1/*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */
29/*
30 * Copyright (c) 1982, 1986, 1989, 1991, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)kern_fork.c 8.8 (Berkeley) 2/14/95
67 */
68/*
69 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74/*
75 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
76 * support for mandatory and extensible security protections. This notice
77 * is included in support of clause 2.2 (b) of the Apple Public License,
78 * Version 2.0.
79 */
80
81#include <kern/assert.h>
82#include <kern/bits.h>
83#include <sys/param.h>
84#include <sys/systm.h>
85#include <sys/filedesc.h>
86#include <sys/kernel.h>
87#include <sys/malloc.h>
88#include <sys/proc_internal.h>
89#include <sys/kauth.h>
90#include <sys/user.h>
91#include <sys/reason.h>
92#include <sys/resourcevar.h>
93#include <sys/vnode_internal.h>
94#include <sys/file_internal.h>
95#include <sys/acct.h>
96#include <sys/codesign.h>
97#include <sys/sysent.h>
98#include <sys/sysproto.h>
99#include <sys/ulock.h>
100#if CONFIG_PERSONAS
101#include <sys/persona.h>
102#endif
103#include <sys/doc_tombstone.h>
104#if CONFIG_DTRACE
105/* Do not include dtrace.h, it redefines kmem_[alloc/free] */
106extern void (*dtrace_proc_waitfor_exec_ptr)(proc_t);
107extern void dtrace_proc_fork(proc_t, proc_t, int);
108
109/*
110 * Since dtrace_proc_waitfor_exec_ptr can be added/removed in dtrace_subr.c,
111 * we will store its value before actually calling it.
112 */
113static void (*dtrace_proc_waitfor_hook)(proc_t) = NULL;
114
115#include <sys/dtrace_ptss.h>
116#endif
117
118#include <security/audit/audit.h>
119
120#include <mach/mach_types.h>
121#include <kern/coalition.h>
122#include <kern/kern_types.h>
123#include <kern/kalloc.h>
124#include <kern/mach_param.h>
125#include <kern/task.h>
126#include <kern/thread.h>
127#include <kern/thread_call.h>
128#include <kern/zalloc.h>
129
130#if CONFIG_MACF
131#include <security/mac_framework.h>
132#include <security/mac_mach_internal.h>
133#endif
134
135#include <vm/vm_map.h>
136#include <vm/vm_protos.h>
137#include <vm/vm_shared_region.h>
138
139#include <sys/shm_internal.h> /* for shmfork() */
140#include <mach/task.h> /* for thread_create() */
141#include <mach/thread_act.h> /* for thread_resume() */
142
143#include <sys/sdt.h>
144
145#if CONFIG_MEMORYSTATUS
146#include <sys/kern_memorystatus.h>
147#endif
148
149static const uint64_t startup_serial_num_procs = 300;
150bool startup_serial_logging_active = true;
151
152/* XXX routines which should have Mach prototypes, but don't */
153extern void act_thread_catt(void *ctx);
154void thread_set_child(thread_t child, int pid);
155boolean_t thread_is_active(thread_t thread);
156void *act_thread_csave(void);
157extern boolean_t task_is_exec_copy(task_t);
158int nextpidversion = 0;
159
160void ipc_task_enable(task_t task);
161
162proc_t forkproc(proc_t, cloneproc_flags_t);
163void forkproc_free(proc_t);
164thread_t fork_create_child(task_t parent_task,
165 coalition_t *parent_coalitions,
166 proc_t child,
167 int is_64bit_addr,
168 int is_64bit_data,
169 cloneproc_flags_t clone_flags);
170
171__private_extern__ const size_t uthread_size = sizeof(struct uthread);
172static LCK_GRP_DECLARE(rethrottle_lock_grp, "rethrottle");
173
174os_refgrp_decl(, p_refgrp, "proc", NULL);
175
176extern const size_t task_alignment;
177const size_t proc_alignment = _Alignof(struct proc);
178
179extern size_t task_struct_size;
180size_t proc_struct_size = sizeof(struct proc);
181size_t proc_and_task_size;
182
183ZONE_DECLARE_ID(ZONE_ID_PROC_TASK, struct proc);
184SECURITY_READ_ONLY_LATE(zone_t) proc_task_zone;
185
186KALLOC_TYPE_DEFINE(proc_stats_zone, struct pstats, KT_DEFAULT);
187
188/*
189 * fork1
190 *
191 * Description: common code used by all new process creation other than the
192 * bootstrap of the initial process on the system
193 *
194 * Parameters: parent_proc parent process of the process being
195 * child_threadp pointer to location to receive the
196 * Mach thread_t of the child process
197 * created
198 * kind kind of creation being requested
199 * coalitions if spawn, the set of coalitions the
200 * child process should join, or NULL to
201 * inherit the parent's. On non-spawns,
202 * this param is ignored and the child
203 * always inherits the parent's
204 * coalitions.
205 *
206 * Notes: Permissable values for 'kind':
207 *
208 * PROC_CREATE_FORK Create a complete process which will
209 * return actively running in both the
210 * parent and the child; the child copies
211 * the parent address space.
212 * PROC_CREATE_SPAWN Create a complete process which will
213 * return actively running in the parent
214 * only after returning actively running
215 * in the child; the child address space
216 * is newly created by an image activator,
217 * after which the child is run.
218 *
219 * At first it may seem strange that we return the child thread
220 * address rather than process structure, since the process is
221 * the only part guaranteed to be "new"; however, since we do
222 * not actualy adjust other references between Mach and BSD, this
223 * is the only method which guarantees us the ability to get
224 * back to the other information.
225 */
226int
227fork1(proc_t parent_proc, thread_t *child_threadp, int kind, coalition_t *coalitions)
228{
229 proc_t child_proc = NULL; /* set in switch, but compiler... */
230 thread_t child_thread = NULL;
231 uid_t uid;
232 size_t count;
233 int err = 0;
234 int spawn = 0;
235 rlim_t rlimit_nproc_cur;
236
237 /*
238 * Although process entries are dynamically created, we still keep
239 * a global limit on the maximum number we will create. Don't allow
240 * a nonprivileged user to use the last process; don't let root
241 * exceed the limit. The variable nprocs is the current number of
242 * processes, maxproc is the limit.
243 */
244 uid = kauth_getruid();
245 proc_list_lock();
246 if ((nprocs >= maxproc - 1 && uid != 0) || nprocs >= maxproc) {
247#if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
248 /*
249 * On the development kernel, panic so that the fact that we hit
250 * the process limit is obvious, as this may very well wedge the
251 * system.
252 */
253 panic("The process table is full; parent pid=%d", proc_getpid(parent_proc));
254#endif
255 proc_list_unlock();
256 tablefull("proc");
257 return EAGAIN;
258 }
259 proc_list_unlock();
260
261 /*
262 * Increment the count of procs running with this uid. Don't allow
263 * a nonprivileged user to exceed their current limit, which is
264 * always less than what an rlim_t can hold.
