06 19:42:03 +00:00
|
|
|
#include "libc/sysv/consts/auxv.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/sysv/consts/o.h"
|
2023-12-31 19:53:15 +00:00
|
|
|
#include "libc/sysv/consts/ok.h"
|
2023-12-05 04:01:52 +00:00
|
|
|
#include "libc/testlib/ezbench.h"
|
2023-12-04 20:45:46 +00:00
|
|
|
#include "libc/testlib/subprocess.h"
|
|
|
|
#include "libc/testlib/testlib.h"
|
|
|
|
|
|
|
|
static char *self;
|
2024-01-06 19:42:03 +00:00
|
|
|
static bool loaded, skiptests, skiparg0;
|
2023-12-04 20:45:46 +00:00
|
|
|
|
|
|
|
void SetUpOnce(void) {
|
Loader path security (#1012)
The ape loader now passes the program executable name directly as a
register. `x2` is used on aarch64, `%rdx` on x86_64. This is passed
as the third argument to `cosmo()` (M1) or `Launch` (non-M1) and is
assigned to the global `__program_executable_name`.
`GetProgramExecutableName` now returns this global's value, setting
it if it is initially null. `InitProgramExecutableName` first tries
exotic, secure methods: `KERN_PROC_PATHNAME` on FreeBSD/NetBSD, and
`/proc` on Linux. If those produce a reasonable response (i.e., not
`"/usr/bin/ape"`, which happens with the loader before this change),
that is used. Otherwise, if `issetugid()`, the empty string is used.
Otherwise, the old argv/envp parsing code is run.
The value returned from the loader is always the full absolute path
of the binary to be executed, having passed through `realpath`. For
the non-M1 loader, this necessitated writing `RealPath`, which uses
`readlinkat` of `"/proc/self/fd/[progfd]"` on Linux, `F_GETPATH` on
Xnu, and the `__realpath` syscall on OpenBSD. On FreeBSD/NetBSD, it
punts to `GetProgramExecutableName`, which is secure on those OSes.
With the loader, all platforms now have a secure program executable
name. With no loader or an old loader, everything still works as it
did, but setuid/setgid is not supported if the insecure pathfinding
code would have been needed.
Fixes #991.
2023-12-15 17:23:58 +00:00
|
|
|
self = GetProgramExecutableName();
|
2023-12-04 20:45:46 +00:00
|
|
|
testlib_enable_tmp_setup_teardown();
|
2023-12-31 19:53:15 +00:00
|
|
|
if (IsMetal()) {
|
|
|
|
skiptests = true;
|
2024-01-06 19:42:03 +00:00
|
|
|
} else if (IsWindows()) {
|
|
|
|
/* do all tests */
|
|
|
|
} else if (!loaded) {
|
2023-12-31 19:53:15 +00:00
|
|
|
ASSERT_STRNE(self, "");
|
|
|
|
ASSERT_SYS(0, 3, open(self, O_RDONLY));
|
|
|
|
char buf[8];
|
|
|
|
ASSERT_SYS(0, 8, pread(3, buf, 8, 0));
|
|
|
|
ASSERT_SYS(0, 0, close(3));
|
|
|
|
if (READ64LE(buf) != READ64LE("MZqFpD='") &&
|
|
|
|
READ64LE(buf) != READ64LE("jartsr='") &&
|
|
|
|
READ64LE(buf) != READ64LE("APEDBG='")) {
|
2024-01-06 19:42:03 +00:00
|
|
|
// GetProgramExecutableName does not work reliably for assimilated
|
|
|
|
// OpenBSD or XNU binaries.
|
|
|
|
skiptests = IsOpenbsd() || (IsXnu() && !IsXnuSilicon());
|
2023-12-31 19:53:15 +00:00
|
|
|
}
|
2024-01-06 19:42:03 +00:00
|
|
|
} else {
|
2024-01-07 15:13:20 +00:00
|
|
|
skiparg0 = !(getauxval(AT_FLAGS) & AT_FLAGS_PRESERVE_ARGV0);
|
2024-01-06 19:42:03 +00:00
|
|
|
}
|
|
|
|
fprintf(stderr, loaded ? "loaded\n" : "not loaded\n");
|
|
|
|
if (skiptests) {
|
|
|
|
fprintf(stderr, "skipping most GetProgramExecutableName tests\n");
|
|
|
|
} else if (skiparg0) {
|
|
|
|
fprintf(stderr, "skipping argv[0] tests\n");
|
2023-12-31 19:53:15 +00:00
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
__attribute__((__constructor__)) static void Child(int argc, char *argv[]) {
|
2024-01-06 19:42:03 +00:00
|
|
|
loaded = !!__program_executable_name;
|
2023-12-04 20:45:46 +00:00
|
|
|
if (argc >= 2 && !strcmp(argv[1], "Child")) {
|
2024-01-04 16:25:37 +00:00
|
|
|
int rc;
|
|
|
|
if (!IsWindows()) {
|
|
|
|
rc = sys_chdir("/");
|
|
|
|
} else {
|
|
|
|
rc = sys_chdir_nt("/");
|
|
|
|
}
|
|
|
|
if (rc) {
|
2024-01-01 15:23:23 +00:00
|
|
|
exit(122);
|
|
|
|
}
|
2023-12-28 12:22:42 +00:00
|
|
|
if (strcmp(argv[2], GetProgramExecutableName())) {
|
|
|
|
exit(123);
|
Loader path security (#1012)
The ape loader now passes the program executable name directly as a
register. `x2` is used on aarch64, `%rdx` on x86_64. This is passed
as the third argument to `cosmo()` (M1) or `Launch` (non-M1) and is
assigned to the global `__program_executable_name`.
