1 | /* |
2 | * Copyright (c) 2000-2020 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */ |
29 | /* |
30 | * Copyright (c) 1982, 1986, 1989, 1991, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * (c) UNIX System Laboratories, Inc. |
33 | * All or some portions of this file are derived from material licensed |
34 | * to the University of California by American Telephone and Telegraph |
35 | * Co. or Unix System Laboratories, Inc. and are reproduced herein with |
36 | * the permission of UNIX System Laboratories, Inc. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * 1. Redistributions of source code must retain the above copyright |
42 | * notice, this list of conditions and the following disclaimer. |
43 | * 2. Redistributions in binary form must reproduce the above copyright |
44 | * notice, this list of conditions and the following disclaimer in the |
45 | * documentation and/or other materials provided with the distribution. |
46 | * 3. All advertising materials mentioning features or use of this software |
47 | * must display the following acknowledgement: |
48 | * This product includes software developed by the University of |
49 | * California, Berkeley and its contributors. |
50 | * 4. Neither the name of the University nor the names of its contributors |
51 | * may be used to endorse or promote products derived from this software |
52 | * without specific prior written permission. |
53 | * |
54 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
55 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
56 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
57 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
58 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
59 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
60 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
61 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
62 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
63 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
64 | * SUCH DAMAGE. |
65 | * |
66 | * @(#)kern_fork.c 8.8 (Berkeley) 2/14/95 |
67 | */ |
68 | /* |
69 | * NOTICE: This file was modified by McAfee Research in 2004 to introduce |
70 | * support for mandatory and extensible security protections. This notice |
71 | * is included in support of clause 2.2 (b) of the Apple Public License, |
72 | * Version 2.0. |
73 | */ |
74 | /* |
75 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
76 | * support for mandatory and extensible security protections. This notice |
77 | * is included in support of clause 2.2 (b) of the Apple Public License, |
78 | * Version 2.0. |
79 | */ |
80 | |
81 | #include <kern/assert.h> |
82 | #include <kern/bits.h> |
83 | #include <sys/param.h> |
84 | #include <sys/systm.h> |
85 | #include <sys/filedesc.h> |
86 | #include <sys/kernel.h> |
87 | #include <sys/malloc.h> |
88 | #include <sys/proc_internal.h> |
89 | #include <sys/kauth.h> |
90 | #include <sys/user.h> |
91 | #include <sys/reason.h> |
92 | #include <sys/resourcevar.h> |
93 | #include <sys/vnode_internal.h> |
94 | #include <sys/file_internal.h> |
95 | #include <sys/acct.h> |
96 | #include <sys/codesign.h> |
97 | #include <sys/sysent.h> |
98 | #include <sys/sysproto.h> |
99 | #include <sys/ulock.h> |
100 | #if CONFIG_PERSONAS |
101 | #include <sys/persona.h> |
102 | #endif |
103 | #include <sys/doc_tombstone.h> |
104 | #if CONFIG_DTRACE |
105 | /* Do not include dtrace.h, it redefines kmem_[alloc/free] */ |
106 | extern void (*dtrace_proc_waitfor_exec_ptr)(proc_t); |
107 | extern void dtrace_proc_fork(proc_t, proc_t, int); |
108 | |
109 | /* |
110 | * Since dtrace_proc_waitfor_exec_ptr can be added/removed in dtrace_subr.c, |
111 | * we will store its value before actually calling it. |
112 | */ |
113 | static void (*dtrace_proc_waitfor_hook)(proc_t) = NULL; |
114 | |
115 | #include <sys/dtrace_ptss.h> |
116 | #endif |
117 | |
118 | #include <security/audit/audit.h> |
119 | |
120 | #include <mach/mach_types.h> |
121 | #include <kern/coalition.h> |
122 | #include <kern/kern_types.h> |
123 | #include <kern/kalloc.h> |
124 | #include <kern/mach_param.h> |
125 | #include <kern/task.h> |
126 | #include <kern/thread.h> |
127 | #include <kern/thread_call.h> |
128 | #include <kern/zalloc.h> |
129 | |
130 | #if CONFIG_MACF |
131 | #include <security/mac_framework.h> |
132 | #include <security/mac_mach_internal.h> |
133 | #endif |
134 | |
135 | #include <vm/vm_map.h> |
136 | #include <vm/vm_protos.h> |
137 | #include <vm/vm_shared_region.h> |
138 | |
139 | #include <sys/shm_internal.h> /* for shmfork() */ |
140 | #include <mach/task.h> /* for thread_create() */ |
141 | #include <mach/thread_act.h> /* for thread_resume() */ |
142 | |
143 | #include <sys/sdt.h> |
144 | |
145 | #if CONFIG_MEMORYSTATUS |
146 | #include <sys/kern_memorystatus.h> |
147 | #endif |
148 | |
149 | static const uint64_t startup_serial_num_procs = 300; |
150 | bool startup_serial_logging_active = true; |
151 | |
152 | /* XXX routines which should have Mach prototypes, but don't */ |
153 | extern void act_thread_catt(void *ctx); |
154 | void thread_set_child(thread_t child, int pid); |
155 | boolean_t thread_is_active(thread_t thread); |
156 | void *act_thread_csave(void); |
157 | extern boolean_t task_is_exec_copy(task_t); |
158 | int nextpidversion = 0; |
159 | |
160 | void ipc_task_enable(task_t task); |
161 | |
162 | proc_t forkproc(proc_t, cloneproc_flags_t); |
163 | void forkproc_free(proc_t); |
164 | thread_t fork_create_child(task_t parent_task, |
165 | coalition_t *parent_coalitions, |
166 | proc_t child, |
167 | int is_64bit_addr, |
168 | int is_64bit_data, |
169 | cloneproc_flags_t clone_flags); |
170 | |
171 | __private_extern__ const size_t uthread_size = sizeof(struct uthread); |
172 | static LCK_GRP_DECLARE(rethrottle_lock_grp, "rethrottle" ); |
173 | |
174 | os_refgrp_decl(, p_refgrp, "proc" , NULL); |
175 | |
176 | extern const size_t task_alignment; |
177 | const size_t proc_alignment = _Alignof(struct proc); |
178 | |
179 | extern size_t task_struct_size; |
180 | size_t proc_struct_size = sizeof(struct proc); |
181 | size_t proc_and_task_size; |
182 | |
183 | ZONE_DECLARE_ID(ZONE_ID_PROC_TASK, struct proc); |
184 | SECURITY_READ_ONLY_LATE(zone_t) proc_task_zone; |
185 | |
186 | KALLOC_TYPE_DEFINE(proc_stats_zone, struct pstats, KT_DEFAULT); |
187 | |
188 | /* |
189 | * fork1 |
190 | * |
191 | * Description: common code used by all new process creation other than the |
192 | * bootstrap of the initial process on the system |
193 | * |
194 | * Parameters: parent_proc parent process of the process being |
195 | * child_threadp pointer to location to receive the |
196 | * Mach thread_t of the child process |
197 | * created |
198 | * kind kind of creation being requested |
199 | * coalitions if spawn, the set of coalitions the |
200 | * child process should join, or NULL to |
201 | * inherit the parent's. On non-spawns, |
202 | * this param is ignored and the child |
203 | * always inherits the parent's |
204 | * coalitions. |
205 | * |
206 | * Notes: Permissable values for 'kind': |
207 | * |
208 | * PROC_CREATE_FORK Create a complete process which will |
