1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1991, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)kern_fork.c 8.8 (Berkeley) 2/14/95
67 */
68 /*
69 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74 /*
75 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
76 * support for mandatory and extensible security protections. This notice
77 * is included in support of clause 2.2 (b) of the Apple Public License,
78 * Version 2.0.
79 */
80
81 #include <kern/assert.h>
82 #include <kern/bits.h>
83 #include <sys/param.h>
84 #include <sys/systm.h>
85 #include <sys/filedesc.h>
86 #include <sys/kernel.h>
87 #include <sys/malloc.h>
88 #include <sys/proc_internal.h>
89 #include <sys/kauth.h>
90 #include <sys/user.h>
91 #include <sys/reason.h>
92 #include <sys/resourcevar.h>
93 #include <sys/vnode_internal.h>
94 #include <sys/file_internal.h>
95 #include <sys/acct.h>
96 #include <sys/codesign.h>
97 #include <sys/sysent.h>
98 #include <sys/sysproto.h>
99 #include <sys/ulock.h>
100 #if CONFIG_PERSONAS
101 #include <sys/persona.h>
102 #endif
103 #include <sys/doc_tombstone.h>
104 #if CONFIG_DTRACE
105 /* Do not include dtrace.h, it redefines kmem_[alloc/free] */
106 extern void (*dtrace_proc_waitfor_exec_ptr)(proc_t);
107 extern void dtrace_proc_fork(proc_t, proc_t, int);
108
109 /*
110 * Since dtrace_proc_waitfor_exec_ptr can be added/removed in dtrace_subr.c,
111 * we will store its value before actually calling it.
112 */
113 static void (*dtrace_proc_waitfor_hook)(proc_t) = NULL;
114
115 #include <sys/dtrace_ptss.h>
116 #endif
117
118 #include <security/audit/audit.h>
119
120 #include <mach/mach_types.h>
121 #include <kern/coalition.h>
122 #include <kern/kern_types.h>
123 #include <kern/kalloc.h>
124 #include <kern/mach_param.h>
125 #include <kern/task.h>
126 #include <kern/thread.h>
127 #include <kern/thread_call.h>
128 #include <kern/zalloc.h>
129
130 #include <os/log.h>
131
132 #if CONFIG_MACF
133 #include <security/mac_framework.h>
134 #include <security/mac_mach_internal.h>
135 #endif
136
137 #include <vm/vm_map.h>
138 #include <vm/vm_protos.h>
139 #include <vm/vm_shared_region.h>
140
141 #include <sys/shm_internal.h> /* for shmfork() */
142 #include <mach/task.h> /* for thread_create() */
143 #include <mach/thread_act.h> /* for thread_resume() */
144
145 #include <sys/sdt.h>
146
147 #if CONFIG_MEMORYSTATUS
148 #include <sys/kern_memorystatus.h>
149 #endif
150
151 /* XXX routines which should have Mach prototypes, but don't */
152 void thread_set_parent(thread_t parent, int pid);
153 extern void act_thread_catt(void *ctx);
154 void thread_set_child(thread_t child, int pid);
155 void *act_thread_csave(void);
156 extern boolean_t task_is_exec_copy(task_t);
157 int nextpidversion = 0;
158
159 void ipc_task_enable(task_t task);
160
161 proc_t forkproc(proc_t, cloneproc_flags_t);
162 void forkproc_free(proc_t);
163 thread_t fork_create_child(task_t parent_task,
164 coalition_t *parent_coalitions,
165 proc_t child,
166 int is_64bit_addr,
167 int is_64bit_data,
168 cloneproc_flags_t clone_flags);
169
170 __private_extern__ const size_t uthread_size = sizeof(struct uthread);
171 static LCK_GRP_DECLARE(rethrottle_lock_grp, "rethrottle");
172
173 os_refgrp_decl(, p_refgrp, "proc", NULL);
174
175 extern const size_t task_alignment;
176 const size_t proc_alignment = _Alignof(struct proc);
177
178 extern size_t task_struct_size;
179 size_t proc_struct_size = sizeof(struct proc);
180 size_t proc_and_task_size;
181
182 ZONE_DECLARE_ID(ZONE_ID_PROC_TASK, struct proc);
183 SECURITY_READ_ONLY_LATE(zone_t) proc_task_zone;
184
185 ZONE_DEFINE_ID(ZONE_ID_PROC_SIGACTS_RO, "sigacts_ro", struct sigacts_ro,
186 ZC_READONLY | ZC_ZFREE_CLEARMEM);
187
188 KALLOC_TYPE_DEFINE(proc_stats_zone, struct pstats, KT_DEFAULT);
189
190 /*
191 * fork1
192 *
193 * Description: common code used by all new process creation other than the
194 * bootstrap of the initial process on the system
195 *
196 * Parameters: parent_proc parent process of the process being
197 * child_threadp pointer to location to receive the
198 * Mach thread_t of the child process
199 * created
200 * kind kind of creation being requested
201 * coalitions if spawn, the set of coalitions the
202 * child process should join, or NULL to
203 * inherit the parent's. On non-spawns,
204 * this param is ignored and the child
205 * always inherits the parent's
206 * coalitions.
207 *
208 * Notes: Permissable values for 'kind':
209 *
210 * PROC_CREATE_FORK Create a complete process which will
211 * return actively running in both the
212 * parent and the child; the child copies
213 * the parent address space.
214 * PROC_CREATE_SPAWN Create a complete process which will
215 * return actively running in the parent
216 * only after returning actively running
217 * in the child; the child address space
218 * is newly created by an image activator,
219 * after which the child is run.
220 *
221 * At first it may seem strange that we return the child thread
222 * address rather than process structure, since the process is
223 * the only part guaranteed to be "new"; however, since we do
224 * not actualy adjust other references between Mach and BSD, this
225 * is the only method which guarantees us the ability to get
226 * back to the other information.
227 */
228 int
fork1(proc_t parent_proc,thread_t * child_threadp,int kind,coalition_t * coalitions)229 fork1(proc_t parent_proc, thread_t *child_threadp, int kind, coalition_t *coalitions)
230 {
231 proc_t child_proc = NULL; /* set in switch, but compiler... */
232 thread_t child_thread = NULL;
233 uid_t uid;
234 size_t count;
235 int err = 0;
236 int spawn = 0;
237 rlim_t rlimit_nproc_cur;
238
239 /*
240 * Although process entries are dynamically created, we still keep
241 * a global limit on the maximum number we will create. Don't allow
242 * a nonprivileged user to use the last process; don't let root
243 * exceed the limit. The variable nprocs is the current number of
244 * processes, maxproc is the limit.
245 */
246 uid = kauth_getruid();
247 proc_list_lock();
248 if ((nprocs >= maxproc - 1 && uid != 0) || nprocs >= maxproc) {
249 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
250 /*
251 * On the development kernel, panic so that the fact that we hit
252 * the process limit is obvious, as this may very well wedge the
253 * system.
254 */
255 panic("The process table is full; parent pid=%d", proc_getpid(parent_proc));
256 #endif
257 proc_list_unlock();
258 tablefull("proc");
259 return EAGAIN;
260 }
261 proc_list_unlock();
262
263 /*
264 * Increment the count of procs running with this uid. Don't allow
265 * a nonprivileged user to exceed their current limit, which is
266 * always less than what an rlim_t can hold.