`GetProgramExecutableName` now returns this global's value, setting
it if it is initially null. `InitProgramExecutableName` first tries
exotic, secure methods: `KERN_PROC_PATHNAME` on FreeBSD/NetBSD, and
`/proc` on Linux. If those produce a reasonable response (i.e., not
`"/usr/bin/ape"`, which happens with the loader before this change),
that is used. Otherwise, if `issetugid()`, the empty string is used.
Otherwise, the old argv/envp parsing code is run.
The value returned from the loader is always the full absolute path
of the binary to be executed, having passed through `realpath`. For
the non-M1 loader, this necessitated writing `RealPath`, which uses
`readlinkat` of `"/proc/self/fd/[progfd]"` on Linux, `F_GETPATH` on
Xnu, and the `__realpath` syscall on OpenBSD. On FreeBSD/NetBSD, it
punts to `GetProgramExecutableName`, which is secure on those OSes.
With the loader, all platforms now have a secure program executable
name. With no loader or an old loader, everything still works as it
did, but setuid/setgid is not supported if the insecure pathfinding
code would have been needed.
Fixes #991.
2023-12-15 17:23:58 +00:00
|
|
|
}
|
2024-01-06 19:42:03 +00:00
|
|
|
if (argc >= 4) {
|
|
|
|
if (strcmp(argv[3], argv[0])) {
|
|
|
|
exit(124);
|
|
|
|
}
|
2023-12-28 12:22:42 +00:00
|
|
|
}
|
|
|
|
exit(0);
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProgramExecutableName, ofThisFile) {
|
2023-12-31 19:53:15 +00:00
|
|
|
if (IsMetal()) {
|
|
|
|
EXPECT_STREQ(self, APE_COM_NAME);
|
|
|
|
} else {
|
|
|
|
EXPECT_EQ('/', *self);
|
|
|
|
EXPECT_TRUE(!!strstr(self, "getprogramexecutablename_test"));
|
|
|
|
EXPECT_SYS(0, 0, access(self, X_OK));
|
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProgramExecutableName, nullEnv) {
|
Apply clang-format update to repo (#1154)
Commit bc6c183 introduced a bunch of discrepancies between what files
look like in the repo and what clang-format says they should look like.
However, there were already a few discrepancies prior to that. Most of
these discrepancies seemed to be unintentional, but a few of them were
load-bearing (e.g., a #include that violated header ordering needing
something to have been #defined by a 'later' #include.)
I opted to take what I hope is a relatively smooth-brained approach: I
reverted the .clang-format change, ran clang-format on the whole repo,
reapplied the .clang-format change, reran clang-format again, and then
reverted the commit that contained the first run. Thus the full effect
of this PR should only be to apply the changed formatting rules to the
repo, and from skimming the results, this seems to be the case.
My work can be checked by applying the short, manual commits, and then
rerunning the command listed in the autogenerated commits (those whose
messages I have prefixed auto:) and seeing if your results agree.
It might be that the other diffs should be fixed at some point but I'm
leaving that aside for now.
fd '\.c(c|pp)?$' --print0| xargs -0 clang-format -i
2024-04-25 17:38:00 +00:00
|
|
|
if (skiptests)
|
|
|
|
return;
|
2023-12-04 20:45:46 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(self, (char *[]){self, "Child", self, skiparg0 ? 0 : self, 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
TEST(GetProramExecutableName, weirdArgv0NullEnv) {
|
Apply clang-format update to repo (#1154)
Commit bc6c183 introduced a bunch of discrepancies between what files
look like in the repo and what clang-format says they should look like.
However, there were already a few discrepancies prior to that. Most of
these discrepancies seemed to be unintentional, but a few of them were
load-bearing (e.g., a #include that violated header ordering needing
something to have been #defined by a 'later' #include.)