265 * (locking protection is provided by list lock held in chgproccnt)
266 */
267 count = chgproccnt(uid, diff: 1);
268 rlimit_nproc_cur = proc_limitgetcur(p: parent_proc, RLIMIT_NPROC);
269 if (uid != 0 &&
270 (rlim_t)count > rlimit_nproc_cur) {
271#if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
272 /*
273 * On the development kernel, panic so that the fact that we hit
274 * the per user process limit is obvious. This may be less dire
275 * than hitting the global process limit, but we cannot rely on
276 * that.
277 */
278 panic("The per-user process limit has been hit; parent pid=%d, uid=%d", proc_getpid(parent_proc), uid);
279#endif
280 err = EAGAIN;
281 goto bad;
282 }
283
284#if CONFIG_MACF
285 /*
286 * Determine if MAC policies applied to the process will allow
287 * it to fork. This is an advisory-only check.
288 */
289 err = mac_proc_check_fork(proc: parent_proc);
290 if (err != 0) {
291 goto bad;
292 }
293#endif
294
295 switch (kind) {
296 case PROC_CREATE_SPAWN:
297 /*
298 * A spawned process differs from a forked process in that
299 * the spawned process does not carry around the parents
300 * baggage with regard to address space copying, dtrace,
301 * and so on.
302 */
303 spawn = 1;
304
305 OS_FALLTHROUGH;
306
307 case PROC_CREATE_FORK:
308 /*
309 * When we clone the parent process, we are going to inherit
310 * its task attributes and memory, since when we fork, we
311 * will, in effect, create a duplicate of it, with only minor
312 * differences. Contrarily, spawned processes do not inherit.
313 */
314 if ((child_thread = cloneproc(proc_task(parent_proc),
315 spawn ? coalitions : NULL,
316 parent_proc,
317 spawn ? CLONEPROC_SPAWN : CLONEPROC_FORK)) == NULL) {
318 /* Failed to create thread */
319 err = EAGAIN;
320 goto bad;
321 }
322
323 /* child_proc = child_thread->task->proc; */
324 child_proc = (proc_t)(get_bsdtask_info(get_threadtask(child_thread)));
325
326 if (!spawn) {
327 /* Copy current thread state into the child thread (only for fork) */
328 thread_dup(child_thread);
329 }
330
331// XXX BEGIN: wants to move to be common code (and safe)
332#if CONFIG_MACF
333 /*
334 * allow policies to associate the credential/label that
335 * we referenced from the parent ... with the child
336 * JMM - this really isn't safe, as we can drop that
337 * association without informing the policy in other
338 * situations (keep long enough to get policies changed)
339 */
340 mac_cred_label_associate_fork(cred: proc_ucred_unsafe(p: child_proc),
341 child: child_proc);
342#endif
343
344 /*
345 * Propogate change of PID - may get new cred if auditing.
346 */
347 set_security_token(p: child_proc, cred: proc_ucred_unsafe(p: child_proc));
348
349 AUDIT_ARG(pid, proc_getpid(child_proc));
350
351// XXX END: wants to move to be common code (and safe)
352
353 /*
354 * Blow thread state information; this is what gives the child
355 * process its "return" value from a fork() call.
356 *
357 * Note: this should probably move to fork() proper, since it
358 * is not relevent to spawn, and the value won't matter
359 * until we resume the child there. If you are in here
360 * refactoring code, consider doing this at the same time.
361 */
362 thread_set_child(child: child_thread, pid: proc_getpid(child_proc));
363
364 child_proc->p_acflag = AFORK; /* forked but not exec'ed */
365
366#if CONFIG_DTRACE
367 dtrace_proc_fork(parent_proc, child_proc, spawn);
368#endif /* CONFIG_DTRACE */
369 if (!spawn) {
370 /*
371 * Of note, we need to initialize the bank context behind
372 * the protection of the proc_trans lock to prevent a race with exit.
373 */
374 task_bank_init(task: get_threadtask(child_thread));
375 }
376
377 break;
378
379 default:
380 panic("fork1 called with unknown kind %d", kind);
381 break;
382 }
383
384
385 /* return the thread pointer to the caller */
386 *child_threadp = child_thread;
387
388bad:
389 /*
390 * In the error case, we return a 0 value for the returned pid (but
391 * it is ignored in the trampoline due to the error return); this
392 * is probably not necessary.
393 */
394 if (err) {
395 (void)chgproccnt(uid, diff: -1);
396 }
397
398 return err;
399}
400
401
402
403
404/*
405 * fork_create_child
406 *
407 * Description: Common operations associated with the creation of a child
408 * process. Return with new task and first thread's control port movable
409 * and not pinned.
410 *
411 * Parameters: parent_task parent task
412 * parent_coalitions parent's set of coalitions
413 * child_proc child process
414 * inherit_memory TRUE, if the parents address space is
415 * to be inherited by the child
416 * is_64bit_addr TRUE, if the child being created will
417 * be associated with a 64 bit address space
418 * is_64bit_data TRUE if the child being created will use a
419 * 64-bit register state
420 * in_exec TRUE, if called from execve or posix spawn set exec
421 * FALSE, if called from fork or vfexec
422 *
423 * Note: This code is called in the fork() case, from the execve() call
424 * graph, from the posix_spawn() call graph (which implicitly
425 * includes a vfork() equivalent call, and in the system
426 * bootstrap case.
427 *
428 * It creates a new task and thread (and as a side effect of the
429 * thread creation, a uthread) in the parent coalition set, which is
430 * then associated with the process 'child'. If the parent
431 * process address space is to be inherited, then a flag
432 * indicates that the newly created task should inherit this from
433 * the child task.
434 *
435 * As a special concession to bootstrapping the initial process
436 * in the system, it's possible for 'parent_task' to be TASK_NULL;
437 * in this case, 'inherit_memory' MUST be FALSE.
438 */
439thread_t
440fork_create_child(task_t parent_task,
441 coalition_t *parent_coalitions,
442 proc_t child_proc,
443 int is_64bit_addr,
444 int is_64bit_data,
445 cloneproc_flags_t clone_flags)
446{
447 thread_t child_thread = NULL;
448 task_t child_task;
449 kern_return_t result;
450 proc_ro_t proc_ro;
451 bool inherit_memory = !!(clone_flags & CLONEPROC_FORK);
452 bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
453 /*
454 * Exec complete hook should be called for spawn and exec, but not for fork.
455 */
456 uint8_t returnwaitflags = (!inherit_memory ? TRW_LEXEC_COMPLETE : 0) |
457 (TRW_LRETURNWAIT | TRW_LRETURNWAITER);
458
459 proc_ro = proc_get_ro(p: child_proc);
460 if (proc_ro_task(pr: proc_ro) != NULL) {
461 panic("Proc_ro_task for newly created proc %p is not NULL", child_proc);
462 }
463
464 child_task = proc_get_task_raw(proc: child_proc);
465
466 /*
467 * Create a new task for the child process, IPC access to the new task will
468 * be set up after task has been fully initialized.
