From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14766 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: posix_spawn Date: Mon, 30 Sep 2019 22:55:43 -0400 Message-ID: <20191001025543.GB16318@brightrain.aerifal.cx> References: <20190930223632.GW9017@brightrain.aerifal.cx> <20191001022102.GA16318@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="78395"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.5.21 (2010-09-15) Cc: musl To: Joshua Hudson Original-X-From: musl-return-14782-gllmg-musl=m.gmane.org@lists.openwall.com Tue Oct 01 04:55:59 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1iF8KV-000KCk-DR for gllmg-musl@m.gmane.org; Tue, 01 Oct 2019 04:55:59 +0200 Original-Received: (qmail 32293 invoked by uid 550); 1 Oct 2019 02:55:56 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 32275 invoked from network); 1 Oct 2019 02:55:56 -0000 Content-Disposition: inline In-Reply-To: Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:14766 Archived-At: On Mon, Sep 30, 2019 at 07:41:32PM -0700, Joshua Hudson wrote: > > > You now have a quirk and I need to actually detect musl libc. > > > Huh? This does not sound musl-specific. > > Musl seems to be the only library that actually implements vfork > shared memory that can't tolerate calling setuid() inside it. Oh, so you're still trying to do something that is documented as invalid... > This patch should take care of the issue. > > diff --git a/src/thread/synccall.c b/src/thread/synccall.c > index 648a6ad4..e152ccfe 100644 > --- a/src/thread/synccall.c > +++ b/src/thread/synccall.c > @@ -48,6 +48,9 @@ void __synccall(void (*func)(void *), void *ctx) > struct sigaction sa = { .sa_flags = SA_RESTART, .sa_handler = handler }; > pthread_t self = __pthread_self(), td; > int count = 0; > + /* If we aren't in the process we think we're in, this is the best we > + * can hope for. */ > + if (__pthread_self()->tid != syscall(SYS_gettid)) goto single_threaded; > > /* Blocking signals in two steps, first only app-level signals > * before taking the lock, then all signals after taking the lock, This is not safe and creates a false sense that something broken might work. Moreover it's a vulnerability to use it this way. You have a window where different tasks sharing VM space are executing with different privilege levels, and thereby one is able to seize execution of the other and achieve its privilege level. This is the whole situation that the robust multithreaded set*id() is designed to preclude. A better patch here would be: + if (__pthread_self()->tid != syscall(SYS_gettid)) a_crash(); to prevent forward progress in a process with dangerously corrupt state. Rich