209 | * return actively running in both the |
210 | * parent and the child; the child copies |
211 | * the parent address space. |
212 | * PROC_CREATE_SPAWN Create a complete process which will |
213 | * return actively running in the parent |
214 | * only after returning actively running |
215 | * in the child; the child address space |
216 | * is newly created by an image activator, |
217 | * after which the child is run. |
218 | * |
219 | * At first it may seem strange that we return the child thread |
220 | * address rather than process structure, since the process is |
221 | * the only part guaranteed to be "new"; however, since we do |
222 | * not actualy adjust other references between Mach and BSD, this |
223 | * is the only method which guarantees us the ability to get |
224 | * back to the other information. |
225 | */ |
226 | int |
227 | fork1(proc_t parent_proc, thread_t *child_threadp, int kind, coalition_t *coalitions) |
228 | { |
229 | proc_t child_proc = NULL; /* set in switch, but compiler... */ |
230 | thread_t child_thread = NULL; |
231 | uid_t uid; |
232 | size_t count; |
233 | int err = 0; |
234 | int spawn = 0; |
235 | rlim_t rlimit_nproc_cur; |
236 | |
237 | /* |
238 | * Although process entries are dynamically created, we still keep |
239 | * a global limit on the maximum number we will create. Don't allow |
240 | * a nonprivileged user to use the last process; don't let root |
241 | * exceed the limit. The variable nprocs is the current number of |
242 | * processes, maxproc is the limit. |
243 | */ |
244 | uid = kauth_getruid(); |
245 | proc_list_lock(); |
246 | if ((nprocs >= maxproc - 1 && uid != 0) || nprocs >= maxproc) { |
247 | #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX) |
248 | /* |
249 | * On the development kernel, panic so that the fact that we hit |
250 | * the process limit is obvious, as this may very well wedge the |
251 | * system. |
252 | */ |
253 | panic("The process table is full; parent pid=%d" , proc_getpid(parent_proc)); |
254 | #endif |
255 | proc_list_unlock(); |
256 | tablefull("proc" ); |
257 | return EAGAIN; |
258 | } |
259 | proc_list_unlock(); |
260 | |
261 | /* |
262 | * Increment the count of procs running with this uid. Don't allow |
263 | * a nonprivileged user to exceed their current limit, which is |
264 | * always less than what an rlim_t can hold. |
265 | * (locking protection is provided by list lock held in chgproccnt) |
266 | */ |
267 | count = chgproccnt(uid, diff: 1); |
268 | rlimit_nproc_cur = proc_limitgetcur(p: parent_proc, RLIMIT_NPROC); |
269 | if (uid != 0 && |
270 | (rlim_t)count > rlimit_nproc_cur) { |
271 | #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX) |
272 | /* |
273 | * On the development kernel, panic so that the fact that we hit |
274 | * the per user process limit is obvious. This may be less dire |
275 | * than hitting the global process limit, but we cannot rely on |
276 | * that. |
277 | */ |
278 | panic("The per-user process limit has been hit; parent pid=%d, uid=%d" , proc_getpid(parent_proc), uid); |
279 | #endif |
280 | err = EAGAIN; |
281 | goto bad; |
282 | } |
283 | |
284 | #if CONFIG_MACF |
285 | /* |
286 | * Determine if MAC policies applied to the process will allow |
287 | * it to fork. This is an advisory-only check. |
288 | */ |
289 | err = mac_proc_check_fork(proc: parent_proc); |
290 | if (err != 0) { |
291 | goto bad; |
292 | } |
293 | #endif |
294 | |
295 | switch (kind) { |
296 | case PROC_CREATE_SPAWN: |
297 | /* |
298 | * A spawned process differs from a forked process in that |
299 | * the spawned process does not carry around the parents |
300 | * baggage with regard to address space copying, dtrace, |
301 | * and so on. |
302 | */ |
303 | spawn = 1; |
304 | |
305 | OS_FALLTHROUGH; |
306 | |
307 | case PROC_CREATE_FORK: |
308 | /* |
309 | * When we clone the parent process, we are going to inherit |
310 | * its task attributes and memory, since when we fork, we |
311 | * will, in effect, create a duplicate of it, with only minor |
312 | * differences. Contrarily, spawned processes do not inherit. |
313 | */ |
314 | if ((child_thread = cloneproc(proc_task(parent_proc), |
315 | spawn ? coalitions : NULL, |
316 | parent_proc, |
317 | spawn ? CLONEPROC_SPAWN : CLONEPROC_FORK)) == NULL) { |
318 | /* Failed to create thread */ |
319 | err = EAGAIN; |
320 | goto bad; |
321 | } |
322 | |
323 | /* child_proc = child_thread->task->proc; */ |
324 | child_proc = (proc_t)(get_bsdtask_info(get_threadtask(child_thread))); |
325 | |
326 | if (!spawn) { |
327 | /* Copy current thread state into the child thread (only for fork) */ |
328 | thread_dup(child_thread); |
329 | } |
330 | |
331 | // XXX BEGIN: wants to move to be common code (and safe) |
332 | #if CONFIG_MACF |
333 | /* |
334 | * allow policies to associate the credential/label that |
335 | * we referenced from the parent ... with the child |
336 | * JMM - this really isn't safe, as we can drop that |
337 | * association without informing the policy in other |
338 | * situations (keep long enough to get policies changed) |
339 | */ |
340 | mac_cred_label_associate_fork(cred: proc_ucred_unsafe(p: child_proc), |
341 | child: child_proc); |
342 | #endif |
343 | |
344 | /* |
345 | * Propogate change of PID - may get new cred if auditing. |
346 | */ |
347 | set_security_token(p: child_proc, cred: proc_ucred_unsafe(p: child_proc)); |
348 | |
349 | AUDIT_ARG(pid, proc_getpid(child_proc)); |
350 | |
351 | // XXX END: wants to move to be common code (and safe) |
352 | |
353 | /* |
354 | * Blow thread state information; this is what gives the child |
355 | * process its "return" value from a fork() call. |
356 | * |
357 | * Note: this should probably move to fork() proper, since it |
358 | * is not relevent to spawn, and the value won't matter |
359 | * until we resume the child there. If you are in here |
360 | * refactoring code, consider doing this at the same time. |
361 | */ |
362 | thread_set_child(child: child_thread, pid: proc_getpid(child_proc)); |
363 | |
364 | child_proc->p_acflag = AFORK; /* forked but not exec'ed */ |
365 | |
366 | #if CONFIG_DTRACE |
367 | dtrace_proc_fork(parent_proc, child_proc, spawn); |
368 | #endif /* CONFIG_DTRACE */ |
369 | if (!spawn) { |
370 | /* |
371 | * Of note, we need to initialize the bank context behind |
372 | * the protection of the proc_trans lock to prevent a race with exit. |
373 | */ |
374 | task_bank_init(task: get_threadtask(child_thread)); |
375 | } |
376 | |
377 | break; |
378 | |
379 | default: |
380 | panic("fork1 called with unknown kind %d" , kind); |
381 | break; |
382 | } |
383 | |
384 | |
385 | /* return the thread pointer to the caller */ |
386 | *child_threadp = child_thread; |
387 | |
388 | bad: |
389 | /* |
390 | * In the error case, we return a 0 value for the returned pid (but |
391 | * it is ignored in the trampoline due to the error return); this |
392 | * is probably not necessary. |
393 | */ |
394 | if (err) { |
395 | (void)chgproccnt(uid, diff: -1); |
396 | } |
397 | |
398 | return err; |
399 | } |
400 | |
401 | |
402 | |
403 | |
404 | /* |