469 */
470 result = task_create_internal(parent_task,
471 proc_ro,
472 parent_coalitions,
473 inherit_memory,
474 is_64bit: is_64bit_addr,
475 is_64bit_data,
476 TF_NONE,
477 TF_NONE,
478 procflags: in_exec ? TPF_EXEC_COPY : TPF_NONE, /* Mark the task exec copy if in execve */
479 t_returnwaitflags: returnwaitflags, /* All created threads will wait in task_wait_to_return */
480 child_task);
481 if (result != KERN_SUCCESS) {
482 printf("%s: task_create_internal failed. Code: %d\n",
483 __func__, result);
484 goto bad;
485 }
486
487 /* Set the child proc process to child task */
488 proc_set_task(child_proc, child_task);
489
490 /* Set child task process to child proc */
491 set_bsdtask_info(child_task, child_proc);
492
493 /* Propagate CPU limit timer from parent */
494 if (timerisset(&child_proc->p_rlim_cpu)) {
495 task_vtimer_set(task: child_task, TASK_VTIMER_RLIM);
496 }
497
498 /*
499 * Set child process BSD visible scheduler priority if nice value
500 * inherited from parent
501 */
502 if (child_proc->p_nice != 0) {
503 resetpriority(child_proc);
504 }
505
506 /*
507 * Create main thread for the child process. Its control port is not immovable/pinned
508 * until main_thread_set_immovable_pinned().
509 *
510 * The new thread is waiting on the event triggered by 'task_clear_return_wait'
511 */
512 result = main_thread_create_waiting(task: child_task,
513 continuation: (thread_continue_t)task_wait_to_return,
514 event: task_get_return_wait_event(task: child_task),
515 new_thread: &child_thread);
516
517 if (result != KERN_SUCCESS) {
518 printf("%s: thread_create failed. Code: %d\n",
519 __func__, result);
520 task_deallocate(child_task);
521 child_task = NULL;
522 }
523
524 /*
525 * Tag thread as being the first thread in its task.
526 */
527 thread_set_tag(thread: child_thread, tag: THREAD_TAG_MAINTHREAD);
528
529bad:
530 thread_yield_internal(interval: 1);
531
532 return child_thread;
533}
534
535
536/*
537 * fork
538 *
539 * Description: fork system call.
540 *
541 * Parameters: parent Parent process to fork
542 * uap (void) [unused]
543 * retval Return value
544 *
545 * Returns: 0 Success
546 * EAGAIN Resource unavailable, try again
547 *
548 * Notes: Attempts to create a new child process which inherits state
549 * from the parent process. If successful, the call returns
550 * having created an initially suspended child process with an
551 * extra Mach task and thread reference, for which the thread
552 * is initially suspended. Until we resume the child process,
553 * it is not yet running.
554 *
555 * The return information to the child is contained in the
556 * thread state structure of the new child, and does not
557 * become visible to the child through a normal return process,
558 * since it never made the call into the kernel itself in the
559 * first place.
560 *
561 * After resuming the thread, this function returns directly to
562 * the parent process which invoked the fork() system call.
563 *
564 * Important: The child thread_resume occurs before the parent returns;
565 * depending on scheduling latency, this means that it is not
566 * deterministic as to whether the parent or child is scheduled
567 * to run first. It is entirely possible that the child could
568 * run to completion prior to the parent running.
569 */
570int
571fork(proc_t parent_proc, __unused struct fork_args *uap, int32_t *retval)
572{
573 thread_t child_thread;
574 int err;
575
576 retval[1] = 0; /* flag parent return for user space */
577
578 if ((err = fork1(parent_proc, child_threadp: &child_thread, PROC_CREATE_FORK, NULL)) == 0) {
579 task_t child_task;
580 proc_t child_proc;
581
582 /* Return to the parent */
583 child_proc = (proc_t)get_bsdthreadtask_info(child_thread);
584 retval[0] = proc_getpid(child_proc);
585
586 child_task = (task_t)get_threadtask(child_thread);
587 assert(child_task != TASK_NULL);
588
589 /* task_control_port_options has been inherited from parent, apply it */
590 task_set_immovable_pinned(task: child_task);
591 main_thread_set_immovable_pinned(thread: child_thread);
592
593 /*
594 * Since the task ports for this new task are now set to be immovable,
595 * we can enable them.
596 */
597 ipc_task_enable(task: get_threadtask(child_thread));
598
599 /*
600 * Drop the signal lock on the child which was taken on our
601 * behalf by forkproc()/cloneproc() to prevent signals being
602 * received by the child in a partially constructed state.
603 */
604 proc_signalend(child_proc, locked: 0);
605 proc_transend(child_proc, locked: 0);
606
607 /* flag the fork has occurred */
608 proc_knote(p: parent_proc, NOTE_FORK | proc_getpid(child_proc));
609 DTRACE_PROC1(create, proc_t, child_proc);
610
611#if CONFIG_DTRACE
612 if ((dtrace_proc_waitfor_hook = dtrace_proc_waitfor_exec_ptr) != NULL) {
613 (*dtrace_proc_waitfor_hook)(child_proc);
614 }
615#endif
616
617 /*
618 * If current process died during the fork, the child would contain
619 * non consistent vmmap, kill the child and reap it internally.
620 */
621 if (parent_proc->p_lflag & P_LEXIT || !thread_is_active(thread: current_thread())) {
622 task_terminate_internal(task: child_task);
623 proc_list_lock();
624 child_proc->p_listflag |= P_LIST_DEADPARENT;
625 proc_list_unlock();
626 }
627
628 /* "Return" to the child */
629 task_clear_return_wait(task: get_threadtask(child_thread), TCRW_CLEAR_ALL_WAIT);
630
631 /* drop the extra references we got during the creation */
632 task_deallocate(child_task);
633 thread_deallocate(thread: child_thread);
634 }
635
636 return err;
637}
638
639
640/*
641 * cloneproc
642 *
643 * Description: Create a new process from a specified process.
644 *
645 * Parameters: parent_task The parent task to be cloned, or
646 * TASK_NULL is task characteristics
647 * are not to be inherited
648 * be cloned, or TASK_NULL if the new
649 * task is not to inherit the VM
650 * characteristics of the parent
651 * parent_proc The parent process to be cloned
652 * clone_flags Clone flags to specify if the cloned
653 * process should inherit memory,
654 * marked as memory stat internal,
655 * or if the cloneproc is called for exec.
656 *
657 * Returns: !NULL pointer to new child thread
658 * NULL Failure (unspecified)
659 *
660 * Note: On return newly created child process has signal lock held
661 * to block delivery of signal to it if called with lock set.
662 * fork() code needs to explicity remove this lock before
663 * signals can be delivered
664 *
665 * In the case of bootstrap, this function can be called from
666 * bsd_utaskbootstrap() in order to bootstrap the first process;
667 * the net effect is to provide a uthread structure for the
668 * kernel process associated with the kernel task.
669 *
670 * XXX: Tristating using the value parent_task as the major key
671 * and inherit_memory as the minor key is something we should
672 * refactor later; we owe the current semantics, ultimately,
673 * to the semantics of task_create_internal. For now, we will
674 * live with this being somewhat awkward.