267 * (locking protection is provided by list lock held in chgproccnt)
268 */
269 count = chgproccnt(uid, 1);
270 rlimit_nproc_cur = proc_limitgetcur(parent_proc, RLIMIT_NPROC);
271 if (uid != 0 &&
272 (rlim_t)count > rlimit_nproc_cur) {
273 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
274 /*
275 * On the development kernel, panic so that the fact that we hit
276 * the per user process limit is obvious. This may be less dire
277 * than hitting the global process limit, but we cannot rely on
278 * that.
279 */
280 panic("The per-user process limit has been hit; parent pid=%d, uid=%d", proc_getpid(parent_proc), uid);
281 #endif
282 err = EAGAIN;
283 goto bad;
284 }
285
286 #if CONFIG_MACF
287 /*
288 * Determine if MAC policies applied to the process will allow
289 * it to fork. This is an advisory-only check.
290 */
291 err = mac_proc_check_fork(parent_proc);
292 if (err != 0) {
293 goto bad;
294 }
295 #endif
296
297 switch (kind) {
298 case PROC_CREATE_SPAWN:
299 /*
300 * A spawned process differs from a forked process in that
301 * the spawned process does not carry around the parents
302 * baggage with regard to address space copying, dtrace,
303 * and so on.
304 */
305 spawn = 1;
306
307 OS_FALLTHROUGH;
308
309 case PROC_CREATE_FORK:
310 /*
311 * When we clone the parent process, we are going to inherit
312 * its task attributes and memory, since when we fork, we
313 * will, in effect, create a duplicate of it, with only minor
314 * differences. Contrarily, spawned processes do not inherit.
315 */
316 if ((child_thread = cloneproc(proc_task(parent_proc),
317 spawn ? coalitions : NULL,
318 parent_proc,
319 spawn ? CLONEPROC_FLAGS_NONE : CLONEPROC_FLAGS_INHERIT_MEMORY)) == NULL) {
320 /* Failed to create thread */
321 err = EAGAIN;
322 goto bad;
323 }
324
325 /* child_proc = child_thread->task->proc; */
326 child_proc = (proc_t)(get_bsdtask_info(get_threadtask(child_thread)));
327
328 if (!spawn) {
329 /* Copy current thread state into the child thread (only for fork) */
330 thread_dup(child_thread);
331 /*
332 * Also enable task ports for the new task for fork. In the spawn
333 * case, task ports enablement is delayed until after image activation
334 * since task map will be swapped during mach executable loading.
335 */
336 ipc_task_enable(get_threadtask(child_thread));
337 }
338
339 // XXX BEGIN: wants to move to be common code (and safe)
340 #if CONFIG_MACF
341 /*
342 * allow policies to associate the credential/label that
343 * we referenced from the parent ... with the child
344 * JMM - this really isn't safe, as we can drop that
345 * association without informing the policy in other
346 * situations (keep long enough to get policies changed)
347 */
348 mac_cred_label_associate_fork(proc_ucred(child_proc), child_proc);
349 #endif
350
351 /*
352 * Propogate change of PID - may get new cred if auditing.
353 */
354 set_security_token(child_proc);
355
356 AUDIT_ARG(pid, proc_getpid(child_proc));
357
358 // XXX END: wants to move to be common code (and safe)
359
360 /*
361 * Blow thread state information; this is what gives the child
362 * process its "return" value from a fork() call.
363 *
364 * Note: this should probably move to fork() proper, since it
365 * is not relevent to spawn, and the value won't matter
366 * until we resume the child there. If you are in here
367 * refactoring code, consider doing this at the same time.
368 */
369 thread_set_child(child_thread, proc_getpid(child_proc));
370
371 child_proc->p_acflag = AFORK; /* forked but not exec'ed */
372
373 #if CONFIG_DTRACE
374 dtrace_proc_fork(parent_proc, child_proc, spawn);
375 #endif /* CONFIG_DTRACE */
376 if (!spawn) {
377 /*
378 * Of note, we need to initialize the bank context behind
379 * the protection of the proc_trans lock to prevent a race with exit.
380 */
381 task_bank_init(get_threadtask(child_thread));
382 }
383
384 break;
385
386 default:
387 panic("fork1 called with unknown kind %d", kind);
388 break;
389 }
390
391
392 /* return the thread pointer to the caller */
393 *child_threadp = child_thread;
394
395 bad:
396 /*
397 * In the error case, we return a 0 value for the returned pid (but
398 * it is ignored in the trampoline due to the error return); this
399 * is probably not necessary.
400 */
401 if (err) {
402 (void)chgproccnt(uid, -1);
403 }
404
405 return err;
406 }
407
408
409
410
411 /*
412 * fork_create_child
413 *
414 * Description: Common operations associated with the creation of a child
415 * process. Return with new task and first thread's control port movable
416 * and not pinned.
417 *
418 * Parameters: parent_task parent task
419 * parent_coalitions parent's set of coalitions
420 * child_proc child process
421 * inherit_memory TRUE, if the parents address space is
422 * to be inherited by the child
423 * is_64bit_addr TRUE, if the child being created will
424 * be associated with a 64 bit address space
425 * is_64bit_data TRUE if the child being created will use a
426 * 64-bit register state
427 * in_exec TRUE, if called from execve or posix spawn set exec
428 * FALSE, if called from fork or vfexec
429 *
430 * Note: This code is called in the fork() case, from the execve() call
431 * graph, from the posix_spawn() call graph (which implicitly
432 * includes a vfork() equivalent call, and in the system
433 * bootstrap case.
434 *
435 * It creates a new task and thread (and as a side effect of the
436 * thread creation, a uthread) in the parent coalition set, which is
437 * then associated with the process 'child'. If the parent
438 * process address space is to be inherited, then a flag
439 * indicates that the newly created task should inherit this from
440 * the child task.
441 *
442 * As a special concession to bootstrapping the initial process
443 * in the system, it's possible for 'parent_task' to be TASK_NULL;
444 * in this case, 'inherit_memory' MUST be FALSE.
445 */
446 thread_t
fork_create_child(task_t parent_task,coalition_t * parent_coalitions,proc_t child_proc,int is_64bit_addr,int is_64bit_data,cloneproc_flags_t clone_flags)447 fork_create_child(task_t parent_task,
448 coalition_t *parent_coalitions,
449 proc_t child_proc,
450 int is_64bit_addr,
451 int is_64bit_data,
452 cloneproc_flags_t clone_flags)
453 {
454 thread_t child_thread = NULL;
455 task_t child_task;
456 kern_return_t result;
457 proc_ro_t proc_ro;
458 bool inherit_memory = !!(clone_flags & CLONEPROC_FLAGS_INHERIT_MEMORY);
459 bool in_exec = !!(clone_flags & CLONEPROC_FLAGS_FOR_EXEC);
460
461 proc_ro = proc_get_ro(child_proc);
462 if (proc_ro_task(proc_ro) != NULL) {
463 panic("Proc_ro_task for newly created proc %p is not NULL", child_proc);
464 }
465
466 child_task = proc_get_task_raw(child_proc);
467
468 /*
469 * Create a new task for the child process, IPC access to the new task will
470 * be set up after task has been fully initialized.
