On Fri, Jun 5, 2020 at 9:55 AM Szabolcs Nagy <nsz@xxxxxxxxxx> wrote: > > * Christian Brauner <christian.brauner@xxxxxxxxxx> [2020-06-02 22:42:17 +0200]: > > [... snip ...] > > > > First, it helps to close all file descriptors of an exec()ing task. This > > can be done safely via (quoting Al's example from [1] verbatim): > > > > /* that exec is sensitive */ > > unshare(CLONE_FILES); > > /* we don't want anything past stderr here */ > > close_range(3, ~0U); > > execve(....); > > this api needs a documentation patch if there isn't yet. > > currently there is no libc interface contract in place that > says which calls may use libc internal fds e.g. i've seen > > openlog(...) // opens libc internal syslog fd > ... > fork() > closefrom(...) // close syslog fd > open(...) // something that reuses the closed fd > syslog(...) // unsafe: uses the wrong fd > execve(...) > > syslog uses a libc internal fd that the user trampled on and > this can go bad in many ways depending on what libc apis are > used between closefrom (or equivalent) and exec. > Documentation is good. :-) I think you'll find that while this example seems to be innocuous on FreeBSD (and likely other *BSD), this is an atypical scenario and generally not advised. You would usually not start closing until you're actually ready to exec/fail. > > The code snippet above is one way of working around the problem that file > > descriptors are not cloexec by default. This is aggravated by the fact that > > we can't just switch them over without massively regressing userspace. For > > why is a switch_to_cloexec_range worse than close_range? > the former seems safer to me. (and allows libc calls > to be made between such switch and exec: libc internal > fds have to be cloexec anyway) > I wouldn't say it's worse, but it only solves half the problem. While closefrom -> exec is the most common usage by a long shot, there are also times (e.g. post-fork without intent to exec for a daemon/service type) that you want to go ahead and close everything except maybe a pipe fd that you've opened for IPC. While uncommon, there's no reason this needs to devolve into a loop to close 'all the fds' when you can instead introduce close_range to solve both the exec case and other less common scenarios. > > a whole class of programs having an in-kernel method of closing all file > > descriptors is very helpful (e.g. demons, service managers, programming > > language standard libraries, container managers etc.). > > (Please note, unshare(CLONE_FILES) should only be needed if the calling > > task is multi-threaded and shares the file descriptor table with another > > thread in which case two threads could race with one thread allocating file > > descriptors and the other one closing them via close_range(). For the > > general case close_range() before the execve() is sufficient.) > > > > Second, it allows userspace to avoid implementing closing all file > > descriptors by parsing through /proc/<pid>/fd/* and calling close() on each > > file descriptor. From looking at various large(ish) userspace code bases > > this or similar patterns are very common in: > > - service managers (cf. [4]) > > - libcs (cf. [6]) > > - container runtimes (cf. [5]) > > - programming language runtimes/standard libraries > > - Python (cf. [2]) > > - Rust (cf. [7], [8]) > > As Dmitry pointed out there's even a long-standing glibc bug about missing > > kernel support for this task (cf. [3]). > > In addition, the syscall will also work for tasks that do not have procfs > > mounted and on kernels that do not have procfs support compiled in. In such > > situations the only way to make sure that all file descriptors are closed > > is to call close() on each file descriptor up to UINT_MAX or RLIMIT_NOFILE, > > OPEN_MAX trickery (cf. comment [8] on Rust). > > close_range still seems like a bad operation to expose. > > if users really want closing behaviour (instead of marking > fds cloexec) then they likely need coordination with libc > and other libraries. > > e.g. this usage does not work: > > maxfd = findmaxfd(); > call_that_may_leak_fds(); > close_range(maxfd,~0U); > > as far as i can tell only the close right before exec works. I don't have much to say on this one, except that's also an unusual case. I don't know that I'd anticipate close_range getting used for that kind of cleanup job (I've never seen a similar use of closefrom), which seems to just be papering over application/library bugs. Coordination with libc is generally not much of an issue, because this is really one of the last things you do before exec() or swiftly failing miserably. Applications that currently loop over all fd <= maxfd and close(fd) right now are subject to the very same constraints, this is just a much more efficient way and debugger-friendly way to accomplish it. You've absolutely not lived life until you've had to watch thousands of close() calls painfully scroll by in truss/strace. Thank, Kyle Evans