405 | * fork_create_child |
406 | * |
407 | * Description: Common operations associated with the creation of a child |
408 | * process. Return with new task and first thread's control port movable |
409 | * and not pinned. |
410 | * |
411 | * Parameters: parent_task parent task |
412 | * parent_coalitions parent's set of coalitions |
413 | * child_proc child process |
414 | * inherit_memory TRUE, if the parents address space is |
415 | * to be inherited by the child |
416 | * is_64bit_addr TRUE, if the child being created will |
417 | * be associated with a 64 bit address space |
418 | * is_64bit_data TRUE if the child being created will use a |
419 | * 64-bit register state |
420 | * in_exec TRUE, if called from execve or posix spawn set exec |
421 | * FALSE, if called from fork or vfexec |
422 | * |
423 | * Note: This code is called in the fork() case, from the execve() call |
424 | * graph, from the posix_spawn() call graph (which implicitly |
425 | * includes a vfork() equivalent call, and in the system |
426 | * bootstrap case. |
427 | * |
428 | * It creates a new task and thread (and as a side effect of the |
429 | * thread creation, a uthread) in the parent coalition set, which is |
430 | * then associated with the process 'child'. If the parent |
431 | * process address space is to be inherited, then a flag |
432 | * indicates that the newly created task should inherit this from |
433 | * the child task. |
434 | * |
435 | * As a special concession to bootstrapping the initial process |
436 | * in the system, it's possible for 'parent_task' to be TASK_NULL; |
437 | * in this case, 'inherit_memory' MUST be FALSE. |
438 | */ |
439 | thread_t |
440 | fork_create_child(task_t parent_task, |
441 | coalition_t *parent_coalitions, |
442 | proc_t child_proc, |
443 | int is_64bit_addr, |
444 | int is_64bit_data, |
445 | cloneproc_flags_t clone_flags) |
446 | { |
447 | thread_t child_thread = NULL; |
448 | task_t child_task; |
449 | kern_return_t result; |
450 | proc_ro_t proc_ro; |
451 | bool inherit_memory = !!(clone_flags & CLONEPROC_FORK); |
452 | bool in_exec = !!(clone_flags & CLONEPROC_EXEC); |
453 | /* |
454 | * Exec complete hook should be called for spawn and exec, but not for fork. |
455 | */ |
456 | uint8_t returnwaitflags = (!inherit_memory ? TRW_LEXEC_COMPLETE : 0) | |
457 | (TRW_LRETURNWAIT | TRW_LRETURNWAITER); |
458 | |
459 | proc_ro = proc_get_ro(p: child_proc); |
460 | if (proc_ro_task(pr: proc_ro) != NULL) { |
461 | panic("Proc_ro_task for newly created proc %p is not NULL" , child_proc); |
462 | } |
463 | |
464 | child_task = proc_get_task_raw(proc: child_proc); |
465 | |
466 | /* |
467 | * Create a new task for the child process, IPC access to the new task will |
468 | * be set up after task has been fully initialized. |
469 | */ |
470 | result = task_create_internal(parent_task, |
471 | proc_ro, |
472 | parent_coalitions, |
473 | inherit_memory, |
474 | is_64bit: is_64bit_addr, |
475 | is_64bit_data, |
476 | TF_NONE, |
477 | TF_NONE, |
478 | procflags: in_exec ? TPF_EXEC_COPY : TPF_NONE, /* Mark the task exec copy if in execve */ |
479 | t_returnwaitflags: returnwaitflags, /* All created threads will wait in task_wait_to_return */ |
480 | child_task); |
481 | if (result != KERN_SUCCESS) { |
482 | printf("%s: task_create_internal failed. Code: %d\n" , |
483 | __func__, result); |
484 | goto bad; |
485 | } |
486 | |
487 | /* Set the child proc process to child task */ |
488 | proc_set_task(child_proc, child_task); |
489 | |
490 | /* Set child task process to child proc */ |
491 | set_bsdtask_info(child_task, child_proc); |
492 | |
493 | /* Propagate CPU limit timer from parent */ |
494 | if (timerisset(&child_proc->p_rlim_cpu)) { |
495 | task_vtimer_set(task: child_task, TASK_VTIMER_RLIM); |
496 | } |
497 | |
498 | /* |
499 | * Set child process BSD visible scheduler priority if nice value |
500 | * inherited from parent |
501 | */ |
502 | if (child_proc->p_nice != 0) { |
503 | resetpriority(child_proc); |
504 | } |
505 | |
506 | /* |
507 | * Create main thread for the child process. Its control port is not immovable/pinned |
508 | * until main_thread_set_immovable_pinned(). |
509 | * |
510 | * The new thread is waiting on the event triggered by 'task_clear_return_wait' |
511 | */ |
512 | result = main_thread_create_waiting(task: child_task, |
513 | continuation: (thread_continue_t)task_wait_to_return, |
514 | event: task_get_return_wait_event(task: child_task), |
515 | new_thread: &child_thread); |
516 | |
517 | if (result != KERN_SUCCESS) { |
518 | printf("%s: thread_create failed. Code: %d\n" , |
519 | __func__, result); |
520 | task_deallocate(child_task); |
521 | child_task = NULL; |
522 | } |
523 | |
524 | /* |
525 | * Tag thread as being the first thread in its task. |
526 | */ |
527 | thread_set_tag(thread: child_thread, tag: THREAD_TAG_MAINTHREAD); |
528 | |
529 | bad: |
530 | thread_yield_internal(interval: 1); |
531 | |
532 | return child_thread; |
533 | } |
534 | |
535 | |
536 | /* |
537 | * fork |
538 | * |
539 | * Description: fork system call. |
540 | * |
541 | * Parameters: parent Parent process to fork |
542 | * uap (void) [unused] |
543 | * retval Return value |
544 | * |
545 | * Returns: 0 Success |
546 | * EAGAIN Resource unavailable, try again |
547 | * |
548 | * Notes: Attempts to create a new child process which inherits state |
549 | * from the parent process. If successful, the call returns |
550 | * having created an initially suspended child process with an |
551 | * extra Mach task and thread reference, for which the thread |
552 | * is initially suspended. Until we resume the child process, |
553 | * it is not yet running. |
554 | * |
555 | * The return information to the child is contained in the |
556 | * thread state structure of the new child, and does not |
557 | * become visible to the child through a normal return process, |
558 | * since it never made the call into the kernel itself in the |
559 | * first place. |
560 | * |
561 | * After resuming the thread, this function returns directly to |
562 | * the parent process which invoked the fork() system call. |
563 | * |
564 | * Important: The child thread_resume occurs before the parent returns; |
565 | * depending on scheduling latency, this means that it is not |
566 | * deterministic as to whether the parent or child is scheduled |
567 | * to run first. It is entirely possible that the child could |
568 | * run to completion prior to the parent running. |
569 | */ |
570 | int |
571 | fork(proc_t parent_proc, __unused struct fork_args *uap, int32_t *retval) |
572 | { |
573 | thread_t child_thread; |
574 | int err; |
575 | |
576 | retval[1] = 0; /* flag parent return for user space */ |
577 | |
578 | if ((err = fork1(parent_proc, child_threadp: &child_thread, PROC_CREATE_FORK, NULL)) == 0) { |
579 | task_t child_task; |
580 | proc_t child_proc; |
581 | |
582 | /* Return to the parent */ |
583 | child_proc = (proc_t)get_bsdthreadtask_info(child_thread); |
584 | retval[0] = proc_getpid(child_proc); |
585 | |
586 | child_task = (task_t)get_threadtask(child_thread); |
587 | assert(child_task != TASK_NULL); |