471 */
472 result = task_create_internal(parent_task,
473 proc_ro,
474 parent_coalitions,
475 inherit_memory,
476 is_64bit_addr,
477 is_64bit_data,
478 TF_NONE,
479 in_exec ? TPF_EXEC_COPY : TPF_NONE, /* Mark the task exec copy if in execve */
480 (TRW_LRETURNWAIT | TRW_LRETURNWAITER), /* All created threads will wait in task_wait_to_return */
481 child_task);
482 if (result != KERN_SUCCESS) {
483 printf("%s: task_create_internal failed. Code: %d\n",
484 __func__, result);
485 goto bad;
486 }
487
488 /* Set the child proc process to child task */
489 proc_set_task(child_proc, child_task);
490
491 /* Set child task process to child proc */
492 set_bsdtask_info(child_task, child_proc);
493
494 /* Propagate CPU limit timer from parent */
495 if (timerisset(&child_proc->p_rlim_cpu)) {
496 task_vtimer_set(child_task, TASK_VTIMER_RLIM);
497 }
498
499 /*
500 * Set child process BSD visible scheduler priority if nice value
501 * inherited from parent
502 */
503 if (child_proc->p_nice != 0) {
504 resetpriority(child_proc);
505 }
506
507 /*
508 * Create main thread for the child process. Its control port is not immovable/pinned
509 * until main_thread_set_immovable_pinned().
510 *
511 * The new thread is waiting on the event triggered by 'task_clear_return_wait'
512 */
513 result = main_thread_create_waiting(child_task,
514 (thread_continue_t)task_wait_to_return,
515 task_get_return_wait_event(child_task),
516 &child_thread);
517
518 if (result != KERN_SUCCESS) {
519 printf("%s: thread_create failed. Code: %d\n",
520 __func__, result);
521 task_deallocate(child_task);
522 child_task = NULL;
523 }
524
525 /*
526 * Tag thread as being the first thread in its task.
527 */
528 thread_set_tag(child_thread, THREAD_TAG_MAINTHREAD);
529
530 bad:
531 thread_yield_internal(1);
532
533 return child_thread;
534 }
535
536
537 /*
538 * fork
539 *
540 * Description: fork system call.
541 *
542 * Parameters: parent Parent process to fork
543 * uap (void) [unused]
544 * retval Return value
545 *
546 * Returns: 0 Success
547 * EAGAIN Resource unavailable, try again
548 *
549 * Notes: Attempts to create a new child process which inherits state
550 * from the parent process. If successful, the call returns
551 * having created an initially suspended child process with an
552 * extra Mach task and thread reference, for which the thread
553 * is initially suspended. Until we resume the child process,
554 * it is not yet running.
555 *
556 * The return information to the child is contained in the
557 * thread state structure of the new child, and does not
558 * become visible to the child through a normal return process,
559 * since it never made the call into the kernel itself in the
560 * first place.
561 *
562 * After resuming the thread, this function returns directly to
563 * the parent process which invoked the fork() system call.
564 *
565 * Important: The child thread_resume occurs before the parent returns;
566 * depending on scheduling latency, this means that it is not
567 * deterministic as to whether the parent or child is scheduled
568 * to run first. It is entirely possible that the child could
569 * run to completion prior to the parent running.
570 */
571 int
fork(proc_t parent_proc,__unused struct fork_args * uap,int32_t * retval)572 fork(proc_t parent_proc, __unused struct fork_args *uap, int32_t *retval)
573 {
574 thread_t child_thread;
575 int err;
576
577 retval[1] = 0; /* flag parent return for user space */
578
579 if ((err = fork1(parent_proc, &child_thread, PROC_CREATE_FORK, NULL)) == 0) {
580 task_t child_task;
581 proc_t child_proc;
582
583 /* Return to the parent */
584 child_proc = (proc_t)get_bsdthreadtask_info(child_thread);
585 retval[0] = proc_getpid(child_proc);
586
587 child_task = (task_t)get_threadtask(child_thread);
588 assert(child_task != TASK_NULL);
589
590 /* task_control_port_options has been inherited from parent, apply it */
591 task_set_immovable_pinned(child_task);
592 main_thread_set_immovable_pinned(child_thread);
593
594 /*
595 * Drop the signal lock on the child which was taken on our
596 * behalf by forkproc()/cloneproc() to prevent signals being
597 * received by the child in a partially constructed state.
598 */
599 proc_signalend(child_proc, 0);
600 proc_transend(child_proc, 0);
601
602 /* flag the fork has occurred */
603 proc_knote(parent_proc, NOTE_FORK | proc_getpid(child_proc));
604 DTRACE_PROC1(create, proc_t, child_proc);
605
606 #if CONFIG_DTRACE
607 if ((dtrace_proc_waitfor_hook = dtrace_proc_waitfor_exec_ptr) != NULL) {
608 (*dtrace_proc_waitfor_hook)(child_proc);
609 }
610 #endif
611
612 /* "Return" to the child */
613 task_clear_return_wait(get_threadtask(child_thread), TCRW_CLEAR_ALL_WAIT);
614
615 /* drop the extra references we got during the creation */
616 task_deallocate(child_task);
617 thread_deallocate(child_thread);
618 }
619
620 return err;
621 }
622
623
624 /*
625 * cloneproc
626 *
627 * Description: Create a new process from a specified process.
628 *
629 * Parameters: parent_task The parent task to be cloned, or
630 * TASK_NULL is task characteristics
631 * are not to be inherited
632 * be cloned, or TASK_NULL if the new
633 * task is not to inherit the VM
634 * characteristics of the parent
635 * parent_proc The parent process to be cloned
636 * clone_flags Clone flags to specify if the cloned
637 * process should inherit memory,
638 * marked as memory stat internal,
639 * or if the cloneproc is called for exec.
640 *
641 * Returns: !NULL pointer to new child thread
642 * NULL Failure (unspecified)
643 *
644 * Note: On return newly created child process has signal lock held
645 * to block delivery of signal to it if called with lock set.
646 * fork() code needs to explicity remove this lock before
647 * signals can be delivered
648 *
649 * In the case of bootstrap, this function can be called from
650 * bsd_utaskbootstrap() in order to bootstrap the first process;
651 * the net effect is to provide a uthread structure for the
652 * kernel process associated with the kernel task.
653 *
654 * XXX: Tristating using the value parent_task as the major key
655 * and inherit_memory as the minor key is something we should
656 * refactor later; we owe the current semantics, ultimately,
657 * to the semantics of task_create_internal. For now, we will
658 * live with this being somewhat awkward.
659 */
660 thread_t
cloneproc(task_t parent_task,coalition_t * parent_coalitions,proc_t parent_proc,cloneproc_flags_t clone_flags)661 cloneproc(task_t parent_task, coalition_t *parent_coalitions, proc_t parent_proc, cloneproc_flags_t clone_flags)
662 {
663 #if !CONFIG_MEMORYSTATUS
664 #pragma unused(memstat_internal)
665 #endif
666 task_t child_task;
667 proc_t child_proc;
668 thread_t child_thread = NULL;
669 bool memstat_internal = !!(clone_flags & CLONEPROC_FLAGS_MEMSTAT_INTERNAL);
670 bool in_exec = !!(clone_flags & CLONEPROC_FLAGS_FOR_EXEC);
671
672 if ((child_proc = forkproc(parent_proc, clone_flags)) == NULL) {
673 /* Failed to allocate new process */
674 goto bad;
675 }
676
677 /*
678 * In the case where the parent_task is TASK_NULL (during the init path)
679 * we make the assumption that the register size will be the same as the
680 * address space size since there's no way to determine the possible
681 * register size until an image is exec'd.
682 *
683 * The only architecture that has different address space and register sizes
684 * (arm64_32) isn't being used within kernel-space, so the above assumption
685 * always holds true for the init path.