675 */
676thread_t
677cloneproc(task_t parent_task, coalition_t *parent_coalitions, proc_t parent_proc, cloneproc_flags_t clone_flags)
678{
679#if !CONFIG_MEMORYSTATUS
680#pragma unused(cloning_initproc)
681#endif
682 task_t child_task;
683 proc_t child_proc;
684 thread_t child_thread = NULL;
685 bool cloning_initproc = !!(clone_flags & CLONEPROC_INITPROC);
686 bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
687
688 if ((child_proc = forkproc(parent_proc, clone_flags)) == NULL) {
689 /* Failed to allocate new process */
690 goto bad;
691 }
692
693 /*
694 * In the case where the parent_task is TASK_NULL (during the init path)
695 * we make the assumption that the register size will be the same as the
696 * address space size since there's no way to determine the possible
697 * register size until an image is exec'd.
698 *
699 * The only architecture that has different address space and register sizes
700 * (arm64_32) isn't being used within kernel-space, so the above assumption
701 * always holds true for the init path.
702 */
703 const int parent_64bit_addr = parent_proc->p_flag & P_LP64;
704 const int parent_64bit_data = (parent_task == TASK_NULL) ? parent_64bit_addr : task_get_64bit_data(task: parent_task);
705
706 child_thread = fork_create_child(parent_task,
707 parent_coalitions,
708 child_proc,
709 is_64bit_addr: parent_64bit_addr,
710 is_64bit_data: parent_64bit_data,
711 clone_flags);
712
713 if (child_thread == NULL) {
714 /*
715 * Failed to create thread; now we must deconstruct the new
716 * process previously obtained from forkproc().
717 */
718 forkproc_free(child_proc);
719 goto bad;
720 }
721
722 child_task = get_threadtask(child_thread);
723 if (parent_64bit_addr) {
724 OSBitOrAtomic(P_LP64, (UInt32 *)&child_proc->p_flag);
725 get_bsdthread_info(child_thread)->uu_flag |= UT_LP64;
726 } else {
727 OSBitAndAtomic(~((uint32_t)P_LP64), (UInt32 *)&child_proc->p_flag);
728 get_bsdthread_info(child_thread)->uu_flag &= ~UT_LP64;
729 }
730
731#if CONFIG_MEMORYSTATUS
732 if (cloning_initproc ||
733 (in_exec && (parent_proc->p_memstat_state & P_MEMSTAT_INTERNAL))) {
734 proc_list_lock();
735 child_proc->p_memstat_state |= P_MEMSTAT_INTERNAL;
736 child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_INTERNAL;
737 child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_INTERNAL;
738 proc_list_unlock();
739 }
740 if (in_exec && parent_proc->p_memstat_relaunch_flags != P_MEMSTAT_RELAUNCH_UNKNOWN) {
741 memorystatus_relaunch_flags_update(p: child_proc, relaunch_flags: parent_proc->p_memstat_relaunch_flags);
742 }
743#endif
744
745 /* make child visible */
746 pinsertchild(parent: parent_proc, child: child_proc, in_exec);
747
748 /*
749 * Make child runnable, set start time.
750 */
751 child_proc->p_stat = SRUN;
752bad:
753 return child_thread;
754}
755
756void
757proc_set_sigact(proc_t p, int sig, user_addr_t sigact)
758{
759 assert((sig > 0) && (sig < NSIG));
760
761 p->p_sigacts.ps_sigact[sig] = sigact;
762}
763
764void
765proc_set_trampact(proc_t p, int sig, user_addr_t trampact)
766{
767 assert((sig > 0) && (sig < NSIG));
768
769 p->p_sigacts.ps_trampact[sig] = trampact;
770}
771
772void
773proc_set_sigact_trampact(proc_t p, int sig, user_addr_t sigact, user_addr_t trampact)
774{
775 assert((sig > 0) && (sig < NSIG));
776
777 p->p_sigacts.ps_sigact[sig] = sigact;
778 p->p_sigacts.ps_trampact[sig] = trampact;
779}
780
781void
782proc_reset_sigact(proc_t p, sigset_t sigs)
783{
784 user_addr_t *sigacts = p->p_sigacts.ps_sigact;
785 int nc;
786
787 while (sigs) {
788 nc = ffs((unsigned int)sigs);
789 if (sigacts[nc] != SIG_DFL) {
790 sigacts[nc] = SIG_DFL;
791 }
792 sigs &= ~sigmask(nc);
793 }
794}
795
796/*
797 * Destroy a process structure that resulted from a call to forkproc(), but
798 * which must be returned to the system because of a subsequent failure
799 * preventing it from becoming active.
800 *
801 * Parameters: p The incomplete process from forkproc()
802 *
803 * Returns: (void)
804 *
805 * Note: This function should only be used in an error handler following
806 * a call to forkproc().
807 *
808 * Operations occur in reverse order of those in forkproc().
809 */
810void
811forkproc_free(proc_t p)
812{
813 struct pgrp *pg;
814
815#if CONFIG_PERSONAS
816 persona_proc_drop(p);
817#endif /* CONFIG_PERSONAS */
818
819#if PSYNCH
820 pth_proc_hashdelete(p);
821#endif /* PSYNCH */
822
823 /* We held signal and a transition locks; drop them */
824 proc_signalend(p, locked: 0);
825 proc_transend(p, locked: 0);
826
827 /*
828 * If we have our own copy of the resource limits structure, we
829 * need to free it. If it's a shared copy, we need to drop our
830 * reference on it.
831 */
832 proc_limitdrop(p);
833
834#if SYSV_SHM
835 /* Need to drop references to the shared memory segment(s), if any */
836 if (p->vm_shm) {
837 /*
838 * Use shmexec(): we have no address space, so no mappings
839 *
840 * XXX Yes, the routine is badly named.
841 */
842 shmexec(p);
843 }
844#endif
845
846 /* Need to undo the effects of the fdt_fork(), if any */
847 fdt_invalidate(p);
848 fdt_destroy(p);
849
850 /*
851 * Drop the reference on a text vnode pointer, if any
852 * XXX This code is broken in forkproc(); see <rdar://4256419>;
853 * XXX if anyone ever uses this field, we will be extremely unhappy.
854 */
855 if (p->p_textvp) {
856 vnode_rele(vp: p->p_textvp);
857 p->p_textvp = NULL;
858 }
859
860 /* Update the audit session proc count */
861 AUDIT_SESSION_PROCEXIT(p);
862
863 lck_mtx_destroy(lck: &p->p_mlock, grp: &proc_mlock_grp);
864 lck_mtx_destroy(lck: &p->p_ucred_mlock, grp: &proc_ucred_mlock_grp);
865#if CONFIG_AUDIT
866 lck_mtx_destroy(lck: &p->p_audit_mlock, grp: &proc_ucred_mlock_grp);
867#endif /* CONFIG_AUDIT */
868#if CONFIG_DTRACE
869 lck_mtx_destroy(lck: &p->p_dtrace_sprlock, grp: &proc_lck_grp);
870#endif
871 lck_spin_destroy(lck: &p->p_slock, grp: &proc_slock_grp);
872
873 proc_list_lock();
874 /* Decrement the count of processes in the system */
875 nprocs--;
876
877 /* quit the group */
878 pg = pgrp_leave_locked(p);
879
880 /* Take it out of process hash */
881 assert((os_ref_get_raw_mask(&p->p_refcount) >> P_REF_BITS) == 1);
882 assert((os_ref_get_raw_mask(&p->p_refcount) & P_REF_NEW) == P_REF_NEW);
883 os_atomic_xor(&p->p_refcount, P_REF_NEW | P_REF_DEAD, relaxed);
884
885 /* Remove from hash if not a shadow proc */
886 if (!proc_is_shadow(p)) {
887 phash_remove_locked(p);
888 }
889
890 proc_list_unlock();
891
892 pgrp_rele(pgrp: pg);
893
894 thread_call_free(call: p->p_rcall);
895
896 /* Free allocated memory */
897 zfree(proc_stats_zone, p->p_stats);
898 p->p_stats = NULL;
899 if (p->p_subsystem_root_path) {
900 zfree(ZV_NAMEI, p->p_subsystem_root_path);
901 p->p_subsystem_root_path = NULL;
902 }
903
904 proc_checkdeadrefs(p);
905 proc_wait_release(p);
906}
907
908
909/*
910 * forkproc
911 *
912 * Description: Create a new process structure, given a parent process
913 * structure.