588 | |
589 | /* task_control_port_options has been inherited from parent, apply it */ |
590 | task_set_immovable_pinned(task: child_task); |
591 | main_thread_set_immovable_pinned(thread: child_thread); |
592 | |
593 | /* |
594 | * Since the task ports for this new task are now set to be immovable, |
595 | * we can enable them. |
596 | */ |
597 | ipc_task_enable(task: get_threadtask(child_thread)); |
598 | |
599 | /* |
600 | * Drop the signal lock on the child which was taken on our |
601 | * behalf by forkproc()/cloneproc() to prevent signals being |
602 | * received by the child in a partially constructed state. |
603 | */ |
604 | proc_signalend(child_proc, locked: 0); |
605 | proc_transend(child_proc, locked: 0); |
606 | |
607 | /* flag the fork has occurred */ |
608 | proc_knote(p: parent_proc, NOTE_FORK | proc_getpid(child_proc)); |
609 | DTRACE_PROC1(create, proc_t, child_proc); |
610 | |
611 | #if CONFIG_DTRACE |
612 | if ((dtrace_proc_waitfor_hook = dtrace_proc_waitfor_exec_ptr) != NULL) { |
613 | (*dtrace_proc_waitfor_hook)(child_proc); |
614 | } |
615 | #endif |
616 | |
617 | /* |
618 | * If current process died during the fork, the child would contain |
619 | * non consistent vmmap, kill the child and reap it internally. |
620 | */ |
621 | if (parent_proc->p_lflag & P_LEXIT || !thread_is_active(thread: current_thread())) { |
622 | task_terminate_internal(task: child_task); |
623 | proc_list_lock(); |
624 | child_proc->p_listflag |= P_LIST_DEADPARENT; |
625 | proc_list_unlock(); |
626 | } |
627 | |
628 | /* "Return" to the child */ |
629 | task_clear_return_wait(task: get_threadtask(child_thread), TCRW_CLEAR_ALL_WAIT); |
630 | |
631 | /* drop the extra references we got during the creation */ |
632 | task_deallocate(child_task); |
633 | thread_deallocate(thread: child_thread); |
634 | } |
635 | |
636 | return err; |
637 | } |
638 | |
639 | |
640 | /* |
641 | * cloneproc |
642 | * |
643 | * Description: Create a new process from a specified process. |
644 | * |
645 | * Parameters: parent_task The parent task to be cloned, or |
646 | * TASK_NULL is task characteristics |
647 | * are not to be inherited |
648 | * be cloned, or TASK_NULL if the new |
649 | * task is not to inherit the VM |
650 | * characteristics of the parent |
651 | * parent_proc The parent process to be cloned |
652 | * clone_flags Clone flags to specify if the cloned |
653 | * process should inherit memory, |
654 | * marked as memory stat internal, |
655 | * or if the cloneproc is called for exec. |
656 | * |
657 | * Returns: !NULL pointer to new child thread |
658 | * NULL Failure (unspecified) |
659 | * |
660 | * Note: On return newly created child process has signal lock held |
661 | * to block delivery of signal to it if called with lock set. |
662 | * fork() code needs to explicity remove this lock before |
663 | * signals can be delivered |
664 | * |
665 | * In the case of bootstrap, this function can be called from |
666 | * bsd_utaskbootstrap() in order to bootstrap the first process; |
667 | * the net effect is to provide a uthread structure for the |
668 | * kernel process associated with the kernel task. |
669 | * |
670 | * XXX: Tristating using the value parent_task as the major key |
671 | * and inherit_memory as the minor key is something we should |
672 | * refactor later; we owe the current semantics, ultimately, |
673 | * to the semantics of task_create_internal. For now, we will |
674 | * live with this being somewhat awkward. |
675 | */ |
676 | thread_t |
677 | cloneproc(task_t parent_task, coalition_t *parent_coalitions, proc_t parent_proc, cloneproc_flags_t clone_flags) |
678 | { |
679 | #if !CONFIG_MEMORYSTATUS |
680 | #pragma unused(cloning_initproc) |
681 | #endif |
682 | task_t child_task; |
683 | proc_t child_proc; |
684 | thread_t child_thread = NULL; |
685 | bool cloning_initproc = !!(clone_flags & CLONEPROC_INITPROC); |
686 | bool in_exec = !!(clone_flags & CLONEPROC_EXEC); |
687 | |
688 | if ((child_proc = forkproc(parent_proc, clone_flags)) == NULL) { |
689 | /* Failed to allocate new process */ |
690 | goto bad; |
691 | } |
692 | |
693 | /* |
694 | * In the case where the parent_task is TASK_NULL (during the init path) |
695 | * we make the assumption that the register size will be the same as the |
696 | * address space size since there's no way to determine the possible |
697 | * register size until an image is exec'd. |
698 | * |
699 | * The only architecture that has different address space and register sizes |
700 | * (arm64_32) isn't being used within kernel-space, so the above assumption |
701 | * always holds true for the init path. |
702 | */ |
703 | const int parent_64bit_addr = parent_proc->p_flag & P_LP64; |
704 | const int parent_64bit_data = (parent_task == TASK_NULL) ? parent_64bit_addr : task_get_64bit_data(task: parent_task); |
705 | |
706 | child_thread = fork_create_child(parent_task, |
707 | parent_coalitions, |
708 | child_proc, |
709 | is_64bit_addr: parent_64bit_addr, |
710 | is_64bit_data: parent_64bit_data, |
711 | clone_flags); |
712 | |
713 | if (child_thread == NULL) { |
714 | /* |
715 | * Failed to create thread; now we must deconstruct the new |
716 | * process previously obtained from forkproc(). |
717 | */ |
718 | forkproc_free(child_proc); |
719 | goto bad; |
720 | } |
721 | |
722 | child_task = get_threadtask(child_thread); |
723 | if (parent_64bit_addr) { |
724 | OSBitOrAtomic(P_LP64, (UInt32 *)&child_proc->p_flag); |
725 | get_bsdthread_info(child_thread)->uu_flag |= UT_LP64; |
726 | } else { |
727 | OSBitAndAtomic(~((uint32_t)P_LP64), (UInt32 *)&child_proc->p_flag); |
728 | get_bsdthread_info(child_thread)->uu_flag &= ~UT_LP64; |
729 | } |
730 | |
731 | #if CONFIG_MEMORYSTATUS |
732 | if (cloning_initproc || |
733 | (in_exec && (parent_proc->p_memstat_state & P_MEMSTAT_INTERNAL))) { |
734 | proc_list_lock(); |
735 | child_proc->p_memstat_state |= P_MEMSTAT_INTERNAL; |
736 | child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_INTERNAL; |
737 | child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_INTERNAL; |
738 | proc_list_unlock(); |
739 | } |
740 | if (in_exec && parent_proc->p_memstat_relaunch_flags != P_MEMSTAT_RELAUNCH_UNKNOWN) { |
741 | memorystatus_relaunch_flags_update(p: child_proc, relaunch_flags: parent_proc->p_memstat_relaunch_flags); |
742 | } |
743 | #endif |
744 | |
745 | /* make child visible */ |
746 | pinsertchild(parent: parent_proc, child: child_proc, in_exec); |
747 | |
748 | /* |
749 | * Make child runnable, set start time. |
750 | */ |
751 | child_proc->p_stat = SRUN; |
752 | bad: |
753 | return child_thread; |
754 | } |
755 | |
756 | void |
757 | proc_set_sigact(proc_t p, int sig, user_addr_t sigact) |
758 | { |
759 | assert((sig > 0) && (sig < NSIG)); |
760 | |
761 | p->p_sigacts.ps_sigact[sig] = sigact; |
762 | } |
763 | |
764 | void |
765 | proc_set_trampact(proc_t p, int sig, user_addr_t trampact) |
766 | { |
767 | assert((sig > 0) && (sig < NSIG)); |
768 | |
769 | p->p_sigacts.ps_trampact[sig] = trampact; |
770 | } |
771 | |
772 | void |
773 | proc_set_sigact_trampact(proc_t p, int sig, user_addr_t sigact, user_addr_t trampact) |
