xref: /freebsd/sys/kern/sys_procdesc.c (revision 13de33a5dc2304b13d595d75d48c51793958474f)
1 /*-
2  * Copyright (c) 2009 Robert N. M. Watson
3  * All rights reserved.
4  *
5  * This software was developed at the University of Cambridge Computer
6  * Laboratory with support from a grant from Google, Inc.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*-
31  * FreeBSD process descriptor facility.
32  *
33  * Some processes are represented by a file descriptor, which will be used in
34  * preference to signaling and pids for the purposes of process management,
35  * and is, in effect, a form of capability.  When a process descriptor is
36  * used with a process, it ceases to be visible to certain traditional UNIX
37  * process facilities, such as waitpid(2).
38  *
39  * Some semantics:
40  *
41  * - At most one process descriptor will exist for any process, although
42  *   references to that descriptor may be held from many processes (or even
43  *   be in flight between processes over a local domain socket).
44  * - Last close on the process descriptor will terminate the process using
45  *   SIGKILL and reparent it to init so that there's a process to reap it
46  *   when it's done exiting.
47  * - If the process exits before the descriptor is closed, it will not
48  *   generate SIGCHLD on termination, or be picked up by waitpid().
49  * - The pdkill(2) system call may be used to deliver a signal to the process
50  *   using its process descriptor.
51  * - The pdwait4(2) system call may be used to block (or not) on a process
52  *   descriptor to collect termination information.
53  *
54  * Open questions:
55  *
56  * - How to handle ptrace(2)?
57  * - Will we want to add a pidtoprocdesc(2) system call to allow process
58  *   descriptors to be created for processes without pfork(2)?
59  */
60 
61 #include <sys/cdefs.h>
62 __FBSDID("$FreeBSD$");
63 
64 #include <sys/param.h>
65 #include <sys/capability.h>
66 #include <sys/fcntl.h>
67 #include <sys/file.h>
68 #include <sys/filedesc.h>
69 #include <sys/kernel.h>
70 #include <sys/lock.h>
71 #include <sys/mutex.h>
72 #include <sys/poll.h>
73 #include <sys/proc.h>
74 #include <sys/procdesc.h>
75 #include <sys/resourcevar.h>
76 #include <sys/stat.h>
77 #include <sys/sysproto.h>
78 #include <sys/sysctl.h>
79 #include <sys/systm.h>
80 #include <sys/ucred.h>
81 
82 #include <security/audit/audit.h>
83 
84 #include <vm/uma.h>
85 
86 FEATURE(process_descriptors, "Process Descriptors");
87 
88 static uma_zone_t procdesc_zone;
89 
90 static fo_rdwr_t	procdesc_read;
91 static fo_rdwr_t	procdesc_write;
92 static fo_truncate_t	procdesc_truncate;
93 static fo_ioctl_t	procdesc_ioctl;
94 static fo_poll_t	procdesc_poll;
95 static fo_kqfilter_t	procdesc_kqfilter;
96 static fo_stat_t	procdesc_stat;
97 static fo_close_t	procdesc_close;
98 static fo_chmod_t	procdesc_chmod;
99 static fo_chown_t	procdesc_chown;
100 
101 static struct fileops procdesc_ops = {
102 	.fo_read = procdesc_read,
103 	.fo_write = procdesc_write,
104 	.fo_truncate = procdesc_truncate,
105 	.fo_ioctl = procdesc_ioctl,
106 	.fo_poll = procdesc_poll,
107 	.fo_kqfilter = procdesc_kqfilter,
108 	.fo_stat = procdesc_stat,
109 	.fo_close = procdesc_close,
110 	.fo_chmod = procdesc_chmod,
111 	.fo_chown = procdesc_chown,
112 	.fo_sendfile = invfo_sendfile,
113 	.fo_flags = DFLAG_PASSABLE,
114 };
115 
116 /*
117  * Initialize with VFS so that process descriptors are available along with
118  * other file descriptor types.  As long as it runs before init(8) starts,
119  * there shouldn't be a problem.
120  */
121 static void
122 procdesc_init(void *dummy __unused)
123 {
124 
125 	procdesc_zone = uma_zcreate("procdesc", sizeof(struct procdesc),
126 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
127 	if (procdesc_zone == NULL)
128 		panic("procdesc_init: procdesc_zone not initialized");
129 }
130 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_ANY, procdesc_init, NULL);
131 
132 /*
133  * Return a locked process given a process descriptor, or ESRCH if it has
134  * died.