914 *
915 * Parameters: parent_proc The parent process
916 *
917 * Returns: !NULL The new process structure
918 * NULL Error (insufficient free memory)
919 *
920 * Note: When successful, the newly created process structure is
921 * partially initialized; if a caller needs to deconstruct the
922 * returned structure, they must call forkproc_free() to do so.
923 */
924proc_t
925forkproc(proc_t parent_proc, cloneproc_flags_t clone_flags)
926{
927 static uint64_t nextuniqueid = 0;
928 static pid_t lastpid = 0;
929
930 proc_t child_proc; /* Our new process */
931 int error = 0;
932 struct pgrp *pg;
933 uthread_t parent_uthread = current_uthread();
934 rlim_t rlimit_cpu_cur;
935 pid_t pid;
936 struct proc_ro_data proc_ro_data = {};
937 bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
938 bool in_fork = !!(clone_flags & CLONEPROC_FORK);
939
940 child_proc = zalloc_flags(proc_task_zone, Z_WAITOK | Z_ZERO);
941
942 child_proc->p_stats = zalloc_flags(proc_stats_zone, Z_WAITOK | Z_ZERO);
943 child_proc->p_sigacts = parent_proc->p_sigacts;
944 os_ref_init_mask(&child_proc->p_refcount, P_REF_BITS, &p_refgrp, P_REF_NEW);
945 os_ref_init_raw(&child_proc->p_waitref, &p_refgrp);
946 proc_ref_hold_proc_task_struct(proc: child_proc);
947
948 /* allocate a callout for use by interval timers */
949 child_proc->p_rcall = thread_call_allocate(func: (thread_call_func_t)realitexpire, param0: child_proc);
950
951
952 /*
953 * Find an unused PID.
954 */
955
956 fdt_init(p: child_proc);
957
958 proc_list_lock();
959
960 if (!in_exec) {
961 pid = lastpid;
962 do {
963 /*
964 * If the process ID prototype has wrapped around,
965 * restart somewhat above 0, as the low-numbered procs
966 * tend to include daemons that don't exit.
967 */
968 if (++pid >= PID_MAX) {
969 pid = 100;
970 }
971 if (pid == lastpid) {
972 panic("Unable to allocate a new pid");
973 }
974
975 /* if the pid stays in hash both for zombie and runniing state */
976 } while (phash_find_locked(pid) != PROC_NULL ||
977 pghash_exists_locked(pid) ||
978 session_find_locked(sessid: pid) != SESSION_NULL);
979
980 lastpid = pid;
981 nprocs++;
982
983 child_proc->p_pid = pid;
984 proc_ro_data.p_idversion = OSIncrementAtomic(&nextpidversion);
985 /* kernel process is handcrafted and not from fork, so start from 1 */
986 proc_ro_data.p_uniqueid = ++nextuniqueid;
987
988 /* Insert in the hash, and inherit our group (and session) */
989 phash_insert_locked(child_proc);
990
991 /* Check if the proc is from App Cryptex */
992 if (parent_proc->p_ladvflag & P_RSR) {
993 os_atomic_or(&child_proc->p_ladvflag, P_RSR, relaxed);
994 }
995 } else {
996 /* For exec copy of the proc, copy the pid, pidversion and uniqueid of original proc */
997 pid = parent_proc->p_pid;
998 child_proc->p_pid = pid;
999 proc_ro_data.p_idversion = parent_proc->p_proc_ro->p_idversion;
1000 proc_ro_data.p_uniqueid = parent_proc->p_proc_ro->p_uniqueid;
1001
1002 nprocs++;
1003 os_atomic_or(&child_proc->p_refcount, P_REF_SHADOW, relaxed);
1004 }
1005 pg = pgrp_enter_locked(parent: parent_proc, p: child_proc);
1006 proc_list_unlock();
1007
1008 if (proc_ro_data.p_uniqueid == startup_serial_num_procs) {
1009 /*
1010 * Turn off startup serial logging now that we have reached
1011 * the defined number of startup processes.
1012 */
1013 startup_serial_logging_active = false;
1014 }
1015
1016 /*
1017 * We've identified the PID we are going to use;
1018 * initialize the new process structure.
1019 */
1020 child_proc->p_stat = SIDL;
1021
1022 /*
1023 * The zero'ing of the proc was at the allocation time due to need
1024 * for insertion to hash. Copy the section that is to be copied
1025 * directly from the parent.
1026 */
1027 child_proc->p_forkcopy = parent_proc->p_forkcopy;
1028
1029 proc_ro_data.syscall_filter_mask = proc_syscall_filter_mask(parent_proc);
1030 proc_ro_data.p_platform_data = proc_get_ro(p: parent_proc)->p_platform_data;
1031
1032 /*
1033 * Some flags are inherited from the parent.
1034 * Duplicate sub-structures as needed.
1035 * Increase reference counts on shared objects.
1036 * The p_stats substruct is set in vm_fork.
1037 */
1038#if CONFIG_DELAY_IDLE_SLEEP
1039 child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_DELAYIDLESLEEP | P_SUGID | P_AFFINITY));
1040#else /* CONFIG_DELAY_IDLE_SLEEP */
1041 child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_SUGID | P_AFFINITY));
1042#endif /* CONFIG_DELAY_IDLE_SLEEP */
1043
1044 child_proc->p_vfs_iopolicy = (parent_proc->p_vfs_iopolicy & (P_VFS_IOPOLICY_INHERITED_MASK));
1045
1046 proc_set_responsible_pid(target_proc: child_proc, responsible_pid: parent_proc->p_responsible_pid);
1047
1048 /*
1049 * Note that if the current thread has an assumed identity, this
1050 * credential will be granted to the new process.
1051 * This is OK to do in exec, because it will be over-written during image activation
1052 * before the proc is visible.