774 | { |
775 | assert((sig > 0) && (sig < NSIG)); |
776 | |
777 | p->p_sigacts.ps_sigact[sig] = sigact; |
778 | p->p_sigacts.ps_trampact[sig] = trampact; |
779 | } |
780 | |
781 | void |
782 | proc_reset_sigact(proc_t p, sigset_t sigs) |
783 | { |
784 | user_addr_t *sigacts = p->p_sigacts.ps_sigact; |
785 | int nc; |
786 | |
787 | while (sigs) { |
788 | nc = ffs((unsigned int)sigs); |
789 | if (sigacts[nc] != SIG_DFL) { |
790 | sigacts[nc] = SIG_DFL; |
791 | } |
792 | sigs &= ~sigmask(nc); |
793 | } |
794 | } |
795 | |
796 | /* |
797 | * Destroy a process structure that resulted from a call to forkproc(), but |
798 | * which must be returned to the system because of a subsequent failure |
799 | * preventing it from becoming active. |
800 | * |
801 | * Parameters: p The incomplete process from forkproc() |
802 | * |
803 | * Returns: (void) |
804 | * |
805 | * Note: This function should only be used in an error handler following |
806 | * a call to forkproc(). |
807 | * |
808 | * Operations occur in reverse order of those in forkproc(). |
809 | */ |
810 | void |
811 | forkproc_free(proc_t p) |
812 | { |
813 | struct pgrp *pg; |
814 | |
815 | #if CONFIG_PERSONAS |
816 | persona_proc_drop(p); |
817 | #endif /* CONFIG_PERSONAS */ |
818 | |
819 | #if PSYNCH |
820 | pth_proc_hashdelete(p); |
821 | #endif /* PSYNCH */ |
822 | |
823 | /* We held signal and a transition locks; drop them */ |
824 | proc_signalend(p, locked: 0); |
825 | proc_transend(p, locked: 0); |
826 | |
827 | /* |
828 | * If we have our own copy of the resource limits structure, we |
829 | * need to free it. If it's a shared copy, we need to drop our |
830 | * reference on it. |
831 | */ |
832 | proc_limitdrop(p); |
833 | |
834 | #if SYSV_SHM |
835 | /* Need to drop references to the shared memory segment(s), if any */ |
836 | if (p->vm_shm) { |
837 | /* |
838 | * Use shmexec(): we have no address space, so no mappings |
839 | * |
840 | * XXX Yes, the routine is badly named. |
841 | */ |
842 | shmexec(p); |
843 | } |
844 | #endif |
845 | |
846 | /* Need to undo the effects of the fdt_fork(), if any */ |
847 | fdt_invalidate(p); |
848 | fdt_destroy(p); |
849 | |
850 | /* |
851 | * Drop the reference on a text vnode pointer, if any |
852 | * XXX This code is broken in forkproc(); see <rdar://4256419>; |
853 | * XXX if anyone ever uses this field, we will be extremely unhappy. |
854 | */ |
855 | if (p->p_textvp) { |
856 | vnode_rele(vp: p->p_textvp); |
857 | p->p_textvp = NULL; |
858 | } |
859 | |
860 | /* Update the audit session proc count */ |
861 | AUDIT_SESSION_PROCEXIT(p); |
862 | |
863 | lck_mtx_destroy(lck: &p->p_mlock, grp: &proc_mlock_grp); |
864 | lck_mtx_destroy(lck: &p->p_ucred_mlock, grp: &proc_ucred_mlock_grp); |
865 | #if CONFIG_AUDIT |
866 | lck_mtx_destroy(lck: &p->p_audit_mlock, grp: &proc_ucred_mlock_grp); |
867 | #endif /* CONFIG_AUDIT */ |
868 | #if CONFIG_DTRACE |
869 | lck_mtx_destroy(lck: &p->p_dtrace_sprlock, grp: &proc_lck_grp); |
870 | #endif |
871 | lck_spin_destroy(lck: &p->p_slock, grp: &proc_slock_grp); |
872 | |
873 | proc_list_lock(); |
874 | /* Decrement the count of processes in the system */ |
875 | nprocs--; |
876 | |
877 | /* quit the group */ |
878 | pg = pgrp_leave_locked(p); |
879 | |
880 | /* Take it out of process hash */ |
881 | assert((os_ref_get_raw_mask(&p->p_refcount) >> P_REF_BITS) == 1); |
882 | assert((os_ref_get_raw_mask(&p->p_refcount) & P_REF_NEW) == P_REF_NEW); |
883 | os_atomic_xor(&p->p_refcount, P_REF_NEW | P_REF_DEAD, relaxed); |
884 | |
885 | /* Remove from hash if not a shadow proc */ |
886 | if (!proc_is_shadow(p)) { |
887 | phash_remove_locked(p); |
888 | } |
889 | |
890 | proc_list_unlock(); |
891 | |
892 | pgrp_rele(pgrp: pg); |
893 | |
894 | thread_call_free(call: p->p_rcall); |
895 | |
896 | /* Free allocated memory */ |
897 | zfree(proc_stats_zone, p->p_stats); |
898 | p->p_stats = NULL; |
899 | if (p->p_subsystem_root_path) { |
900 | zfree(ZV_NAMEI, p->p_subsystem_root_path); |
901 | p->p_subsystem_root_path = NULL; |
902 | } |
903 | |
904 | proc_checkdeadrefs(p); |
905 | proc_wait_release(p); |
906 | } |
907 | |
908 | |
909 | /* |
910 | * forkproc |
911 | * |
912 | * Description: Create a new process structure, given a parent process |
913 | * structure. |
914 | * |
915 | * Parameters: parent_proc The parent process |
916 | * |
917 | * Returns: !NULL The new process structure |
918 | * NULL Error (insufficient free memory) |
919 | * |
920 | * Note: When successful, the newly created process structure is |
921 | * partially initialized; if a caller needs to deconstruct the |
922 | * returned structure, they must call forkproc_free() to do so. |
923 | */ |
924 | proc_t |
925 | forkproc(proc_t parent_proc, cloneproc_flags_t clone_flags) |
926 | { |
927 | static uint64_t nextuniqueid = 0; |
928 | static pid_t lastpid = 0; |
929 | |
930 | proc_t child_proc; /* Our new process */ |
931 | int error = 0; |
932 | struct pgrp *pg; |
933 | uthread_t parent_uthread = current_uthread(); |
934 | rlim_t rlimit_cpu_cur; |
935 | pid_t pid; |
936 | struct proc_ro_data proc_ro_data = {}; |
937 | bool in_exec = !!(clone_flags & CLONEPROC_EXEC); |
938 | bool in_fork = !!(clone_flags & CLONEPROC_FORK); |
939 | |
940 | child_proc = zalloc_flags(proc_task_zone, Z_WAITOK | Z_ZERO); |
941 | |
942 | child_proc->p_stats = zalloc_flags(proc_stats_zone, Z_WAITOK | Z_ZERO); |
943 | child_proc->p_sigacts = parent_proc->p_sigacts; |
944 | os_ref_init_mask(&child_proc->p_refcount, P_REF_BITS, &p_refgrp, P_REF_NEW); |
945 | os_ref_init_raw(&child_proc->p_waitref, &p_refgrp); |
946 | proc_ref_hold_proc_task_struct(proc: child_proc); |
947 | |
948 | /* allocate a callout for use by interval timers */ |
949 | child_proc->p_rcall = thread_call_allocate(func: (thread_call_func_t)realitexpire, param0: child_proc); |
950 | |
951 | |
952 | /* |
953 | * Find an unused PID. |
954 | */ |
955 | |
956 | fdt_init(p: child_proc); |
957 | |
958 | proc_list_lock(); |
959 | |
960 | if (!in_exec) { |
961 | pid = lastpid; |
962 | do { |
963 | /* |
964 | * If the process ID prototype has wrapped around, |
965 | * restart somewhat above 0, as the low-numbered procs |
966 | * tend to include daemons that don't exit. |
967 | */ |
968 | if (++pid >= PID_MAX) { |
969 | pid = 100; |
970 | } |
971 | if (pid == lastpid) { |
972 | panic("Unable to allocate a new pid" ); |
973 | } |
974 | |
975 | /* if the pid stays in hash both for zombie and runniing state */ |
976 | } while (phash_find_locked(pid) != PROC_NULL || |
977 | pghash_exists_locked(pid) || |
978 | session_find_locked(sessid: pid) != SESSION_NULL); |
979 | |
980 | lastpid = pid; |
981 | nprocs++; |
982 | |
983 | child_proc->p_pid = pid; |
984 | proc_ro_data.p_idversion = OSIncrementAtomic(&nextpidversion); |
985 | /* kernel process is handcrafted and not from fork, so start from 1 */ |
986 | proc_ro_data.p_uniqueid = ++nextuniqueid; |
987 | |
988 | /* Insert in the hash, and inherit our group (and session) */ |
989 | phash_insert_locked(child_proc); |
990 | |
991 | /* Check if the proc is from App Cryptex */ |
992 | if (parent_proc->p_ladvflag & P_RSR) { |