135  */
136 int
137 procdesc_find(struct thread *td, int fd, cap_rights_t *rightsp,
138     struct proc **p)
139 {
140 	struct procdesc *pd;
141 	struct file *fp;
142 	int error;
143 
144 	error = fget(td, fd, rightsp, &fp);
145 	if (error)
146 		return (error);
147 	if (fp->f_type != DTYPE_PROCDESC) {
148 		error = EBADF;
149 		goto out;
150 	}
151 	pd = fp->f_data;
152 	sx_slock(&proctree_lock);
153 	if (pd->pd_proc != NULL) {
154 		*p = pd->pd_proc;
155 		PROC_LOCK(*p);
156 	} else
157 		error = ESRCH;
158 	sx_sunlock(&proctree_lock);
159 out:
160 	fdrop(fp, td);
161 	return (error);
162 }
163 
164 /*
165  * Function to be used by procstat(1) sysctls when returning procdesc
166  * information.
167  */
168 pid_t
169 procdesc_pid(struct file *fp_procdesc)
170 {
171 	struct procdesc *pd;
172 
173 	KASSERT(fp_procdesc->f_type == DTYPE_PROCDESC,
174 	   ("procdesc_pid: !procdesc"));
175 
176 	pd = fp_procdesc->f_data;
177 	return (pd->pd_pid);
178 }
179 
180 /*
181  * Retrieve the PID associated with a process descriptor.
182  */
183 int
184 kern_pdgetpid(struct thread *td, int fd, cap_rights_t *rightsp, pid_t *pidp)
185 {
186 	struct file *fp;
187 	int error;
188 
189 	error = fget(td, fd, rightsp, &fp);
190 	if (error)
191 		return (error);
192 	if (fp->f_type != DTYPE_PROCDESC) {
193 		error = EBADF;
194 		goto out;
195 	}
196 	*pidp = procdesc_pid(fp);
197 out:
198 	fdrop(fp, td);
199 	return (error);
200 }
201 
202 /*
203  * System call to return the pid of a process given its process descriptor.
204  */
205 int
206 sys_pdgetpid(struct thread *td, struct pdgetpid_args *uap)
207 {
208 	cap_rights_t rights;
209 	pid_t pid;
210 	int error;
211 
212 	AUDIT_ARG_FD(uap->fd);
213 	error = kern_pdgetpid(td, uap->fd,
214 	    cap_rights_init(&rights, CAP_PDGETPID), &pid);
215 	if (error == 0)
216 		error = copyout(&pid, uap->pidp, sizeof(pid));
217 	return (error);
218 }
219 
220 /*
221  * When a new process is forked by pdfork(), a file descriptor is allocated
222  * by the fork code first, then the process is forked, and then we get a
223  * chance to set up the process descriptor.  Failure is not permitted at this
224  * point, so procdesc_new() must succeed.
225  */
226 void
227 procdesc_new(struct proc *p, int flags)
228 {
229 	struct procdesc *pd;
230 
231 	pd = uma_zalloc(procdesc_zone, M_WAITOK | M_ZERO);
232 	pd->pd_proc = p;
233 	pd->pd_pid = p->p_pid;
234 	p->p_procdesc = pd;
235 	pd->pd_flags = 0;
236 	if (flags & PD_DAEMON)
237 		pd->pd_flags |= PDF_DAEMON;
238 	PROCDESC_LOCK_INIT(pd);
239 
240 	/*
241 	 * Process descriptors start out with two references: one from their
242 	 * struct file, and the other from their struct proc.
243 	 */
244 	refcount_init(&pd->pd_refcount, 2);
245 }
246 
247 /*
248  * Initialize a file with a process descriptor.
249  */
250 void
251 procdesc_finit(struct procdesc *pdp, struct file *fp)
252 {
253 
254 	finit(fp, FREAD | FWRITE, DTYPE_PROCDESC, pdp, &procdesc_ops);
255 }
256 
257 static void
258 procdesc_free(struct procdesc *pd)
259 {
260 
261 	/*
262 	 * When the last reference is released, we assert that the descriptor
263 	 * has been closed, but not that the process has exited, as we will
264 	 * detach the descriptor before the process dies if the descript is
265 	 * closed, as we can't wait synchronously.