1053 */
1054 kauth_cred_set(&proc_ro_data.p_ucred.__smr_ptr, kauth_cred_get());
1055
1056 lck_mtx_init(lck: &child_proc->p_mlock, grp: &proc_mlock_grp, attr: &proc_lck_attr);
1057 lck_mtx_init(lck: &child_proc->p_ucred_mlock, grp: &proc_ucred_mlock_grp, attr: &proc_lck_attr);
1058#if CONFIG_AUDIT
1059 lck_mtx_init(lck: &child_proc->p_audit_mlock, grp: &proc_ucred_mlock_grp, attr: &proc_lck_attr);
1060#endif /* CONFIG_AUDIT */
1061#if CONFIG_DTRACE
1062 lck_mtx_init(lck: &child_proc->p_dtrace_sprlock, grp: &proc_lck_grp, attr: &proc_lck_attr);
1063#endif
1064 lck_spin_init(lck: &child_proc->p_slock, grp: &proc_slock_grp, attr: &proc_lck_attr);
1065
1066 klist_init(list: &child_proc->p_klist);
1067
1068 if (child_proc->p_textvp != NULLVP) {
1069 /* bump references to the text vnode */
1070 /* Need to hold iocount across the ref call */
1071 if ((error = vnode_getwithref(vp: child_proc->p_textvp)) == 0) {
1072 error = vnode_ref(vp: child_proc->p_textvp);
1073 vnode_put(vp: child_proc->p_textvp);
1074 }
1075
1076 if (error != 0) {
1077 child_proc->p_textvp = NULLVP;
1078 }
1079 }
1080 uint64_t csflag_inherit_mask = ~CS_KILLED;
1081 if (!in_fork) {
1082 /* All non-fork paths should not inherit GTA flag */
1083 csflag_inherit_mask &= ~CS_GET_TASK_ALLOW;
1084 }
1085 proc_ro_data.p_csflags = ((uint32_t)proc_getcsflags(parent_proc) & csflag_inherit_mask);
1086
1087 child_proc->p_proc_ro = proc_ro_alloc(p: child_proc, p_data: &proc_ro_data, NULL, NULL);
1088
1089 /* update cred on proc */
1090 proc_update_creds_onproc(child_proc, cred: proc_ucred_unsafe(p: child_proc));
1091
1092 /* update audit session proc count */
1093 AUDIT_SESSION_PROCNEW(child_proc);
1094
1095 /*
1096 * Copy the parents per process open file table to the child; if
1097 * there is a per-thread current working directory, set the childs
1098 * per-process current working directory to that instead of the
1099 * parents.
1100 */
1101 if (fdt_fork(child_fdt: &child_proc->p_fd, parent_p: parent_proc, uth_cdir: parent_uthread->uu_cdir, in_exec) != 0) {
1102 forkproc_free(p: child_proc);
1103 child_proc = NULL;
1104 goto bad;
1105 }
1106
1107#if SYSV_SHM
1108 if (parent_proc->vm_shm && !in_exec) {
1109 /* XXX may fail to attach shm to child */
1110 (void)shmfork(parent_proc, child_proc);
1111 }
1112#endif
1113
1114 /*
1115 * Child inherits the parent's plimit
1116 */
1117 proc_limitfork(parent: parent_proc, child: child_proc);
1118
1119 rlimit_cpu_cur = proc_limitgetcur(p: child_proc, RLIMIT_CPU);
1120 if (rlimit_cpu_cur != RLIM_INFINITY) {
1121 child_proc->p_rlim_cpu.tv_sec = (rlimit_cpu_cur > __INT_MAX__) ? __INT_MAX__ : rlimit_cpu_cur;
1122 }
1123
1124 if (in_exec) {
1125 /* Keep the original start time for exec'ed proc */
1126 child_proc->p_stats->ps_start = parent_proc->p_stats->ps_start;
1127 child_proc->p_start.tv_sec = parent_proc->p_start.tv_sec;
1128 child_proc->p_start.tv_usec = parent_proc->p_start.tv_usec;
1129 } else {
1130 /* Intialize new process stats, including start time */
1131 /* <rdar://6640543> non-zeroed portion contains garbage AFAICT */
1132 microtime_with_abstime(tv: &child_proc->p_start, abstime: &child_proc->p_stats->ps_start);
1133 }
1134
1135 if (pg->pg_session->s_ttyvp != NULL && parent_proc->p_flag & P_CONTROLT) {
1136 os_atomic_or(&child_proc->p_flag, P_CONTROLT, relaxed);
1137 }
1138
1139 /*
1140 * block all signals to reach the process.
1141 * no transition race should be occuring with the child yet,
1142 * but indicate that the process is in (the creation) transition.
1143 */
1144 proc_signalstart(child_proc, locked: 0);
1145 proc_transstart(child_proc, locked: 0, non_blocking: 0);
1146
1147 child_proc->p_pcaction = 0;
1148
1149 TAILQ_INIT(&child_proc->p_uthlist);
1150 TAILQ_INIT(&child_proc->p_aio_activeq);
1151 TAILQ_INIT(&child_proc->p_aio_doneq);
1152
1153 /*
1154 * Copy work queue information
1155 *
1156 * Note: This should probably only happen in the case where we are
1157 * creating a child that is a copy of the parent; since this
1158 * routine is called in the non-duplication case of vfork()
1159 * or posix_spawn(), then this information should likely not
1160 * be duplicated.
