From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 22336 invoked from network); 4 May 2023 19:17:13 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 4 May 2023 19:17:13 -0000 Received: (qmail 26228 invoked by uid 550); 4 May 2023 19:17:11 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 26196 invoked from network); 4 May 2023 19:17:10 -0000 Date: Thu, 4 May 2023 15:16:58 -0400 From: Rich Felker To: Petr Skocik Cc: musl@lists.openwall.com Message-ID: <20230504191658.GH4163@brightrain.aerifal.cx> References: <20230504175208.GF4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Namespace violation in system()? On Thu, May 04, 2023 at 08:53:03PM +0200, Petr Skocik wrote: > On 5/4/23 19:52, Rich Felker wrote: > >On Thu, May 04, 2023 at 06:33:27PM +0200, Markus Wichmann wrote: > >>Hi all, > >> > >>I stumbled upon the source code of system() today. It is this at the > >>moment: > >> > >>|int system(const char *cmd) > >>|{ > >>| pid_t pid; > >>| sigset_t old, reset; > >>| struct sigaction sa = { .sa_handler = SIG_IGN }, oldint, oldquit; > >>| int status = -1, ret; > >>| posix_spawnattr_t attr; > >>| > >>| pthread_testcancel(); > >>| > >>| if (!cmd) return 1; > >>| > >>| sigaction(SIGINT, &sa, &oldint); > >>| sigaction(SIGQUIT, &sa, &oldquit); > >>| sigaddset(&sa.sa_mask, SIGCHLD); > >>| sigprocmask(SIG_BLOCK, &sa.sa_mask, &old); > >>| > >>| sigemptyset(&reset); > >>| if (oldint.sa_handler != SIG_IGN) sigaddset(&reset, SIGINT); > >>| if (oldquit.sa_handler != SIG_IGN) sigaddset(&reset, SIGQUIT); > >>| posix_spawnattr_init(&attr); > >>| posix_spawnattr_setsigmask(&attr, &old); > >>| posix_spawnattr_setsigdefault(&attr, &reset); > >>| posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETSIGDEF|POSIX_SPAWN_SETSIGMASK); > >>| ret = posix_spawn(&pid, "/bin/sh", 0, &attr, > >>| (char *[]){"sh", "-c", (char *)cmd, 0}, __environ); > >>| posix_spawnattr_destroy(&attr); > >>| > >>| if (!ret) while (waitpid(pid, &status, 0)<0 && errno == EINTR); > >>| sigaction(SIGINT, &oldint, NULL); > >>| sigaction(SIGQUIT, &oldquit, NULL); > >>| sigprocmask(SIG_SETMASK, &old, NULL); > >>| > >>| if (ret) errno = ret; > >>| return status; > >>|} > >> > >>Aren't all of those calls namespace violations? system() is an ISO-C > >>function, so the only symbols it is allowed to pull into the link are > >>other ISO-C functions or hidden double-underscore symbols, right? But > >>all the functions called here POSIX functions. And while POSIX contains > >>the rule that posix_* functions are reserved, that is in POSIX, not > >>ISO-C. And even with that rule, there are all the other calls. > >> > >>Does someone need to pour out a bucket of underscores over this > >>function? > >The behavior of system() is implementation-defined, so we define it as > >calling those functions. :-) > > > >Rich > > Hi. I think Markus Wichmann makes a valid point. > > Unless it's valid behavior for > > #include > #include > void sigprocmask(void){ >     puts("Hi, I'm a user-defined sigprocmask"); >     system("echo hello world"); > } > int main(void){ sigprocmask(); } > > to keep outputting "Hi, I'm a user-defined sigprocmask" until it > crashes from stack overflow (musl-gcc -static). Yes, it is valid behavior. C doesn't define anything about what the command in the string means, and in fact there are commands which would do specifically that regardless of how we implement system. For example, system("gdb ..."); with an appropriately nasty set of gdb commands pointed at $PPID or something. If you want to be assuming there's an echo command with POSIX semantics, you're writing a POSIX program not a plain C program, and then redefining sigprocmask has undefined behavior. Rich