266 	 */
267 	if (refcount_release(&pd->pd_refcount)) {
268 		KASSERT(pd->pd_proc == NULL,
269 		    ("procdesc_free: pd_proc != NULL"));
270 		KASSERT((pd->pd_flags & PDF_CLOSED),
271 		    ("procdesc_free: !PDF_CLOSED"));
272 
273 		PROCDESC_LOCK_DESTROY(pd);
274 		uma_zfree(procdesc_zone, pd);
275 	}
276 }
277 
278 /*
279  * procdesc_exit() - notify a process descriptor that its process is exiting.
280  * We use the proctree_lock to ensure that process exit either happens
281  * strictly before or strictly after a concurrent call to procdesc_close().
282  */
283 int
284 procdesc_exit(struct proc *p)
285 {
286 	struct procdesc *pd;
287 
288 	sx_assert(&proctree_lock, SA_XLOCKED);
289 	PROC_LOCK_ASSERT(p, MA_OWNED);
290 	KASSERT(p->p_procdesc != NULL, ("procdesc_exit: p_procdesc NULL"));
291 
292 	pd = p->p_procdesc;
293 
294 	PROCDESC_LOCK(pd);
295 	KASSERT((pd->pd_flags & PDF_CLOSED) == 0 || p->p_pptr == initproc,
296 	    ("procdesc_exit: closed && parent not init"));
297 
298 	pd->pd_flags |= PDF_EXITED;
299 
300 	/*
301 	 * If the process descriptor has been closed, then we have nothing
302 	 * to do; return 1 so that init will get SIGCHLD and do the reaping.
303 	 * Clean up the procdesc now rather than letting it happen during
304 	 * that reap.
305 	 */
306 	if (pd->pd_flags & PDF_CLOSED) {
307 		PROCDESC_UNLOCK(pd);
308 		pd->pd_proc = NULL;
309 		p->p_procdesc = NULL;
310 		procdesc_free(pd);
311 		return (1);
312 	}
313 	if (pd->pd_flags & PDF_SELECTED) {
314 		pd->pd_flags &= ~PDF_SELECTED;
315 		selwakeup(&pd->pd_selinfo);
316 	}
317 	PROCDESC_UNLOCK(pd);
318 	return (0);
319 }
320 
321 /*
322  * When a process descriptor is reaped, perhaps as a result of close() or
323  * pdwait4(), release the process's reference on the process descriptor.
324  */
325 void
326 procdesc_reap(struct proc *p)
327 {
328 	struct procdesc *pd;
329 
330 	sx_assert(&proctree_lock, SA_XLOCKED);
331 	KASSERT(p->p_procdesc != NULL, ("procdesc_reap: p_procdesc == NULL"));
332 
333 	pd = p->p_procdesc;
334 	pd->pd_proc = NULL;
335 	p->p_procdesc = NULL;
336 	procdesc_free(pd);
337 }
338 
339 /*
340  * procdesc_close() - last close on a process descriptor.  If the process is
341  * still running, terminate with SIGKILL (unless PDF_DAEMON is set) and let
342  * init(8) clean up the mess; if not, we have to clean up the zombie ourselves.
343  */
344 static int
345 procdesc_close(struct file *fp, struct thread *td)
346 {
347 	struct procdesc *pd;
348 	struct proc *p;
349 
350 	KASSERT(fp->f_type == DTYPE_PROCDESC, ("procdesc_close: !procdesc"));
351 
352 	pd = fp->f_data;
353 	fp->f_ops = &badfileops;
354 	fp->f_data = NULL;
355 
356 	sx_xlock(&proctree_lock);
357 	PROCDESC_LOCK(pd);
358 	pd->pd_flags |= PDF_CLOSED;
359 	PROCDESC_UNLOCK(pd);
360 	p = pd->pd_proc;
361 	if (p == NULL) {
362 		/*
363 		 * This is the case where process' exit status was already
364 		 * collected and procdesc_reap() was already called.
365 		 */
366 		sx_xunlock(&proctree_lock);
367 	} else if (p->p_state == PRS_ZOMBIE) {
368 		/*
369 		 * If the process is already dead and just awaiting reaping,
370 		 * do that now.  This will release the process's reference to
371 		 * the process descriptor when it calls back into
372 		 * procdesc_reap().
373 		 */
374 		PROC_LOCK(p);
375 		PROC_SLOCK(p);
376 		proc_reap(curthread, p, NULL, 0);
377 	} else {
378 		/*
379 		 * If the process is not yet dead, we need to kill it, but we
380 		 * can't wait around synchronously for it to go away, as that
381 		 * path leads to madness (and deadlocks).  First, detach the
382 		 * process from its descriptor so that its exit status will
383 		 * be reported normally.