686 */
687 const int parent_64bit_addr = parent_proc->p_flag & P_LP64;
688 const int parent_64bit_data = (parent_task == TASK_NULL) ? parent_64bit_addr : task_get_64bit_data(parent_task);
689
690 child_thread = fork_create_child(parent_task,
691 parent_coalitions,
692 child_proc,
693 parent_64bit_addr,
694 parent_64bit_data,
695 clone_flags);
696
697 if (child_thread == NULL) {
698 /*
699 * Failed to create thread; now we must deconstruct the new
700 * process previously obtained from forkproc().
701 */
702 forkproc_free(child_proc);
703 goto bad;
704 }
705
706 child_task = get_threadtask(child_thread);
707 if (parent_64bit_addr) {
708 OSBitOrAtomic(P_LP64, (UInt32 *)&child_proc->p_flag);
709 get_bsdthread_info(child_thread)->uu_flag |= UT_LP64;
710 } else {
711 OSBitAndAtomic(~((uint32_t)P_LP64), (UInt32 *)&child_proc->p_flag);
712 get_bsdthread_info(child_thread)->uu_flag &= ~UT_LP64;
713 }
714
715 #if CONFIG_MEMORYSTATUS
716 if (memstat_internal ||
717 (in_exec && (parent_proc->p_memstat_state & P_MEMSTAT_INTERNAL))) {
718 proc_list_lock();
719 child_proc->p_memstat_state |= P_MEMSTAT_INTERNAL;
720 proc_list_unlock();
721 }
722 if (in_exec && parent_proc->p_memstat_relaunch_flags != P_MEMSTAT_RELAUNCH_UNKNOWN) {
723 memorystatus_relaunch_flags_update(child_proc, parent_proc->p_memstat_relaunch_flags);
724 }
725 #endif
726
727 /* make child visible */
728 pinsertchild(parent_proc, child_proc, in_exec);
729
730 /*
731 * Make child runnable, set start time.
732 */
733 child_proc->p_stat = SRUN;
734 bad:
735 return child_thread;
736 }
737
738 __abortlike
739 static void
panic_sigacts_backref_mismatch(struct sigacts * sa)740 panic_sigacts_backref_mismatch(struct sigacts *sa)
741 {
742 panic("sigacts_ro backref mismatch: sigacts=%p, ro=%p, backref=%p",
743 sa, sa->ps_ro, sa->ps_ro->ps_rw);
744 }
745
746 static struct sigacts_ro *
sigacts_ro(struct sigacts * sa)747 sigacts_ro(struct sigacts *sa)
748 {
749 struct sigacts_ro *ro = sa->ps_ro;
750
751 zone_require_ro(ZONE_ID_PROC_SIGACTS_RO, sizeof(struct sigacts_ro),
752 ro);
753
754 if (__improbable(ro->ps_rw != sa)) {
755 panic_sigacts_backref_mismatch(sa);
756 }
757
758 return ro;
759 }
760
761 void
proc_set_sigact(proc_t p,int sig,user_addr_t sigact)762 proc_set_sigact(proc_t p, int sig, user_addr_t sigact)
763 {
764 assert((sig > 0) && (sig < NSIG));
765
766 zalloc_ro_update_field(ZONE_ID_PROC_SIGACTS_RO, sigacts_ro(&p->p_sigacts),
767 ps_sigact[sig], &sigact);
768 }
769
770 void
proc_set_trampact(proc_t p,int sig,user_addr_t trampact)771 proc_set_trampact(proc_t p, int sig, user_addr_t trampact)
772 {
773 assert((sig > 0) && (sig < NSIG));
774
775 zalloc_ro_update_field(ZONE_ID_PROC_SIGACTS_RO, sigacts_ro(&p->p_sigacts),
776 ps_trampact[sig], &trampact);
777 }
778
779 void
proc_set_sigact_trampact(proc_t p,int sig,user_addr_t sigact,user_addr_t trampact)780 proc_set_sigact_trampact(proc_t p, int sig, user_addr_t sigact, user_addr_t trampact)
781 {
782 struct sigacts_ro *ps_ro = sigacts_ro(&p->p_sigacts);
783 struct sigacts_ro psro_local = *ps_ro;
784
785 assert((sig > 0) && (sig < NSIG));
786
787 psro_local.ps_sigact[sig] = sigact;
788 psro_local.ps_trampact[sig] = trampact;
789
790 zalloc_ro_update_elem(ZONE_ID_PROC_SIGACTS_RO, ps_ro, &psro_local);
791 }
792
793 void
proc_reset_sigact(proc_t p,sigset_t sigs)794 proc_reset_sigact(proc_t p, sigset_t sigs)
795 {
796 int nc;
797 user_addr_t sigacts[NSIG];
798 bool changed = false;
799 struct sigacts_ro *ro = sigacts_ro(&p->p_sigacts);
800
801 memcpy(sigacts, ro->ps_sigact, sizeof(sigacts));
802
803 while (sigs) {
804 nc = ffs((unsigned int)sigs);
805 if (sigacts[nc] != SIG_DFL) {
806 sigacts[nc] = SIG_DFL;
807 changed = true;
808 }
809 sigs &= ~sigmask(nc);
810 }
811
812 if (changed) {
813 zalloc_ro_update_field(ZONE_ID_PROC_SIGACTS_RO, ro, ps_sigact,
814 (user_addr_t const (*)[NSIG])sigacts);
815 }
816 }
817
818 void
proc_sigacts_copy(proc_t dst,proc_t src)819 proc_sigacts_copy(proc_t dst, proc_t src)
820 {
821 struct sigacts_ro ro_local;
822 struct sigacts_ro *ro;
823
824 if (src == NULL) {
825 assert(dst == kernproc);
826 bzero(&dst->p_sigacts, sizeof(struct sigacts));
827 bzero(&ro_local, sizeof(struct sigacts_ro));
828 } else {
829 dst->p_sigacts = src->p_sigacts;
830 ro_local = *sigacts_ro(&src->p_sigacts);
831 }
832
833 ro_local.ps_rw = &dst->p_sigacts;
834
835 ro = zalloc_ro(ZONE_ID_PROC_SIGACTS_RO, Z_WAITOK | Z_NOFAIL | Z_ZERO);
836 zalloc_ro_update_elem(ZONE_ID_PROC_SIGACTS_RO, ro, &ro_local);
837
838 dst->p_sigacts.ps_ro = ro;
839 }
840
841 /*
842 * Destroy a process structure that resulted from a call to forkproc(), but
843 * which must be returned to the system because of a subsequent failure
844 * preventing it from becoming active.
845 *
846 * Parameters: p The incomplete process from forkproc()
847 *
848 * Returns: (void)
849 *
850 * Note: This function should only be used in an error handler following
851 * a call to forkproc().
852 *
853 * Operations occur in reverse order of those in forkproc().
854 */
855 void
forkproc_free(proc_t p)856 forkproc_free(proc_t p)
857 {
858 struct pgrp *pg;
859
860 #if CONFIG_PERSONAS
861 persona_proc_drop(p);
862 #endif /* CONFIG_PERSONAS */
863
864 #if PSYNCH
865 pth_proc_hashdelete(p);
866 #endif /* PSYNCH */
867
868 /* We held signal and a transition locks; drop them */
869 proc_signalend(p, 0);
870 proc_transend(p, 0);
871
872 /*
873 * If we have our own copy of the resource limits structure, we
874 * need to free it. If it's a shared copy, we need to drop our
875 * reference on it.
876 */
877 proc_limitdrop(p);
878
879 #if SYSV_SHM
880 /* Need to drop references to the shared memory segment(s), if any */
881 if (p->vm_shm) {
882 /*
883 * Use shmexec(): we have no address space, so no mappings
884 *
885 * XXX Yes, the routine is badly named.