993 | os_atomic_or(&child_proc->p_ladvflag, P_RSR, relaxed); |
994 | } |
995 | } else { |
996 | /* For exec copy of the proc, copy the pid, pidversion and uniqueid of original proc */ |
997 | pid = parent_proc->p_pid; |
998 | child_proc->p_pid = pid; |
999 | proc_ro_data.p_idversion = parent_proc->p_proc_ro->p_idversion; |
1000 | proc_ro_data.p_uniqueid = parent_proc->p_proc_ro->p_uniqueid; |
1001 | |
1002 | nprocs++; |
1003 | os_atomic_or(&child_proc->p_refcount, P_REF_SHADOW, relaxed); |
1004 | } |
1005 | pg = pgrp_enter_locked(parent: parent_proc, p: child_proc); |
1006 | proc_list_unlock(); |
1007 | |
1008 | if (proc_ro_data.p_uniqueid == startup_serial_num_procs) { |
1009 | /* |
1010 | * Turn off startup serial logging now that we have reached |
1011 | * the defined number of startup processes. |
1012 | */ |
1013 | startup_serial_logging_active = false; |
1014 | } |
1015 | |
1016 | /* |
1017 | * We've identified the PID we are going to use; |
1018 | * initialize the new process structure. |
1019 | */ |
1020 | child_proc->p_stat = SIDL; |
1021 | |
1022 | /* |
1023 | * The zero'ing of the proc was at the allocation time due to need |
1024 | * for insertion to hash. Copy the section that is to be copied |
1025 | * directly from the parent. |
1026 | */ |
1027 | child_proc->p_forkcopy = parent_proc->p_forkcopy; |
1028 | |
1029 | proc_ro_data.syscall_filter_mask = proc_syscall_filter_mask(parent_proc); |
1030 | proc_ro_data.p_platform_data = proc_get_ro(p: parent_proc)->p_platform_data; |
1031 | |
1032 | /* |
1033 | * Some flags are inherited from the parent. |
1034 | * Duplicate sub-structures as needed. |
1035 | * Increase reference counts on shared objects. |
1036 | * The p_stats substruct is set in vm_fork. |
1037 | */ |
1038 | #if CONFIG_DELAY_IDLE_SLEEP |
1039 | child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_DELAYIDLESLEEP | P_SUGID | P_AFFINITY)); |
1040 | #else /* CONFIG_DELAY_IDLE_SLEEP */ |
1041 | child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_SUGID | P_AFFINITY)); |
1042 | #endif /* CONFIG_DELAY_IDLE_SLEEP */ |
1043 | |
1044 | child_proc->p_vfs_iopolicy = (parent_proc->p_vfs_iopolicy & (P_VFS_IOPOLICY_INHERITED_MASK)); |
1045 | |
1046 | proc_set_responsible_pid(target_proc: child_proc, responsible_pid: parent_proc->p_responsible_pid); |
1047 | |
1048 | /* |
1049 | * Note that if the current thread has an assumed identity, this |
1050 | * credential will be granted to the new process. |
1051 | * This is OK to do in exec, because it will be over-written during image activation |
1052 | * before the proc is visible. |
1053 | */ |
1054 | kauth_cred_set(&proc_ro_data.p_ucred.__smr_ptr, kauth_cred_get()); |
1055 | |
1056 | lck_mtx_init(lck: &child_proc->p_mlock, grp: &proc_mlock_grp, attr: &proc_lck_attr); |
1057 | lck_mtx_init(lck: &child_proc->p_ucred_mlock, grp: &proc_ucred_mlock_grp, attr: &proc_lck_attr); |
1058 | #if CONFIG_AUDIT |
1059 | lck_mtx_init(lck: &child_proc->p_audit_mlock, grp: &proc_ucred_mlock_grp, attr: &proc_lck_attr); |
1060 | #endif /* CONFIG_AUDIT */ |
1061 | #if CONFIG_DTRACE |
1062 | lck_mtx_init(lck: &child_proc->p_dtrace_sprlock, grp: &proc_lck_grp, attr: &proc_lck_attr); |
1063 | #endif |
1064 | lck_spin_init(lck: &child_proc->p_slock, grp: &proc_slock_grp, attr: &proc_lck_attr); |
1065 | |
1066 | klist_init(list: &child_proc->p_klist); |
1067 | |
1068 | if (child_proc->p_textvp != NULLVP) { |
1069 | /* bump references to the text vnode */ |
1070 | /* Need to hold iocount across the ref call */ |
1071 | if ((error = vnode_getwithref(vp: child_proc->p_textvp)) == 0) { |
1072 | error = vnode_ref(vp: child_proc->p_textvp); |
1073 | vnode_put(vp: child_proc->p_textvp); |
1074 | } |
1075 | |
1076 | if (error != 0) { |
1077 | child_proc->p_textvp = NULLVP; |
1078 | } |
1079 | } |
1080 | uint64_t csflag_inherit_mask = ~CS_KILLED; |
1081 | if (!in_fork) { |
1082 | /* All non-fork paths should not inherit GTA flag */ |
1083 | csflag_inherit_mask &= ~CS_GET_TASK_ALLOW; |
1084 | } |
1085 | proc_ro_data.p_csflags = ((uint32_t)proc_getcsflags(parent_proc) & csflag_inherit_mask); |
1086 | |
1087 | child_proc->p_proc_ro = proc_ro_alloc(p: child_proc, p_data: &proc_ro_data, NULL, NULL); |
1088 | |
1089 | /* update cred on proc */ |
1090 | proc_update_creds_onproc(child_proc, cred: proc_ucred_unsafe(p: child_proc)); |
1091 | |
1092 | /* update audit session proc count */ |
1093 | AUDIT_SESSION_PROCNEW(child_proc); |
1094 | |
1095 | /* |
1096 | * Copy the parents per process open file table to the child; if |
1097 | * there is a per-thread current working directory, set the childs |
1098 | * per-process current working directory to that instead of the |
1099 | * parents. |
1100 | */ |
1101 | if (fdt_fork(child_fdt: &child_proc->p_fd, parent_p: parent_proc, uth_cdir: parent_uthread->uu_cdir, in_exec) != 0) { |
1102 | forkproc_free(p: child_proc); |
1103 | child_proc = NULL; |
1104 | goto bad; |
1105 | } |
1106 | |
1107 | #if SYSV_SHM |
1108 | if (parent_proc->vm_shm && !in_exec) { |
1109 | /* XXX may fail to attach shm to child */ |
1110 | (void)shmfork(parent_proc, child_proc); |
1111 | } |
1112 | #endif |
1113 | |
1114 | /* |
1115 | * Child inherits the parent's plimit |
1116 | */ |
1117 | proc_limitfork(parent: parent_proc, child: child_proc); |
1118 | |
1119 | rlimit_cpu_cur = proc_limitgetcur(p: child_proc, RLIMIT_CPU); |
1120 | if (rlimit_cpu_cur != RLIM_INFINITY) { |
1121 | child_proc->p_rlim_cpu.tv_sec = (rlimit_cpu_cur > __INT_MAX__) ? __INT_MAX__ : rlimit_cpu_cur; |
1122 | } |
1123 | |
1124 | if (in_exec) { |
1125 | /* Keep the original start time for exec'ed proc */ |
1126 | child_proc->p_stats->ps_start = parent_proc->p_stats->ps_start; |
1127 | child_proc->p_start.tv_sec = parent_proc->p_start.tv_sec; |
1128 | child_proc->p_start.tv_usec = parent_proc->p_start.tv_usec; |
1129 | } else { |
1130 | /* Intialize new process stats, including start time */ |
1131 | /* <rdar://6640543> non-zeroed portion contains garbage AFAICT */ |
1132 | microtime_with_abstime(tv: &child_proc->p_start, abstime: &child_proc->p_stats->ps_start); |
1133 | } |
1134 | |
1135 | if (pg->pg_session->s_ttyvp != NULL && parent_proc->p_flag & P_CONTROLT) { |
1136 | os_atomic_or(&child_proc->p_flag, P_CONTROLT, relaxed); |
1137 | } |
1138 | |
1139 | /* |
1140 | * block all signals to reach the process. |
1141 | * no transition race should be occuring with the child yet, |
1142 | * but indicate that the process is in (the creation) transition. |
1143 | */ |
1144 | proc_signalstart(child_proc, locked: 0); |
1145 | proc_transstart(child_proc, locked: 0, non_blocking: 0); |
1146 | |
1147 | child_proc->p_pcaction = 0; |
1148 | |
1149 | TAILQ_INIT(&child_proc->p_uthlist); |
1150 | TAILQ_INIT(&child_proc->p_aio_activeq); |
1151 | TAILQ_INIT(&child_proc->p_aio_doneq); |
1152 | |
1153 | /* |
1154 | * Copy work queue information |
1155 | * |
1156 | * Note: This should probably only happen in the case where we are |
1157 | * creating a child that is a copy of the parent; since this |
1158 | * routine is called in the non-duplication case of vfork() |
1159 | * or posix_spawn(), then this information should likely not |