I opted to take what I hope is a relatively smooth-brained approach: I
reverted the .clang-format change, ran clang-format on the whole repo,
reapplied the .clang-format change, reran clang-format again, and then
reverted the commit that contained the first run. Thus the full effect
of this PR should only be to apply the changed formatting rules to the
repo, and from skimming the results, this seems to be the case.
My work can be checked by applying the short, manual commits, and then
rerunning the command listed in the autogenerated commits (those whose
messages I have prefixed auto:) and seeing if your results agree.
It might be that the other diffs should be fixed at some point but I'm
leaving that aside for now.
fd '\.c(c|pp)?$' --print0| xargs -0 clang-format -i
2024-04-25 17:38:00 +00:00
|
|
|
if (skiptests)
|
|
|
|
return;
|
2023-12-04 20:45:46 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(self, (char *[]){"hello", "Child", self, skiparg0 ? 0 : "hello", 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
|
|
|
}
|
|
|
|
|
2023-12-05 04:01:52 +00:00
|
|
|
TEST(GetProgramExecutableName, movedSelf) {
|
Apply clang-format update to repo (#1154)
Commit bc6c183 introduced a bunch of discrepancies between what files
look like in the repo and what clang-format says they should look like.
However, there were already a few discrepancies prior to that. Most of
these discrepancies seemed to be unintentional, but a few of them were
load-bearing (e.g., a #include that violated header ordering needing
something to have been #defined by a 'later' #include.)
I opted to take what I hope is a relatively smooth-brained approach: I
reverted the .clang-format change, ran clang-format on the whole repo,
reapplied the .clang-format change, reran clang-format again, and then
reverted the commit that contained the first run. Thus the full effect
of this PR should only be to apply the changed formatting rules to the
repo, and from skimming the results, this seems to be the case.
My work can be checked by applying the short, manual commits, and then
rerunning the command listed in the autogenerated commits (those whose
messages I have prefixed auto:) and seeing if your results agree.
It might be that the other diffs should be fixed at some point but I'm
leaving that aside for now.
fd '\.c(c|pp)?$' --print0| xargs -0 clang-format -i
2024-04-25 17:38:00 +00:00
|
|
|
if (skiptests)
|
|
|
|
return;
|
2024-01-29 23:45:10 +00:00
|
|
|
if (IsAarch64() && IsQemuUser()) {
|
2024-01-04 16:25:37 +00:00
|
|
|
// clang-format off
|
2024-03-03 00:57:56 +00:00
|
|
|
// TODO(mrdomino): fix: make -j8 m=aarch64 o/aarch64/test/libc/calls/getprogramexecutablename_test.ok
|
2024-01-04 16:25:37 +00:00
|
|
|
// possibly related to the intersection of binfmt_misc and qemu-aarch64
|
|
|
|
// clang-format on
|
|
|
|
return;
|
|
|
|
}
|
2023-12-04 20:45:46 +00:00
|
|
|
char buf[BUFSIZ];
|
|
|
|
ASSERT_SYS(0, 3, open(GetProgramExecutableName(), O_RDONLY));
|
|
|
|
ASSERT_SYS(0, 4, creat("test", 0755));
|
|
|
|
ssize_t rc;
|
|
|
|
while ((rc = read(3, buf, BUFSIZ)) > 0) {
|
|
|
|
ASSERT_SYS(0, rc, write(4, buf, rc));
|
|
|
|
}
|
|
|
|
ASSERT_EQ(0, rc);
|
|
|
|
ASSERT_SYS(0, 0, close(4));
|
|
|
|
ASSERT_SYS(0, 0, close(3));
|
|
|
|
ASSERT_NE(NULL, getcwd(buf, BUFSIZ - 5));
|
|
|
|
stpcpy(buf + strlen(buf), "/test");
|
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve(buf, (char *[]){"hello", "Child", buf, skiparg0 ? 0 : "hello", 0},
|
|
|
|
(char *[]){0});
|
2023-12-05 04:01:52 +00:00
|
|
|
abort();
|
2023-12-04 20:45:46 +00:00
|
|
|
EXITS(0);
|
2024-01-01 15:23:23 +00:00
|
|
|
SPAWN(fork);
|
2024-01-06 19:42:03 +00:00
|
|
|
execve("./test", (char *[]){"hello", "Child", buf, skiparg0 ? 0 : "hello", 0},
|
2024-01-01 15:23:23 +00:00
|
|
|
(char *[]){0});
|
|
|
|
abort();
|
|
|
|
EXITS(0);
|
2023-12-04 20:45:46 +00:00
|
|
|
}
|