886 */
887 shmexec(p);
888 }
889 #endif
890
891 /* Need to undo the effects of the fdt_fork(), if any */
892 fdt_invalidate(p);
893 fdt_destroy(p);
894
895 /*
896 * Drop the reference on a text vnode pointer, if any
897 * XXX This code is broken in forkproc(); see <rdar://4256419>;
898 * XXX if anyone ever uses this field, we will be extremely unhappy.
899 */
900 if (p->p_textvp) {
901 vnode_rele(p->p_textvp);
902 p->p_textvp = NULL;
903 }
904
905 /* Update the audit session proc count */
906 AUDIT_SESSION_PROCEXIT(p);
907
908 lck_mtx_destroy(&p->p_mlock, &proc_mlock_grp);
909 lck_mtx_destroy(&p->p_ucred_mlock, &proc_ucred_mlock_grp);
910 #if CONFIG_DTRACE
911 lck_mtx_destroy(&p->p_dtrace_sprlock, &proc_lck_grp);
912 #endif
913 lck_spin_destroy(&p->p_slock, &proc_slock_grp);
914
915 /* Release the credential reference */
916 proc_set_ucred(p, NOCRED);
917
918 proc_list_lock();
919 /* Decrement the count of processes in the system */
920 nprocs--;
921
922 /* quit the group */
923 pg = pgrp_leave_locked(p);
924
925 /* Take it out of process hash */
926 assert((os_ref_get_raw_mask(&p->p_refcount) >> P_REF_BITS) == 1);
927 assert((os_ref_get_raw_mask(&p->p_refcount) & P_REF_NEW) == P_REF_NEW);
928 os_atomic_xor(&p->p_refcount, P_REF_NEW | P_REF_DEAD, relaxed);
929
930 /* Remove from hash if not a shadow proc */
931 if (!proc_is_shadow(p)) {
932 phash_remove_locked(proc_getpid(p), p);
933 }
934
935 proc_list_unlock();
936
937 pgrp_rele(pg);
938
939 thread_call_free(p->p_rcall);
940
941 /* Free allocated memory */
942 zfree_ro(ZONE_ID_PROC_SIGACTS_RO, p->p_sigacts.ps_ro);
943 zfree(proc_stats_zone, p->p_stats);
944 p->p_stats = NULL;
945 if (p->p_subsystem_root_path) {
946 zfree(ZV_NAMEI, p->p_subsystem_root_path);
947 }
948
949 p->p_proc_ro = proc_ro_release_proc(p->p_proc_ro);
950 if (p->p_proc_ro != NULL) {
951 proc_ro_free(p->p_proc_ro);
952 p->p_proc_ro = NULL;
953 }
954
955 proc_checkdeadrefs(p);
956 proc_wait_release(p);
957 }
958
959
960 /*
961 * forkproc
962 *
963 * Description: Create a new process structure, given a parent process
964 * structure.
965 *
966 * Parameters: parent_proc The parent process
967 *
968 * Returns: !NULL The new process structure
969 * NULL Error (insufficient free memory)
970 *
971 * Note: When successful, the newly created process structure is
972 * partially initialized; if a caller needs to deconstruct the
973 * returned structure, they must call forkproc_free() to do so.
974 */
975 proc_t
forkproc(proc_t parent_proc,cloneproc_flags_t clone_flags)976 forkproc(proc_t parent_proc, cloneproc_flags_t clone_flags)
977 {
978 static uint64_t nextuniqueid = 0;
979 static pid_t lastpid = 0;
980
981 proc_t child_proc; /* Our new process */
982 int error = 0;
983 struct pgrp *pg;
984 uthread_t parent_uthread = current_uthread();
985 rlim_t rlimit_cpu_cur;
986 pid_t pid;
987 struct proc_ro_data proc_ro_data = {};
988 bool in_exec = !!(clone_flags & CLONEPROC_FLAGS_FOR_EXEC);
989
990 child_proc = zalloc_flags(proc_task_zone, Z_WAITOK | Z_ZERO);
991
992 child_proc->p_stats = zalloc_flags(proc_stats_zone, Z_WAITOK | Z_ZERO);
993 proc_sigacts_copy(child_proc, parent_proc);
994 os_ref_init_mask(&child_proc->p_refcount, P_REF_BITS, &p_refgrp, P_REF_NEW);
995 os_ref_init_raw(&child_proc->p_waitref, &p_refgrp);
996 proc_ref_hold_proc_task_struct(child_proc);
997
998 /* allocate a callout for use by interval timers */
999 child_proc->p_rcall = thread_call_allocate((thread_call_func_t)realitexpire, child_proc);
1000
1001
1002 /*
1003 * Find an unused PID.
1004 */
1005
1006 fdt_init(child_proc);
1007
1008 proc_list_lock();
1009
1010 if (!in_exec) {
1011 pid = lastpid;
1012 do {
1013 /*
1014 * If the process ID prototype has wrapped around,
1015 * restart somewhat above 0, as the low-numbered procs
1016 * tend to include daemons that don't exit.
1017 */
1018 if (++pid >= PID_MAX) {
1019 pid = 100;
1020 }
1021 if (pid == lastpid) {
1022 panic("Unable to allocate a new pid");
1023 }
1024
1025 /* if the pid stays in hash both for zombie and runniing state */
1026 } while (phash_find_locked(pid) != PROC_NULL ||
1027 pghash_find_locked(pid) != PGRP_NULL ||
1028 session_find_locked(pid) != SESSION_NULL);
1029
1030 lastpid = pid;
1031 nprocs++;
1032
1033 child_proc->p_pid = pid;
1034 proc_ro_data.p_idversion = OSIncrementAtomic(&nextpidversion);
1035 /* kernel process is handcrafted and not from fork, so start from 1 */
1036 proc_ro_data.p_uniqueid = ++nextuniqueid;
1037
1038 /* Insert in the hash, and inherit our group (and session) */
1039 phash_insert_locked(pid, child_proc);
1040
1041 /* Check if the proc is from App Cryptex */
1042 if (parent_proc->p_ladvflag & P_RSR) {
1043 os_atomic_or(&child_proc->p_ladvflag, P_RSR, relaxed);
1044 }
1045 } else {
1046 /* For exec copy of the proc, copy the pid, pidversion and uniqueid of original proc */
1047 pid = parent_proc->p_pid;
1048 child_proc->p_pid = pid;
1049 proc_ro_data.p_idversion = parent_proc->p_proc_ro->p_idversion;
1050 proc_ro_data.p_uniqueid = parent_proc->p_proc_ro->p_uniqueid;
1051
1052 nprocs++;
1053 os_atomic_or(&child_proc->p_refcount, P_REF_SHADOW, relaxed);
1054 }
1055 pg = pgrp_enter_locked(parent_proc, child_proc);
1056 proc_list_unlock();
1057
1058 if (proc_ro_data.p_uniqueid == startup_serial_num_procs) {
1059 /*
1060 * Turn off startup serial logging now that we have reached
1061 * the defined number of startup processes.
1062 */
1063 startup_serial_logging_active = false;
1064 }
1065
1066 /*
1067 * We've identified the PID we are going to use;
1068 * initialize the new process structure.
1069 */
1070 child_proc->p_stat = SIDL;
1071
1072 /*
1073 * The zero'ing of the proc was at the allocation time due to need
1074 * for insertion to hash. Copy the section that is to be copied
1075 * directly from the parent.