384 		 */
385 		PROC_LOCK(p);
386 		pd->pd_proc = NULL;
387 		p->p_procdesc = NULL;
388 		procdesc_free(pd);
389 
390 		/*
391 		 * Next, reparent it to init(8) so that there's someone to
392 		 * pick up the pieces; finally, terminate with prejudice.
393 		 */
394 		p->p_sigparent = SIGCHLD;
395 		proc_reparent(p, initproc);
396 		if ((pd->pd_flags & PDF_DAEMON) == 0)
397 			kern_psignal(p, SIGKILL);
398 		PROC_UNLOCK(p);
399 		sx_xunlock(&proctree_lock);
400 	}
401 
402 	/*
403 	 * Release the file descriptor's reference on the process descriptor.
404 	 */
405 	procdesc_free(pd);
406 	return (0);
407 }
408 
409 static int
410 procdesc_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
411     int flags, struct thread *td)
412 {
413 
414 	return (EOPNOTSUPP);
415 }
416 
417 static int
418 procdesc_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
419     int flags, struct thread *td)
420 {
421 
422 	return (EOPNOTSUPP);
423 }
424 
425 static int
426 procdesc_truncate(struct file *fp, off_t length, struct ucred *active_cred,
427     struct thread *td)
428 {
429 
430 	return (EOPNOTSUPP);
431 }
432 
433 static int
434 procdesc_ioctl(struct file *fp, u_long com, void *data,
435     struct ucred *active_cred, struct thread *td)
436 {
437 
438 	return (EOPNOTSUPP);
439 }
440 
441 static int
442 procdesc_poll(struct file *fp, int events, struct ucred *active_cred,
443     struct thread *td)
444 {
445 	struct procdesc *pd;
446 	int revents;
447 
448 	revents = 0;
449 	pd = fp->f_data;
450 	PROCDESC_LOCK(pd);
451 	if (pd->pd_flags & PDF_EXITED)
452 		revents |= POLLHUP;
453 	if (revents == 0) {
454 		selrecord(td, &pd->pd_selinfo);
455 		pd->pd_flags |= PDF_SELECTED;
456 	}
457 	PROCDESC_UNLOCK(pd);
458 	return (revents);
459 }
460 
461 static int
462 procdesc_kqfilter(struct file *fp, struct knote *kn)
463 {
464 
465 	return (EOPNOTSUPP);
466 }
467 
468 static int
469 procdesc_stat(struct file *fp, struct stat *sb, struct ucred *active_cred,
470     struct thread *td)
471 {
472 	struct procdesc *pd;
473 	struct timeval pstart;
474 
475 	/*
476 	 * XXXRW: Perhaps we should cache some more information from the
477 	 * process so that we can return it reliably here even after it has
478 	 * died.  For example, caching its credential data.
479 	 */
480 	bzero(sb, sizeof(*sb));
481 	pd = fp->f_data;
482 	sx_slock(&proctree_lock);
483 	if (pd->pd_proc != NULL) {
484 		PROC_LOCK(pd->pd_proc);
485 
486 		/* Set birth and [acm] times to process start time. */
487 		pstart = pd->pd_proc->p_stats->p_start;
488 		timevaladd(&pstart, &boottime);
489 		TIMEVAL_TO_TIMESPEC(&pstart, &sb->st_birthtim);
490 		sb->st_atim = sb->st_birthtim;
491 		sb->st_ctim = sb->st_birthtim;
492 		sb->st_mtim = sb->st_birthtim;
493 		if (pd->pd_proc->p_state != PRS_ZOMBIE)
494 			sb->st_mode = S_IFREG | S_IRWXU;
495 		else
496 			sb->st_mode = S_IFREG;
497 		sb->st_uid = pd->pd_proc->p_ucred->cr_ruid;
498 		sb->st_gid = pd->pd_proc->p_ucred->cr_rgid;
499 		PROC_UNLOCK(pd->pd_proc);
500 	} else
501 		sb->st_mode = S_IFREG;
502 	sx_sunlock(&proctree_lock);
503 	return (0);
504 }
505 
506 static int
507 procdesc_chmod(struct file *fp, mode_t mode, struct ucred *active_cred,
508     struct thread *td)
509 {
510 
511 	return (EOPNOTSUPP);
512 }
513 
514 static int
515 procdesc_chown(struct file *fp, uid_t uid, gid_t gid, struct ucred *active_cred,
516     struct thread *td)
517 {
518 
519 	return (EOPNOTSUPP);
520 }
521