1161 *
1162 * <rdar://6640553> Work queue pointers that no longer point to code
1163 */
1164 child_proc->p_wqthread = parent_proc->p_wqthread;
1165 child_proc->p_threadstart = parent_proc->p_threadstart;
1166 child_proc->p_pthsize = parent_proc->p_pthsize;
1167 if ((parent_proc->p_lflag & P_LREGISTER) != 0) {
1168 child_proc->p_lflag |= P_LREGISTER;
1169 }
1170 child_proc->p_dispatchqueue_offset = parent_proc->p_dispatchqueue_offset;
1171 child_proc->p_dispatchqueue_serialno_offset = parent_proc->p_dispatchqueue_serialno_offset;
1172 child_proc->p_dispatchqueue_label_offset = parent_proc->p_dispatchqueue_label_offset;
1173 child_proc->p_return_to_kernel_offset = parent_proc->p_return_to_kernel_offset;
1174 child_proc->p_mach_thread_self_offset = parent_proc->p_mach_thread_self_offset;
1175 child_proc->p_pth_tsd_offset = parent_proc->p_pth_tsd_offset;
1176 child_proc->p_pthread_wq_quantum_offset = parent_proc->p_pthread_wq_quantum_offset;
1177#if PSYNCH
1178 pth_proc_hashinit(child_proc);
1179#endif /* PSYNCH */
1180
1181#if CONFIG_PERSONAS
1182 child_proc->p_persona = NULL;
1183 if (parent_proc->p_persona) {
1184 struct persona *persona = proc_persona_get(p: parent_proc);
1185
1186 if (persona) {
1187 error = persona_proc_adopt(p: child_proc, persona, NULL);
1188 if (error != 0) {
1189 printf("forkproc: persona_proc_inherit failed (persona %d being destroyed?)\n",
1190 persona_get_id(persona));
1191 forkproc_free(p: child_proc);
1192 child_proc = NULL;
1193 goto bad;
1194 }
1195 }
1196 }
1197#endif
1198
1199#if CONFIG_MEMORYSTATUS
1200 /* Memorystatus init */
1201 child_proc->p_memstat_state = 0;
1202 child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_DEFAULT;
1203 child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_DEFAULT;
1204 child_proc->p_memstat_assertionpriority = 0;
1205 child_proc->p_memstat_userdata = 0;
1206 child_proc->p_memstat_idle_start = 0;
1207 child_proc->p_memstat_idle_delta = 0;
1208 child_proc->p_memstat_memlimit = 0;
1209 child_proc->p_memstat_memlimit_active = 0;
1210 child_proc->p_memstat_memlimit_inactive = 0;
1211 child_proc->p_memstat_relaunch_flags = P_MEMSTAT_RELAUNCH_UNKNOWN;
1212#if CONFIG_FREEZE
1213 child_proc->p_memstat_freeze_sharedanon_pages = 0;
1214#endif
1215 child_proc->p_memstat_dirty = 0;
1216 child_proc->p_memstat_idledeadline = 0;
1217#endif /* CONFIG_MEMORYSTATUS */
1218
1219 if (parent_proc->p_subsystem_root_path) {
1220 size_t parent_length = strlen(s: parent_proc->p_subsystem_root_path) + 1;
1221 assert(parent_length <= MAXPATHLEN);
1222 child_proc->p_subsystem_root_path = zalloc_flags(ZV_NAMEI,
1223 Z_WAITOK | Z_ZERO);
1224 memcpy(dst: child_proc->p_subsystem_root_path, src: parent_proc->p_subsystem_root_path, n: parent_length);
1225 }
1226
1227bad:
1228 return child_proc;
1229}
1230
1231void
1232proc_lock(proc_t p)
1233{
1234 LCK_MTX_ASSERT(&proc_list_mlock, LCK_MTX_ASSERT_NOTOWNED);
1235 lck_mtx_lock(lck: &p->p_mlock);
1236}
1237
1238void
1239proc_unlock(proc_t p)
1240{
1241 lck_mtx_unlock(lck: &p->p_mlock);
1242}
1243
1244void
1245proc_spinlock(proc_t p)
1246{
1247 lck_spin_lock_grp(lck: &p->p_slock, grp: &proc_slock_grp);
1248}
1249
1250void
1251proc_spinunlock(proc_t p)
1252{
1253 lck_spin_unlock(lck: &p->p_slock);
1254}
1255
1256void
1257proc_list_lock(void)
1258{
1259 lck_mtx_lock(lck: &proc_list_mlock);
1260}
1261
1262void
1263proc_list_unlock(void)
1264{
1265 lck_mtx_unlock(lck: &proc_list_mlock);
1266}
1267
1268void
1269proc_ucred_lock(proc_t p)
1270{
1271 lck_mtx_lock(lck: &p->p_ucred_mlock);
1272}
1273
1274void
1275proc_ucred_unlock(proc_t p)
1276{
1277 lck_mtx_unlock(lck: &p->p_ucred_mlock);
1278}
1279
1280void
1281proc_update_creds_onproc(proc_t p, kauth_cred_t cred)
1282{
1283 p->p_uid = kauth_cred_getuid(cred: cred);
1284 p->p_gid = kauth_cred_getgid(cred: cred);
1285 p->p_ruid = kauth_cred_getruid(cred: cred);
1286 p->p_rgid = kauth_cred_getrgid(cred: cred);
1287 p->p_svuid = kauth_cred_getsvuid(cred: cred);
1288 p->p_svgid = kauth_cred_getsvgid(cred: cred);
1289}
1290
1291
1292bool
1293uthread_is64bit(struct uthread *uth)
1294{
1295 return uth->uu_flag & UT_LP64;
1296}
1297
1298void
1299uthread_init(task_t task, uthread_t uth, thread_ro_t tro_tpl, int workq_thread)
1300{
1301 uthread_t uth_parent = current_uthread();
1302
1303 lck_spin_init(lck: &uth->uu_rethrottle_lock, grp: &rethrottle_lock_grp,
1304 LCK_ATTR_NULL);
1305
1306 /*
1307 * Lazily set the thread on the kernel VFS context
1308 * to the first thread made which will be vm_pageout_scan_thread.
1309 */
1310 if (__improbable(vfs_context0.vc_thread == NULL)) {
1311 extern thread_t vm_pageout_scan_thread;
1312
1313 assert(task == kernel_task);
1314 assert(get_machthread(uth) == vm_pageout_scan_thread);
1315 vfs_context0.vc_thread = get_machthread(uth);
1316 }
1317
1318 if (task_get_64bit_addr(task)) {
1319 uth->uu_flag |= UT_LP64;
1320 }
1321
1322 /*
1323 * Thread inherits credential from the creating thread, if both
1324 * are in the same task.
1325 *
1326 * If the creating thread has no credential or is from another
1327 * task we can leave the new thread credential NULL. If it needs
1328 * one later, it will be lazily assigned from the task's process.
1329 */
1330 if (task == kernel_task) {
1331 kauth_cred_set(&tro_tpl->tro_cred, vfs_context0.vc_ucred);
1332 kauth_cred_set(&tro_tpl->tro_realcred, vfs_context0.vc_ucred);
1333 tro_tpl->tro_proc = kernproc;
1334 tro_tpl->tro_proc_ro = kernproc->p_proc_ro;
1335 } else if (!task_is_a_corpse(task)) {
1336 thread_ro_t curtro = current_thread_ro();
1337 proc_t p = get_bsdtask_info(task);
1338
1339 if (task == curtro->tro_task) {
1340 kauth_cred_set(&tro_tpl->tro_realcred,
1341 curtro->tro_realcred);
1342 if (workq_thread) {
1343 kauth_cred_set(&tro_tpl->tro_cred,
1344 curtro->tro_realcred);
1345 } else {
1346 kauth_cred_set(&tro_tpl->tro_cred,
1347 curtro->tro_cred);
1348 }
1349 tro_tpl->tro_proc_ro = curtro->tro_proc_ro;
1350 } else {
1351 kauth_cred_t cred = kauth_cred_proc_ref(procp: p);
1352 kauth_cred_set(&tro_tpl->tro_realcred, cred);
1353 kauth_cred_set(&tro_tpl->tro_cred, cred);
1354 kauth_cred_unref(&cred);
1355 tro_tpl->tro_proc_ro = task_get_ro(t: task);
1356 }
1357 tro_tpl->tro_proc = p;
1358
1359 proc_lock(p);
1360 if (workq_thread) {
1361 /* workq_thread threads will not inherit masks */
1362 uth->uu_sigmask = ~workq_threadmask;
1363 } else if (uth_parent->uu_flag & UT_SAS_OLDMASK) {
1364 uth->uu_sigmask = uth_parent->uu_oldmask;
1365 } else {
1366 uth->uu_sigmask = uth_parent->uu_sigmask;
1367 }
1368
1369 TAILQ_INSERT_TAIL(&p->p_uthlist, uth, uu_list);
1370 proc_unlock(p);
1371
1372#if CONFIG_DTRACE
1373 if (p->p_dtrace_ptss_pages != NULL) {
1374 uth->t_dtrace_scratch = dtrace_ptss_claim_entry(p);
1375 }
1376#endif
1377 } else {
1378 tro_tpl->tro_proc_ro = task_get_ro(t: task);
1379 }
1380
1381 uth->uu_pending_sigreturn = 0;
1382 uthread_init_proc_refcount(uth);
1383}
1384
1385mach_port_name_t
1386uthread_joiner_port(struct uthread *uth)
1387{
1388 return uth->uu_save.uus_bsdthread_terminate.kport;
1389}
1390
1391user_addr_t
1392uthread_joiner_address(uthread_t uth)
1393{
1394 return uth->uu_save.uus_bsdthread_terminate.ulock_addr;
1395}
1396
1397void
1398uthread_joiner_wake(task_t task, uthread_t uth)
1399{
1400 struct _bsdthread_terminate bts = uth->uu_save.uus_bsdthread_terminate;
1401
1402 assert(bts.ulock_addr);
1403 bzero(s: &uth->uu_save.uus_bsdthread_terminate, n: sizeof(bts));
1404
1405 int flags = UL_UNFAIR_LOCK | ULF_WAKE_ALL | ULF_WAKE_ALLOW_NON_OWNER;
1406 (void)ulock_wake(task, operation: flags, addr: bts.ulock_addr, wake_value: 0);
1407 mach_port_deallocate(task: get_task_ipcspace(t: task), name: bts.kport);
1408}
1409
1410/*
1411 * This routine frees the thread name field of the uthread_t structure. Split out of
1412 * uthread_cleanup() so thread name does not get deallocated while generating a corpse fork.