1076 */
1077 child_proc->p_forkcopy = parent_proc->p_forkcopy;
1078
1079 proc_ro_data.syscall_filter_mask = proc_syscall_filter_mask(parent_proc);
1080 proc_ro_data.p_platform_data = proc_get_ro(parent_proc)->p_platform_data;
1081
1082 /*
1083 * Some flags are inherited from the parent.
1084 * Duplicate sub-structures as needed.
1085 * Increase reference counts on shared objects.
1086 * The p_stats substruct is set in vm_fork.
1087 */
1088 #if CONFIG_DELAY_IDLE_SLEEP
1089 child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_DELAYIDLESLEEP | P_SUGID | P_AFFINITY));
1090 #else /* CONFIG_DELAY_IDLE_SLEEP */
1091 child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_SUGID | P_AFFINITY));
1092 #endif /* CONFIG_DELAY_IDLE_SLEEP */
1093
1094 child_proc->p_vfs_iopolicy = (parent_proc->p_vfs_iopolicy & (P_VFS_IOPOLICY_VALID_MASK));
1095
1096 child_proc->p_responsible_pid = parent_proc->p_responsible_pid;
1097
1098 /*
1099 * Note that if the current thread has an assumed identity, this
1100 * credential will be granted to the new process.
1101 */
1102 kauth_cred_set(&proc_ro_data.p_ucred, kauth_cred_get());
1103
1104 lck_mtx_init(&child_proc->p_mlock, &proc_mlock_grp, &proc_lck_attr);
1105 lck_mtx_init(&child_proc->p_ucred_mlock, &proc_ucred_mlock_grp, &proc_lck_attr);
1106 #if CONFIG_DTRACE
1107 lck_mtx_init(&child_proc->p_dtrace_sprlock, &proc_lck_grp, &proc_lck_attr);
1108 #endif
1109 lck_spin_init(&child_proc->p_slock, &proc_slock_grp, &proc_lck_attr);
1110
1111 klist_init(&child_proc->p_klist);
1112
1113 if (child_proc->p_textvp != NULLVP) {
1114 /* bump references to the text vnode */
1115 /* Need to hold iocount across the ref call */
1116 if ((error = vnode_getwithref(child_proc->p_textvp)) == 0) {
1117 error = vnode_ref(child_proc->p_textvp);
1118 vnode_put(child_proc->p_textvp);
1119 }
1120
1121 if (error != 0) {
1122 child_proc->p_textvp = NULLVP;
1123 }
1124 }
1125
1126 /* Inherit the parent flags for code sign */
1127 proc_ro_data.p_csflags = ((uint32_t)proc_getcsflags(parent_proc) & ~CS_KILLED);
1128
1129 child_proc->p_proc_ro = proc_ro_alloc(child_proc, &proc_ro_data, NULL, NULL);
1130
1131 /* update cred on proc */
1132 proc_update_creds_onproc(child_proc);
1133
1134 /* update audit session proc count */
1135 AUDIT_SESSION_PROCNEW(child_proc);
1136
1137 /*
1138 * Copy the parents per process open file table to the child; if
1139 * there is a per-thread current working directory, set the childs
1140 * per-process current working directory to that instead of the
1141 * parents.
1142 */
1143 if (fdt_fork(&child_proc->p_fd, parent_proc, parent_uthread->uu_cdir, in_exec) != 0) {
1144 forkproc_free(child_proc);
1145 child_proc = NULL;
1146 goto bad;
1147 }
1148
1149 #if SYSV_SHM
1150 if (parent_proc->vm_shm && !in_exec) {
1151 /* XXX may fail to attach shm to child */
1152 (void)shmfork(parent_proc, child_proc);
1153 }
1154 #endif
1155
1156 /*
1157 * Child inherits the parent's plimit
1158 */
1159 proc_limitfork(parent_proc, child_proc);
1160
1161 rlimit_cpu_cur = proc_limitgetcur(child_proc, RLIMIT_CPU);
1162 if (rlimit_cpu_cur != RLIM_INFINITY) {
1163 child_proc->p_rlim_cpu.tv_sec = (rlimit_cpu_cur > __INT_MAX__) ? __INT_MAX__ : rlimit_cpu_cur;
1164 }
1165
1166 if (in_exec) {
1167 /* Keep the original start time for exec'ed proc */
1168 child_proc->p_stats->ps_start = parent_proc->p_stats->ps_start;
1169 child_proc->p_start.tv_sec = parent_proc->p_start.tv_sec;
1170 child_proc->p_start.tv_usec = parent_proc->p_start.tv_usec;
1171 } else {
1172 /* Intialize new process stats, including start time */
1173 /* <rdar://6640543> non-zeroed portion contains garbage AFAICT */
1174 microtime_with_abstime(&child_proc->p_start, &child_proc->p_stats->ps_start);
1175 }
1176
1177 if (pg->pg_session->s_ttyvp != NULL && parent_proc->p_flag & P_CONTROLT) {
1178 os_atomic_or(&child_proc->p_flag, P_CONTROLT, relaxed);
1179 }
1180
1181 /*
1182 * block all signals to reach the process.
1183 * no transition race should be occuring with the child yet,
1184 * but indicate that the process is in (the creation) transition.
1185 */
1186 proc_signalstart(child_proc, 0);
1187 proc_transstart(child_proc, 0, 0);
1188
1189 child_proc->p_pcaction = 0;
1190
1191 TAILQ_INIT(&child_proc->p_uthlist);
1192 TAILQ_INIT(&child_proc->p_aio_activeq);
1193 TAILQ_INIT(&child_proc->p_aio_doneq);
1194
1195 /*
1196 * Copy work queue information
1197 *
1198 * Note: This should probably only happen in the case where we are
1199 * creating a child that is a copy of the parent; since this
1200 * routine is called in the non-duplication case of vfork()
1201 * or posix_spawn(), then this information should likely not
1202 * be duplicated.
