1 #include <darwintest.h>
2 #include <darwintest_utils.h>
3
4 #include <errno.h>
5 #include <fcntl.h>
6 #include <signal.h>
7 #include <spawn.h>
8 #include <spawn_private.h>
9 #include <stdbool.h>
10 #include <stdint.h>
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <sys/spawn_internal.h>
15 #include <sys/stat.h>
16 #include <sys/sysctl.h>
17 #include <sys/syslimits.h>
18 #include <sysexits.h>
19 #include <unistd.h>
20
21 static char tmp_path_filter_rules[PATH_MAX] = "";
22 static char tmp_path_env_output[PATH_MAX] = "";
23
24 static void
cleanup_tmpfiles(void)25 cleanup_tmpfiles(void)
26 {
27 if (tmp_path_filter_rules[0] != '\0') {
28 unlink(tmp_path_filter_rules);
29 }
30 if (tmp_path_env_output[0] != '\0') {
31 unlink(tmp_path_env_output);
32 }
33 }
34
35 /*
36 * Creates a filtering rules file that says "when launching sh, add this env
37 * var". The we launch "sh -c env", redirect the output to a file, read the file
38 * and check that the added env var is present.
39 */
40 T_DECL(posix_spawn_filtering,
41 "Check posix_spawn_filtering",
42 T_META_ENVVAR("FEATUREFLAGS_ENABLED=Libsystem/posix_spawn_filtering"))
43 {
44 #if TARGET_OS_OSX
45 const char *tmpdir = dt_tmpdir();
46 T_LOG("tmpdir: %s\n", tmpdir);
47
48 strlcat(tmp_path_filter_rules, tmpdir ? tmpdir : "/tmp", sizeof(tmp_path_filter_rules));
49 strlcat(tmp_path_filter_rules, "/filter.rules.XXXXX", sizeof(tmp_path_filter_rules));
50 int filter_rules_fd = mkstemp(tmp_path_filter_rules);
51 T_ASSERT_POSIX_SUCCESS(filter_rules_fd, "create temporary file 1");
52
53 const char *filter_rules_contents =
54 "binary_name:sh\n"
55 "add_env:ADDED_VAR=VIA_RULES\n";
56 ssize_t bytes_written = write(filter_rules_fd, filter_rules_contents, strlen(filter_rules_contents));
57 T_ASSERT_EQ(bytes_written, (long)strlen(filter_rules_contents), "write should write all contents");
58 close(filter_rules_fd);
59
60 strlcat(tmp_path_env_output, tmpdir ? tmpdir : "/tmp", sizeof(tmp_path_env_output));
61 strlcat(tmp_path_env_output, "/env.output.XXXXX", sizeof(tmp_path_env_output));
62 int env_output_fd = mkstemp(tmp_path_env_output);
63 T_ASSERT_POSIX_SUCCESS(env_output_fd, "create temporary file 2");
64
65 T_ATEND(cleanup_tmpfiles);
66
67 char * const prog = "/bin/sh";
68 char * const argv_child[] = { prog,
69 "-c",
70 "/usr/bin/env",
71 NULL, };
72
73 char rules_path_env[PATH_MAX + 100] = {0};
74 sprintf(rules_path_env, "POSIX_SPAWN_FILTERING_RULES_PATH=%s", tmp_path_filter_rules);
75 char * const envp_child[] = {
76 "HELLO=WORLD",
77 rules_path_env,
78 NULL,
79 };
80
81 pid_t child_pid;
82
83 posix_spawn_file_actions_t file_actions;
84 T_ASSERT_POSIX_SUCCESS(posix_spawn_file_actions_init(&file_actions), "posix_spawn_file_actions_init");
85 T_ASSERT_POSIX_SUCCESS(posix_spawn_file_actions_adddup2(&file_actions, env_output_fd, STDOUT_FILENO), "posix_spawn_file_actions_addup2");
86
87 int ret;
88 ret = posix_spawn(&child_pid, prog, &file_actions, NULL, argv_child, envp_child);
89 T_ASSERT_POSIX_SUCCESS(ret, "posix_spawn");
90 T_LOG("parent: spawned child with pid %d, waiting for child to exit\n", child_pid);
91
92 ret = posix_spawn_file_actions_destroy(&file_actions);
93 T_QUIET;
94 T_ASSERT_POSIX_SUCCESS(ret, "posix_spawn_file_actions_destroy");
95
96 int status = 0;
97 int waitpid_result = waitpid(child_pid, &status, 0);
98 T_ASSERT_POSIX_SUCCESS(waitpid_result, "waitpid");
99 T_ASSERT_EQ(waitpid_result, child_pid, "waitpid should return child we spawned");
100 T_ASSERT_EQ(WIFEXITED(status), 1, "child should have exited normally");
101 T_ASSERT_EQ(WEXITSTATUS(status), EX_OK, "child should have exited with success");
102
103 T_ASSERT_EQ(lseek(env_output_fd, 0, SEEK_SET), 0ull, "lseek should succeed");
104 struct stat s;
105 T_ASSERT_POSIX_SUCCESS(fstat(env_output_fd, &s), "fstat should succeed");
106 T_ASSERT_GT(s.st_size, 0ll, "s.st_size > 0");
107 char env_file_content[s.st_size + 1];
108 memset(env_file_content, 0, s.st_size + 1);
109 T_ASSERT_EQ((long)read(env_output_fd, env_file_content, (size_t)s.st_size), (long)s.st_size, "read should load the whole file");
110
111 T_ASSERT_NOTNULL(strstr(env_file_content, "HELLO=WORLD\n"), "original env var present");
112 T_ASSERT_NOTNULL(strstr(env_file_content, "ADDED_VAR=VIA_RULES\n"), "added env var present");
113
114 T_PASS("posix_spawn_filtering did succeed to set an env var");
115
116 #else // TARGET_OS_OSX
117 T_SKIP("posix_spawn_filtering only supported on macOS");
118 #endif // TARGET_OS_OSX
119 }
120