1160 | * be duplicated. |
1161 | * |
1162 | * <rdar://6640553> Work queue pointers that no longer point to code |
1163 | */ |
1164 | child_proc->p_wqthread = parent_proc->p_wqthread; |
1165 | child_proc->p_threadstart = parent_proc->p_threadstart; |
1166 | child_proc->p_pthsize = parent_proc->p_pthsize; |
1167 | if ((parent_proc->p_lflag & P_LREGISTER) != 0) { |
1168 | child_proc->p_lflag |= P_LREGISTER; |
1169 | } |
1170 | child_proc->p_dispatchqueue_offset = parent_proc->p_dispatchqueue_offset; |
1171 | child_proc->p_dispatchqueue_serialno_offset = parent_proc->p_dispatchqueue_serialno_offset; |
1172 | child_proc->p_dispatchqueue_label_offset = parent_proc->p_dispatchqueue_label_offset; |
1173 | child_proc->p_return_to_kernel_offset = parent_proc->p_return_to_kernel_offset; |
1174 | child_proc->p_mach_thread_self_offset = parent_proc->p_mach_thread_self_offset; |
1175 | child_proc->p_pth_tsd_offset = parent_proc->p_pth_tsd_offset; |
1176 | child_proc->p_pthread_wq_quantum_offset = parent_proc->p_pthread_wq_quantum_offset; |
1177 | #if PSYNCH |
1178 | pth_proc_hashinit(child_proc); |
1179 | #endif /* PSYNCH */ |
1180 | |
1181 | #if CONFIG_PERSONAS |
1182 | child_proc->p_persona = NULL; |
1183 | if (parent_proc->p_persona) { |
1184 | struct persona *persona = proc_persona_get(p: parent_proc); |
1185 | |
1186 | if (persona) { |
1187 | error = persona_proc_adopt(p: child_proc, persona, NULL); |
1188 | if (error != 0) { |
1189 | printf("forkproc: persona_proc_inherit failed (persona %d being destroyed?)\n" , |
1190 | persona_get_id(persona)); |
1191 | forkproc_free(p: child_proc); |
1192 | child_proc = NULL; |
1193 | goto bad; |
1194 | } |
1195 | } |
1196 | } |
1197 | #endif |
1198 | |
1199 | #if CONFIG_MEMORYSTATUS |
1200 | /* Memorystatus init */ |
1201 | child_proc->p_memstat_state = 0; |
1202 | child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_DEFAULT; |
1203 | child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_DEFAULT; |
1204 | child_proc->p_memstat_assertionpriority = 0; |
1205 | child_proc->p_memstat_userdata = 0; |
1206 | child_proc->p_memstat_idle_start = 0; |
1207 | child_proc->p_memstat_idle_delta = 0; |
1208 | child_proc->p_memstat_memlimit = 0; |
1209 | child_proc->p_memstat_memlimit_active = 0; |
1210 | child_proc->p_memstat_memlimit_inactive = 0; |
1211 | child_proc->p_memstat_relaunch_flags = P_MEMSTAT_RELAUNCH_UNKNOWN; |
1212 | #if CONFIG_FREEZE |
1213 | child_proc->p_memstat_freeze_sharedanon_pages = 0; |
1214 | #endif |
1215 | child_proc->p_memstat_dirty = 0; |
1216 | child_proc->p_memstat_idledeadline = 0; |
1217 | #endif /* CONFIG_MEMORYSTATUS */ |
1218 | |
1219 | if (parent_proc->p_subsystem_root_path) { |
1220 | size_t parent_length = strlen(s: parent_proc->p_subsystem_root_path) + 1; |
1221 | assert(parent_length <= MAXPATHLEN); |
1222 | child_proc->p_subsystem_root_path = zalloc_flags(ZV_NAMEI, |
1223 | Z_WAITOK | Z_ZERO); |
1224 | memcpy(dst: child_proc->p_subsystem_root_path, src: parent_proc->p_subsystem_root_path, n: parent_length); |
1225 | } |
1226 | |
1227 | bad: |
1228 | return child_proc; |
1229 | } |
1230 | |
1231 | void |
1232 | proc_lock(proc_t p) |
1233 | { |
1234 | LCK_MTX_ASSERT(&proc_list_mlock, LCK_MTX_ASSERT_NOTOWNED); |
1235 | lck_mtx_lock(lck: &p->p_mlock); |
1236 | } |
1237 | |
1238 | void |
1239 | proc_unlock(proc_t p) |
1240 | { |
1241 | lck_mtx_unlock(lck: &p->p_mlock); |
1242 | } |
1243 | |
1244 | void |
1245 | proc_spinlock(proc_t p) |
1246 | { |
1247 | lck_spin_lock_grp(lck: &p->p_slock, grp: &proc_slock_grp); |
1248 | } |
1249 | |
1250 | void |
1251 | proc_spinunlock(proc_t p) |
1252 | { |
1253 | lck_spin_unlock(lck: &p->p_slock); |
1254 | } |
1255 | |
1256 | void |
1257 | proc_list_lock(void) |
1258 | { |
1259 | lck_mtx_lock(lck: &proc_list_mlock); |
1260 | } |
1261 | |
1262 | void |
1263 | proc_list_unlock(void) |
1264 | { |
1265 | lck_mtx_unlock(lck: &proc_list_mlock); |
1266 | } |
1267 | |
1268 | void |
1269 | proc_ucred_lock(proc_t p) |
1270 | { |
1271 | lck_mtx_lock(lck: &p->p_ucred_mlock); |
1272 | } |
1273 | |
1274 | void |
1275 | proc_ucred_unlock(proc_t p) |
1276 | { |
1277 | lck_mtx_unlock(lck: &p->p_ucred_mlock); |
1278 | } |
1279 | |
1280 | void |
1281 | proc_update_creds_onproc(proc_t p, kauth_cred_t cred) |
1282 | { |
1283 | p->p_uid = kauth_cred_getuid(cred: cred); |
1284 | p->p_gid = kauth_cred_getgid(cred: cred); |
1285 | p->p_ruid = kauth_cred_getruid(cred: cred); |
1286 | p->p_rgid = kauth_cred_getrgid(cred: cred); |
1287 | p->p_svuid = kauth_cred_getsvuid(cred: cred); |
1288 | p->p_svgid = kauth_cred_getsvgid(cred: cred); |
1289 | } |
1290 | |
1291 | |
1292 | bool |
1293 | uthread_is64bit(struct uthread *uth) |
1294 | { |
1295 | return uth->uu_flag & UT_LP64; |
1296 | } |
1297 | |
1298 | void |
1299 | uthread_init(task_t task, uthread_t uth, thread_ro_t tro_tpl, int workq_thread) |
1300 | { |
1301 | uthread_t uth_parent = current_uthread(); |
1302 | |
1303 | lck_spin_init(lck: &uth->uu_rethrottle_lock, grp: &rethrottle_lock_grp, |
1304 | LCK_ATTR_NULL); |
1305 | |
1306 | /* |
1307 | * Lazily set the thread on the kernel VFS context |
1308 | * to the first thread made which will be vm_pageout_scan_thread. |
1309 | */ |
1310 | if (__improbable(vfs_context0.vc_thread == NULL)) { |
1311 | extern thread_t vm_pageout_scan_thread; |
1312 | |
1313 | assert(task == kernel_task); |
1314 | assert(get_machthread(uth) == vm_pageout_scan_thread); |
1315 | vfs_context0.vc_thread = get_machthread(uth); |
1316 | } |
1317 | |
1318 | if (task_get_64bit_addr(task)) { |
1319 | uth->uu_flag |= UT_LP64; |
1320 | } |
1321 | |
1322 | /* |
1323 | * Thread inherits credential from the creating thread, if both |
1324 | * are in the same task. |
1325 | * |
1326 | * If the creating thread has no credential or is from another |
1327 | * task we can leave the new thread credential NULL. If it needs |
1328 | * one later, it will be lazily assigned from the task's process. |
1329 | */ |
1330 | if (task == kernel_task) { |
1331 | kauth_cred_set(&tro_tpl->tro_cred, vfs_context0.vc_ucred); |
1332 | kauth_cred_set(&tro_tpl->tro_realcred, vfs_context0.vc_ucred); |
1333 | tro_tpl->tro_proc = kernproc; |
1334 | tro_tpl->tro_proc_ro = kernproc->p_proc_ro; |
1335 | } else if (!task_is_a_corpse(task)) { |
1336 | thread_ro_t curtro = current_thread_ro(); |
1337 | proc_t p = get_bsdtask_info(task); |
1338 | |
1339 | if (task == curtro->tro_task) { |
1340 | kauth_cred_set(&tro_tpl->tro_realcred, |
1341 | curtro->tro_realcred); |
1342 | if (workq_thread) { |
1343 | kauth_cred_set(&tro_tpl->tro_cred, |
1344 | curtro->tro_realcred); |
1345 | } else { |
1346 | kauth_cred_set(&tro_tpl->tro_cred, |
1347 | curtro->tro_cred); |
1348 | } |
1349 | tro_tpl->tro_proc_ro = curtro->tro_proc_ro; |
1350 | } else { |
1351 | kauth_cred_t cred = kauth_cred_proc_ref(procp: p); |
1352 | kauth_cred_set(&tro_tpl->tro_realcred, cred); |
1353 | kauth_cred_set(&tro_tpl->tro_cred, cred); |
1354 | kauth_cred_unref(&cred); |
1355 | tro_tpl->tro_proc_ro = task_get_ro(t: task); |
1356 | } |
1357 | tro_tpl->tro_proc = p; |
1358 | |
1359 | proc_lock(p); |
1360 | if (workq_thread) { |