1203 *
1204 * <rdar://6640553> Work queue pointers that no longer point to code
1205 */
1206 child_proc->p_wqthread = parent_proc->p_wqthread;
1207 child_proc->p_threadstart = parent_proc->p_threadstart;
1208 child_proc->p_pthsize = parent_proc->p_pthsize;
1209 if ((parent_proc->p_lflag & P_LREGISTER) != 0) {
1210 child_proc->p_lflag |= P_LREGISTER;
1211 }
1212 child_proc->p_dispatchqueue_offset = parent_proc->p_dispatchqueue_offset;
1213 child_proc->p_dispatchqueue_serialno_offset = parent_proc->p_dispatchqueue_serialno_offset;
1214 child_proc->p_dispatchqueue_label_offset = parent_proc->p_dispatchqueue_label_offset;
1215 child_proc->p_return_to_kernel_offset = parent_proc->p_return_to_kernel_offset;
1216 child_proc->p_mach_thread_self_offset = parent_proc->p_mach_thread_self_offset;
1217 child_proc->p_pth_tsd_offset = parent_proc->p_pth_tsd_offset;
1218 child_proc->p_pthread_wq_quantum_offset = parent_proc->p_pthread_wq_quantum_offset;
1219 #if PSYNCH
1220 pth_proc_hashinit(child_proc);
1221 #endif /* PSYNCH */
1222
1223 #if CONFIG_PERSONAS
1224 child_proc->p_persona = NULL;
1225 error = persona_proc_inherit(child_proc, parent_proc);
1226 if (error != 0) {
1227 printf("forkproc: persona_proc_inherit failed (persona %d being destroyed?)\n", persona_id_from_proc(parent_proc));
1228 forkproc_free(child_proc);
1229 child_proc = NULL;
1230 goto bad;
1231 }
1232 #endif
1233
1234 #if CONFIG_MEMORYSTATUS
1235 /* Memorystatus init */
1236 child_proc->p_memstat_state = 0;
1237 child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_DEFAULT;
1238 child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_DEFAULT;
1239 child_proc->p_memstat_assertionpriority = 0;
1240 child_proc->p_memstat_userdata = 0;
1241 child_proc->p_memstat_idle_start = 0;
1242 child_proc->p_memstat_idle_delta = 0;
1243 child_proc->p_memstat_memlimit = 0;
1244 child_proc->p_memstat_memlimit_active = 0;
1245 child_proc->p_memstat_memlimit_inactive = 0;
1246 child_proc->p_memstat_relaunch_flags = P_MEMSTAT_RELAUNCH_UNKNOWN;
1247 #if CONFIG_FREEZE
1248 child_proc->p_memstat_freeze_sharedanon_pages = 0;
1249 #endif
1250 child_proc->p_memstat_dirty = 0;
1251 child_proc->p_memstat_idledeadline = 0;
1252 #endif /* CONFIG_MEMORYSTATUS */
1253
1254 if (parent_proc->p_subsystem_root_path) {
1255 size_t parent_length = strlen(parent_proc->p_subsystem_root_path) + 1;
1256 assert(parent_length <= MAXPATHLEN);
1257 child_proc->p_subsystem_root_path = zalloc_flags(ZV_NAMEI,
1258 Z_WAITOK | Z_ZERO);
1259 memcpy(child_proc->p_subsystem_root_path, parent_proc->p_subsystem_root_path, parent_length);
1260 }
1261
1262 bad:
1263 return child_proc;
1264 }
1265
1266 void
proc_lock(proc_t p)1267 proc_lock(proc_t p)
1268 {
1269 LCK_MTX_ASSERT(&proc_list_mlock, LCK_MTX_ASSERT_NOTOWNED);
1270 lck_mtx_lock(&p->p_mlock);
1271 }
1272
1273 void
proc_unlock(proc_t p)1274 proc_unlock(proc_t p)
1275 {
1276 lck_mtx_unlock(&p->p_mlock);
1277 }
1278
1279 void
proc_spinlock(proc_t p)1280 proc_spinlock(proc_t p)
1281 {
1282 lck_spin_lock_grp(&p->p_slock, &proc_slock_grp);
1283 }
1284
1285 void
proc_spinunlock(proc_t p)1286 proc_spinunlock(proc_t p)
1287 {
1288 lck_spin_unlock(&p->p_slock);
1289 }
1290
1291 void
proc_list_lock(void)1292 proc_list_lock(void)
1293 {
1294 lck_mtx_lock(&proc_list_mlock);
1295 }
1296
1297 void
proc_list_unlock(void)1298 proc_list_unlock(void)
1299 {
1300 lck_mtx_unlock(&proc_list_mlock);
1301 }
1302
1303 void
proc_ucred_lock(proc_t p)1304 proc_ucred_lock(proc_t p)
1305 {
1306 lck_mtx_lock(&p->p_ucred_mlock);
1307 }
1308
1309 void
proc_ucred_unlock(proc_t p)1310 proc_ucred_unlock(proc_t p)
1311 {
1312 lck_mtx_unlock(&p->p_ucred_mlock);
1313 }
1314
1315 void
proc_update_creds_onproc(proc_t p)1316 proc_update_creds_onproc(proc_t p)
1317 {
1318 kauth_cred_t cred = proc_ucred(p);
1319
1320 p->p_uid = kauth_cred_getuid(cred);
1321 p->p_gid = kauth_cred_getgid(cred);
1322 p->p_ruid = kauth_cred_getruid(cred);
1323 p->p_rgid = kauth_cred_getrgid(cred);
1324 p->p_svuid = kauth_cred_getsvuid(cred);
1325 p->p_svgid = kauth_cred_getsvgid(cred);
1326 }
1327
1328
1329 bool
uthread_is64bit(struct uthread * uth)1330 uthread_is64bit(struct uthread *uth)
1331 {
1332 return uth->uu_flag & UT_LP64;
1333 }
1334
1335 void
uthread_init(task_t task,uthread_t uth,thread_ro_t tro_tpl,int workq_thread)1336 uthread_init(task_t task, uthread_t uth, thread_ro_t tro_tpl, int workq_thread)
1337 {
1338 uthread_t uth_parent = current_uthread();
1339
1340 lck_spin_init(&uth->uu_rethrottle_lock, &rethrottle_lock_grp,
1341 LCK_ATTR_NULL);
1342
1343 /*
1344 * Lazily set the thread on the kernel VFS context
1345 * to the first thread made which will be vm_pageout_scan_thread.
1346 */
1347 if (__improbable(vfs_context0.vc_thread == NULL)) {
1348 extern thread_t vm_pageout_scan_thread;
1349
1350 assert(task == kernel_task);
1351 assert(get_machthread(uth) == vm_pageout_scan_thread);
1352 vfs_context0.vc_thread = get_machthread(uth);
1353 }
1354
1355 if (task_get_64bit_addr(task)) {
1356 uth->uu_flag |= UT_LP64;
1357 }
1358
1359 /*
1360 * Thread inherits credential from the creating thread, if both
1361 * are in the same task.
1362 *
1363 * If the creating thread has no credential or is from another
1364 * task we can leave the new thread credential NULL. If it needs
1365 * one later, it will be lazily assigned from the task's process.
1366 */
1367 if (task == kernel_task) {
1368 kauth_cred_set(&tro_tpl->tro_cred, vfs_context0.vc_ucred);
1369 tro_tpl->tro_proc = kernproc;
1370 tro_tpl->tro_proc_ro = kernproc->p_proc_ro;
1371 } else if (!is_corpsetask(task)) {
1372 thread_ro_t curtro = current_thread_ro();
1373 proc_t p = get_bsdtask_info(task);
1374
1375 if (task == curtro->tro_task &&
1376 ((curtro->tro_flags & TRO_SETUID) == 0 || !workq_thread)) {
1377 kauth_cred_set(&tro_tpl->tro_cred, curtro->tro_cred);
1378 tro_tpl->tro_flags = (curtro->tro_flags & TRO_SETUID);
1379 tro_tpl->tro_proc_ro = curtro->tro_proc_ro;
1380 } else {
1381 kauth_cred_t cred = kauth_cred_proc_ref(p);
1382 kauth_cred_set_and_unref(&tro_tpl->tro_cred, &cred);
1383 tro_tpl->tro_proc_ro = task_get_ro(task);
1384 }
1385 tro_tpl->tro_proc = p;
1386
1387 proc_lock(p);
1388 if (workq_thread) {
1389 /* workq_thread threads will not inherit masks */
1390 uth->uu_sigmask = ~workq_threadmask;
1391 } else if (uth_parent->uu_flag & UT_SAS_OLDMASK) {
1392 uth->uu_sigmask = uth_parent->uu_oldmask;
1393 } else {
1394 uth->uu_sigmask = uth_parent->uu_sigmask;
1395 }
1396
1397 TAILQ_INSERT_TAIL(&p->p_uthlist, uth, uu_list);
1398 proc_unlock(p);
1399
1400 #if CONFIG_DTRACE
1401 if (p->p_dtrace_ptss_pages != NULL) {
1402 uth->t_dtrace_scratch = dtrace_ptss_claim_entry(p);
1403 }
1404 #endif
1405 } else {
1406 tro_tpl->tro_proc_ro = task_get_ro(task);
1407 }
1408
1409 uth->uu_pending_sigreturn = 0;
1410 uthread_init_proc_refcount(uth);
1411 }
1412
1413 mach_port_name_t
uthread_joiner_port(struct uthread * uth)1414 uthread_joiner_port(struct uthread *uth)
1415 {
1416 return uth->uu_save.uus_bsdthread_terminate.kport;
1417 }
1418
1419 user_addr_t
uthread_joiner_address(uthread_t uth)1420 uthread_joiner_address(uthread_t uth)
1421 {
1422 return uth->uu_save.uus_bsdthread_terminate.ulock_addr;
1423 }
1424
1425 void
uthread_joiner_wake(task_t task,uthread_t uth)1426 uthread_joiner_wake(task_t task, uthread_t uth)
1427 {
1428 struct _bsdthread_terminate bts = uth->uu_save.uus_bsdthread_terminate;
1429
1430 assert(bts.ulock_addr);
1431 bzero(&uth->uu_save.uus_bsdthread_terminate, sizeof(bts));
1432
1433 int flags = UL_UNFAIR_LOCK | ULF_WAKE_ALL | ULF_WAKE_ALLOW_NON_OWNER;
1434 (void)ulock_wake(task, flags, bts.ulock_addr, 0);
1435 mach_port_deallocate(get_task_ipcspace(task), bts.kport);
1436 }
1437
1438 /*
1439 * This routine frees the thread name field of the uthread_t structure. Split out of
1440 * uthread_cleanup() so thread name does not get deallocated while generating a corpse fork.