1413 */
1414void
1415uthread_cleanup_name(uthread_t uth)
1416{
1417 /*
1418 * <rdar://17834538>
1419 * Set pth_name to NULL before calling free().
1420 * Previously there was a race condition in the
1421 * case this code was executing during a stackshot
1422 * where the stackshot could try and copy pth_name
1423 * after it had been freed and before if was marked
1424 * as null.
1425 */
1426 if (uth->pth_name != NULL) {
1427 void *pth_name = uth->pth_name;
1428 uth->pth_name = NULL;
1429 kfree_data(pth_name, MAXTHREADNAMESIZE);
1430 }
1431 return;
1432}
1433
1434/*
1435 * This routine frees all the BSD context in uthread except the credential.
1436 * It does not free the uthread structure as well
1437 */
1438void
1439uthread_cleanup(uthread_t uth, thread_ro_t tro)
1440{
1441 task_t task = tro->tro_task;
1442 proc_t p = tro->tro_proc;
1443
1444 uthread_assert_zero_proc_refcount(uth);
1445
1446 if (uth->uu_lowpri_window || uth->uu_throttle_info) {
1447 /*
1448 * task is marked as a low priority I/O type
1449 * and we've somehow managed to not dismiss the throttle
1450 * through the normal exit paths back to user space...
1451 * no need to throttle this thread since its going away
1452 * but we do need to update our bookeeping w/r to throttled threads
1453 *
1454 * Calling this routine will clean up any throttle info reference
1455 * still inuse by the thread.
1456 */
1457 throttle_lowpri_io(sleep_amount: 0);
1458 }
1459
1460#if CONFIG_AUDIT
1461 /*
1462 * Per-thread audit state should never last beyond system
1463 * call return. Since we don't audit the thread creation/
1464 * removal, the thread state pointer should never be
1465 * non-NULL when we get here.
1466 */
1467 assert(uth->uu_ar == NULL);
1468#endif
1469
1470 if (uth->uu_select.nbytes) {
1471 select_cleanup_uthread(&uth->uu_select);
1472 }
1473
1474 if (uth->uu_cdir) {
1475 vnode_rele(vp: uth->uu_cdir);
1476 uth->uu_cdir = NULLVP;
1477 }
1478
1479 if (uth->uu_selset) {
1480 select_set_free(selset: uth->uu_selset);
1481 uth->uu_selset = NULL;
1482 }
1483
1484 os_reason_free(cur_reason: uth->uu_exit_reason);
1485
1486 if ((task != kernel_task) && p) {
1487 /*
1488 * Remove the thread from the process list and
1489 * transfer [appropriate] pending signals to the process.
1490 * Do not remove the uthread from proc uthlist for exec
1491 * copy task, since they does not have a ref on proc and
1492 * would not have been added to the list.
1493 */
1494 if (uth->uu_kqr_bound) {
1495 kqueue_threadreq_unbind(p, uth->uu_kqr_bound);
1496 }
1497
1498 if (get_bsdtask_info(task) == p) {
1499 proc_lock(p);
1500 TAILQ_REMOVE(&p->p_uthlist, uth, uu_list);
1501 p->p_siglist |= (uth->uu_siglist & execmask & (~p->p_sigignore | sigcantmask));
1502 proc_unlock(p);
1503 }
1504
1505#if CONFIG_DTRACE
1506 struct dtrace_ptss_page_entry *tmpptr = uth->t_dtrace_scratch;
1507 uth->t_dtrace_scratch = NULL;
1508 if (tmpptr != NULL) {
1509 dtrace_ptss_release_entry(p, e: tmpptr);
1510 }
1511#endif
1512 } else {
1513 assert(!uth->uu_kqr_bound);
1514 }
1515}
1516
1517/* This routine releases the credential stored in uthread */
1518void
1519uthread_cred_ref(struct ucred *ucred)
1520{
1521 kauth_cred_ref(cred: ucred);
1522}
1523
1524void
1525uthread_cred_free(struct ucred *ucred)
1526{
1527 kauth_cred_set(&ucred, NOCRED);
1528}
1529
1530/* This routine frees the uthread structure held in thread structure */
1531void
1532uthread_destroy(uthread_t uth)
1533{
1534 uthread_destroy_proc_refcount(uth);
1535
1536 if (uth->t_tombstone) {
1537 kfree_type(struct doc_tombstone, uth->t_tombstone);
1538 uth->t_tombstone = NULL;
1539 }
1540
1541#if CONFIG_DEBUG_SYSCALL_REJECTION
1542 size_t const bitstr_len = BITMAP_SIZE(mach_trap_count + nsysent);
1543
1544 if (uth->syscall_rejection_mask) {
1545 kfree_data(uth->syscall_rejection_mask, bitstr_len);
1546 uth->syscall_rejection_mask = NULL;
1547 }
1548
1549 if (uth->syscall_rejection_once_mask) {
1550 kfree_data(uth->syscall_rejection_once_mask, bitstr_len);
1551 uth->syscall_rejection_once_mask = NULL;
1552 }
1553#endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
1554
1555 lck_spin_destroy(lck: &uth->uu_rethrottle_lock, grp: &rethrottle_lock_grp);
1556
1557 uthread_cleanup_name(uth);
1558}
1559
1560user_addr_t
1561thread_get_sigreturn_token(thread_t thread)
1562{
1563 uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1564 return ut->uu_sigreturn_token;
1565}
1566
1567uint32_t
1568thread_get_sigreturn_diversifier(thread_t thread)
1569{
1570 uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1571 return ut->uu_sigreturn_diversifier;
1572}
1573