1361 | /* workq_thread threads will not inherit masks */ |
1362 | uth->uu_sigmask = ~workq_threadmask; |
1363 | } else if (uth_parent->uu_flag & UT_SAS_OLDMASK) { |
1364 | uth->uu_sigmask = uth_parent->uu_oldmask; |
1365 | } else { |
1366 | uth->uu_sigmask = uth_parent->uu_sigmask; |
1367 | } |
1368 | |
1369 | TAILQ_INSERT_TAIL(&p->p_uthlist, uth, uu_list); |
1370 | proc_unlock(p); |
1371 | |
1372 | #if CONFIG_DTRACE |
1373 | if (p->p_dtrace_ptss_pages != NULL) { |
1374 | uth->t_dtrace_scratch = dtrace_ptss_claim_entry(p); |
1375 | } |
1376 | #endif |
1377 | } else { |
1378 | tro_tpl->tro_proc_ro = task_get_ro(t: task); |
1379 | } |
1380 | |
1381 | uth->uu_pending_sigreturn = 0; |
1382 | uthread_init_proc_refcount(uth); |
1383 | } |
1384 | |
1385 | mach_port_name_t |
1386 | uthread_joiner_port(struct uthread *uth) |
1387 | { |
1388 | return uth->uu_save.uus_bsdthread_terminate.kport; |
1389 | } |
1390 | |
1391 | user_addr_t |
1392 | uthread_joiner_address(uthread_t uth) |
1393 | { |
1394 | return uth->uu_save.uus_bsdthread_terminate.ulock_addr; |
1395 | } |
1396 | |
1397 | void |
1398 | uthread_joiner_wake(task_t task, uthread_t uth) |
1399 | { |
1400 | struct _bsdthread_terminate bts = uth->uu_save.uus_bsdthread_terminate; |
1401 | |
1402 | assert(bts.ulock_addr); |
1403 | bzero(s: &uth->uu_save.uus_bsdthread_terminate, n: sizeof(bts)); |
1404 | |
1405 | int flags = UL_UNFAIR_LOCK | ULF_WAKE_ALL | ULF_WAKE_ALLOW_NON_OWNER; |
1406 | (void)ulock_wake(task, operation: flags, addr: bts.ulock_addr, wake_value: 0); |
1407 | mach_port_deallocate(task: get_task_ipcspace(t: task), name: bts.kport); |
1408 | } |
1409 | |
1410 | /* |
1411 | * This routine frees the thread name field of the uthread_t structure. Split out of |
1412 | * uthread_cleanup() so thread name does not get deallocated while generating a corpse fork. |
1413 | */ |
1414 | void |
1415 | uthread_cleanup_name(uthread_t uth) |
1416 | { |
1417 | /* |
1418 | * <rdar://17834538> |
1419 | * Set pth_name to NULL before calling free(). |
1420 | * Previously there was a race condition in the |
1421 | * case this code was executing during a stackshot |
1422 | * where the stackshot could try and copy pth_name |
1423 | * after it had been freed and before if was marked |
1424 | * as null. |
1425 | */ |
1426 | if (uth->pth_name != NULL) { |
1427 | void *pth_name = uth->pth_name; |
1428 | uth->pth_name = NULL; |
1429 | kfree_data(pth_name, MAXTHREADNAMESIZE); |
1430 | } |
1431 | return; |
1432 | } |
1433 | |
1434 | /* |
1435 | * This routine frees all the BSD context in uthread except the credential. |
1436 | * It does not free the uthread structure as well |
1437 | */ |
1438 | void |
1439 | uthread_cleanup(uthread_t uth, thread_ro_t tro) |
1440 | { |
1441 | task_t task = tro->tro_task; |
1442 | proc_t p = tro->tro_proc; |
1443 | |
1444 | uthread_assert_zero_proc_refcount(uth); |
1445 | |
1446 | if (uth->uu_lowpri_window || uth->uu_throttle_info) { |
1447 | /* |
1448 | * task is marked as a low priority I/O type |
1449 | * and we've somehow managed to not dismiss the throttle |
1450 | * through the normal exit paths back to user space... |
1451 | * no need to throttle this thread since its going away |
1452 | * but we do need to update our bookeeping w/r to throttled threads |
1453 | * |
1454 | * Calling this routine will clean up any throttle info reference |
1455 | * still inuse by the thread. |
1456 | */ |
1457 | throttle_lowpri_io(sleep_amount: 0); |
1458 | } |
1459 | |
1460 | #if CONFIG_AUDIT |
1461 | /* |
1462 | * Per-thread audit state should never last beyond system |
1463 | * call return. Since we don't audit the thread creation/ |
1464 | * removal, the thread state pointer should never be |
1465 | * non-NULL when we get here. |
1466 | */ |
1467 | assert(uth->uu_ar == NULL); |
1468 | #endif |
1469 | |
1470 | if (uth->uu_select.nbytes) { |
1471 | select_cleanup_uthread(&uth->uu_select); |
1472 | } |
1473 | |
1474 | if (uth->uu_cdir) { |
1475 | vnode_rele(vp: uth->uu_cdir); |
1476 | uth->uu_cdir = NULLVP; |
1477 | } |
1478 | |
1479 | if (uth->uu_selset) { |
1480 | select_set_free(selset: uth->uu_selset); |
1481 | uth->uu_selset = NULL; |
1482 | } |
1483 | |
1484 | os_reason_free(cur_reason: uth->uu_exit_reason); |
1485 | |
1486 | if ((task != kernel_task) && p) { |
1487 | /* |
1488 | * Remove the thread from the process list and |
1489 | * transfer [appropriate] pending signals to the process. |
1490 | * Do not remove the uthread from proc uthlist for exec |
1491 | * copy task, since they does not have a ref on proc and |
1492 | * would not have been added to the list. |
1493 | */ |
1494 | if (uth->uu_kqr_bound) { |
1495 | kqueue_threadreq_unbind(p, uth->uu_kqr_bound); |
1496 | } |
1497 | |
1498 | if (get_bsdtask_info(task) == p) { |
1499 | proc_lock(p); |
1500 | TAILQ_REMOVE(&p->p_uthlist, uth, uu_list); |
1501 | p->p_siglist |= (uth->uu_siglist & execmask & (~p->p_sigignore | sigcantmask)); |
1502 | proc_unlock(p); |
1503 | } |
1504 | |
1505 | #if CONFIG_DTRACE |
1506 | struct dtrace_ptss_page_entry *tmpptr = uth->t_dtrace_scratch; |
1507 | uth->t_dtrace_scratch = NULL; |
1508 | if (tmpptr != NULL) { |
1509 | dtrace_ptss_release_entry(p, e: tmpptr); |
1510 | } |
1511 | #endif |
1512 | } else { |
1513 | assert(!uth->uu_kqr_bound); |
1514 | } |
1515 | } |
1516 | |
1517 | /* This routine releases the credential stored in uthread */ |
1518 | void |
1519 | uthread_cred_ref(struct ucred *ucred) |
1520 | { |
1521 | kauth_cred_ref(cred: ucred); |
1522 | } |
1523 | |
1524 | void |
1525 | uthread_cred_free(struct ucred *ucred) |
1526 | { |
1527 | kauth_cred_set(&ucred, NOCRED); |
1528 | } |
1529 | |
1530 | /* This routine frees the uthread structure held in thread structure */ |
1531 | void |
1532 | uthread_destroy(uthread_t uth) |
1533 | { |
1534 | uthread_destroy_proc_refcount(uth); |
1535 | |
1536 | if (uth->t_tombstone) { |
1537 | kfree_type(struct doc_tombstone, uth->t_tombstone); |
1538 | uth->t_tombstone = NULL; |
1539 | } |
1540 | |
1541 | #if CONFIG_DEBUG_SYSCALL_REJECTION |
1542 | size_t const bitstr_len = BITMAP_SIZE(mach_trap_count + nsysent); |
1543 | |
1544 | if (uth->syscall_rejection_mask) { |
1545 | kfree_data(uth->syscall_rejection_mask, bitstr_len); |
1546 | uth->syscall_rejection_mask = NULL; |
1547 | } |
1548 | |
1549 | if (uth->syscall_rejection_once_mask) { |
1550 | kfree_data(uth->syscall_rejection_once_mask, bitstr_len); |
1551 | uth->syscall_rejection_once_mask = NULL; |
1552 | } |
1553 | #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */ |
1554 | |
1555 | lck_spin_destroy(lck: &uth->uu_rethrottle_lock, grp: &rethrottle_lock_grp); |
1556 | |
1557 | uthread_cleanup_name(uth); |
1558 | } |
1559 | |
1560 | user_addr_t |
1561 | thread_get_sigreturn_token(thread_t thread) |
1562 | { |
1563 | uthread_t ut = (struct uthread *) get_bsdthread_info(thread); |
1564 | return ut->uu_sigreturn_token; |
1565 | } |
1566 | |
1567 | uint32_t |
1568 | thread_get_sigreturn_diversifier(thread_t thread) |
1569 | { |
1570 | uthread_t ut = (struct uthread *) get_bsdthread_info(thread); |
1571 | return ut->uu_sigreturn_diversifier; |
1572 | } |
1573 | |