1441 */
1442 void
uthread_cleanup_name(uthread_t uth)1443 uthread_cleanup_name(uthread_t uth)
1444 {
1445 /*
1446 * <rdar://17834538>
1447 * Set pth_name to NULL before calling free().
1448 * Previously there was a race condition in the
1449 * case this code was executing during a stackshot
1450 * where the stackshot could try and copy pth_name
1451 * after it had been freed and before if was marked
1452 * as null.
1453 */
1454 if (uth->pth_name != NULL) {
1455 void *pth_name = uth->pth_name;
1456 uth->pth_name = NULL;
1457 kfree_data(pth_name, MAXTHREADNAMESIZE);
1458 }
1459 return;
1460 }
1461
1462 /*
1463 * This routine frees all the BSD context in uthread except the credential.
1464 * It does not free the uthread structure as well
1465 */
1466 void
uthread_cleanup(uthread_t uth,thread_ro_t tro)1467 uthread_cleanup(uthread_t uth, thread_ro_t tro)
1468 {
1469 task_t task = tro->tro_task;
1470 proc_t p = tro->tro_proc;
1471
1472 uthread_assert_zero_proc_refcount(uth);
1473
1474 if (uth->uu_lowpri_window || uth->uu_throttle_info) {
1475 /*
1476 * task is marked as a low priority I/O type
1477 * and we've somehow managed to not dismiss the throttle
1478 * through the normal exit paths back to user space...
1479 * no need to throttle this thread since its going away
1480 * but we do need to update our bookeeping w/r to throttled threads
1481 *
1482 * Calling this routine will clean up any throttle info reference
1483 * still inuse by the thread.
1484 */
1485 throttle_lowpri_io(0);
1486 }
1487
1488 #if CONFIG_AUDIT
1489 /*
1490 * Per-thread audit state should never last beyond system
1491 * call return. Since we don't audit the thread creation/
1492 * removal, the thread state pointer should never be
1493 * non-NULL when we get here.
1494 */
1495 assert(uth->uu_ar == NULL);
1496 #endif
1497
1498 if (uth->uu_select.nbytes) {
1499 select_cleanup_uthread(&uth->uu_select);
1500 }
1501
1502 if (uth->uu_cdir) {
1503 vnode_rele(uth->uu_cdir);
1504 uth->uu_cdir = NULLVP;
1505 }
1506
1507 if (uth->uu_selset) {
1508 select_set_free(uth->uu_selset);
1509 uth->uu_selset = NULL;
1510 }
1511
1512 os_reason_free(uth->uu_exit_reason);
1513
1514 if ((task != kernel_task) && p) {
1515 /*
1516 * Remove the thread from the process list and
1517 * transfer [appropriate] pending signals to the process.
1518 * Do not remove the uthread from proc uthlist for exec
1519 * copy task, since they does not have a ref on proc and
1520 * would not have been added to the list.
1521 */
1522 if (uth->uu_kqr_bound) {
1523 kqueue_threadreq_unbind(p, uth->uu_kqr_bound);
1524 }
1525
1526 if (get_bsdtask_info(task) == p) {
1527 proc_lock(p);
1528 TAILQ_REMOVE(&p->p_uthlist, uth, uu_list);
1529 p->p_siglist |= (uth->uu_siglist & execmask & (~p->p_sigignore | sigcantmask));
1530 proc_unlock(p);
1531 }
1532
1533 #if CONFIG_DTRACE
1534 struct dtrace_ptss_page_entry *tmpptr = uth->t_dtrace_scratch;
1535 uth->t_dtrace_scratch = NULL;
1536 if (tmpptr != NULL) {
1537 dtrace_ptss_release_entry(p, tmpptr);
1538 }
1539 #endif
1540 } else {
1541 assert(!uth->uu_kqr_bound);
1542 }
1543 }
1544
1545 /* This routine releases the credential stored in uthread */
1546 void
uthread_cred_ref(struct ucred * ucred)1547 uthread_cred_ref(struct ucred *ucred)
1548 {
1549 kauth_cred_ref(ucred);
1550 }
1551
1552 void
uthread_cred_free(struct ucred * ucred)1553 uthread_cred_free(struct ucred *ucred)
1554 {
1555 kauth_cred_set(&ucred, NOCRED);
1556 }
1557
1558 /* This routine frees the uthread structure held in thread structure */
1559 void
uthread_destroy(uthread_t uth)1560 uthread_destroy(uthread_t uth)
1561 {
1562 uthread_destroy_proc_refcount(uth);
1563
1564 if (uth->t_tombstone) {
1565 kfree_type(struct doc_tombstone, uth->t_tombstone);
1566 uth->t_tombstone = NULL;
1567 }
1568
1569 #if CONFIG_DEBUG_SYSCALL_REJECTION
1570 size_t const bitstr_len = BITMAP_SIZE(mach_trap_count + nsysent);
1571
1572 if (uth->syscall_rejection_mask) {
1573 kfree_data(uth->syscall_rejection_mask, bitstr_len);
1574 uth->syscall_rejection_mask = NULL;
1575 }
1576
1577 if (uth->syscall_rejection_once_mask) {
1578 kfree_data(uth->syscall_rejection_once_mask, bitstr_len);
1579 uth->syscall_rejection_once_mask = NULL;
1580 }
1581 #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
1582
1583 lck_spin_destroy(&uth->uu_rethrottle_lock, &rethrottle_lock_grp);
1584
1585 uthread_cleanup_name(uth);
1586 }
1587
1588 user_addr_t
thread_get_sigreturn_token(thread_t thread)1589 thread_get_sigreturn_token(thread_t thread)
1590 {
1591 uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1592 return ut->uu_sigreturn_token;
1593 }
1594
1595 uint32_t
thread_get_sigreturn_diversifier(thread_t thread)1596 thread_get_sigreturn_diversifier(thread_t thread)
1597 {
1598 uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1599 return ut->uu_sigreturn_diversifier;
1600 }
1601