2 * "Interpreter" that you can put in #! like this
3 * #!/usr/bin/prefork-interp [<options>] <interpreter>
6 * prefork-interp [<option> ..] <interpreter> [<script> [<args> ...]]
7 * prefork-interp [<option>,..],<interpreter> <script> [<args> ...]
8 * prefork-interp '[<option> ..] <interpreter>' <script> [<args> ...]
10 * Options must specify argument laundering mode.
11 * Currently the only mode supported is:
12 * -U unlaundered: setup and executor both get all arguments and env vars
13 * ident covers only env vars specified with -E
14 * ident covers only arguments interpreter and (if present) script
18 * client (C wrapper) connects to server
19 * (including reading ack byte)
21 * === acquires lock ===
22 * makes new listening socket
24 * forks watcher and awaits
25 * makes first-instance socketpair
26 * forks setup (script, sock fds indicated in env)
27 * fd0, fd1, fd2: from-outer
28 * other fd: call(client-end)(fake)
29 * reaps setup (and reports error)
30 * (implicitly releases lock)
32 * watcher fd[012]: watcher pipes
33 * starts watch on socket path
34 * sets stderr to line buffered
35 * sets stdin to nonblocking
36 * daemonises (one fork, becomes session leader)
37 * when socket stat changes, quit
39 * setup (pre-exec) fd0: null,
40 * fd[12]: fd2-from-outer
41 * env fds: listener, call(server-end)(fake),
42 * watcher read, watcher write
44 * possibly clean env, argv
46 * setup (script) runs initialisation parts of the script
47 * at prefork establishment point:
48 * setup (pm) [1] opens syslog
52 * server (pm) [1] [fd0: null],
53 * [fd[12]: fd2-from-outer]
55 * right away, forks init monitor
56 * [2] closes outer caller fds and call(fake)
57 * [server (pm)] fd[012]: null
58 * other fds: listener, syslog
59 * runs in loop accepting and forking,
60 * reaping and limiting children (incl init monitor)
61 * reports failures of monitors to syslog
63 * [client (C wrapper)] if client connect succeeds:
64 * now fd: call(client-end)
65 * sends message with: cmdline, env
68 * [server (script)] accepts, forks subseq monitor
70 * monitor [1] [fd0: null]
71 * (init [fd[12]: init: fd2-from-outer; subseq: null]
72 * or errors: init: fd2; subseq: syslog
73 * subseq) other fds: syslog, call(server-end)
75 * receives args, env, fds
78 * executor sorts out fds:
79 * fd0, fd1, fd2: from-outer
80 * close fds: call(server-end)
81 * retained fds: syslog
84 * runs main part of script
87 * [monitor] [fd[012]: null]
88 * [fd[12]: init: fd2-from-outer; subseq: null]
89 * [errors: init: fd2; subseq: syslog]
91 * reports status via socket
93 * [client (C wrapper)] [fd0, fd1, fd2: from-outer]
94 * [other fd: call(client-end)]
95 * receives status, exits appropriately
96 * (if was bad signal, reports to stderr, exits 127)
99 #include <arpa/inet.h>
105 const char our_name[] = "prefork-interp";
107 static struct sockaddr_un sockaddr_sun;
108 static FILE *call_sock;
110 #define ACK_BYTE '\n'
112 static const char *const *executor_argv;
114 static const char header_magic[4] = "PFI\n";
116 void fusagemessage(FILE *f) {
117 fprintf(f, "usage: #!/usr/bin/prefork-interp [<options>]\n");
120 static int laundering;
121 static struct stat initial_stab;
123 const struct cmdinfo cmdinfos[]= {
125 { 0, 'U', 0, .iassignto= &laundering, .arg= 'U' },
129 void ident_addinit(void) {
130 char ident_magic[1] = { 0 };
131 sha256_update(&identsc, sizeof(ident_magic), ident_magic);
134 static void propagate_exit_status(int status, const char *what) {
137 if (WIFEXITED(status)) {
141 if (WIFSIGNALED(status)) {
142 int sig = WTERMSIG(status);
143 const char *signame = strsignal(sig);
144 if (signame == 0) signame = "unknown signal";
146 if (! WCOREDUMP(status) &&
153 sa.sa_handler = SIG_DFL;
154 r = sigaction(sig, &sa, 0);
155 if (r) diee("failed to reset signal handler while propagating %s",
160 sigaddset(&sset, sig);
161 r = sigprocmask(SIG_UNBLOCK, &sset, 0);
162 if (r) diee("failed to reset signal block while propagating %s",
166 die("unexpectedly kept running after raising (to propagate) %s",
170 die("%s failed due to signal %d %s%s", what, sig, signame,
171 WCOREDUMP(status) ? " (core dumped)" : "");
174 die("%s failed with weird wait status %d 0x%x", what, status, status);
177 static __attribute((noreturn)) void die_data_overflow(void) {
178 die("cannot handle data with length >2^32");
181 static void prepare_data(size_t *len, char **buf,
182 const void *data, size_t dl) {
184 if (dl >= SIZE_MAX - *len)
189 memcpy(*buf, data, dl);
194 static void prepare_length(size_t *len, char **buf, size_t dl_sz) {
195 if (dl_sz > UINT32_MAX) die_data_overflow();
196 uint32_t dl = htonl(dl_sz);
197 prepare_data(len, buf, &dl, sizeof(dl));
200 static void prepare_string(size_t *len, char **buf, const char *s) {
201 size_t sl = strlen(s);
202 prepare_data(len, buf, s, sl+1);
205 static void prepare_message(size_t *len, char **buf) {
208 const char *const *p = (void*)environ;
211 prepare_string(len, buf, s);
214 prepare_string(len, buf, "");
218 prepare_string(len, buf, s);
221 static void send_fd(int payload_fd) {
222 int via_fd = fileno(call_sock);
225 struct cmsghdr align;
226 char buf[CMSG_SPACE(sizeof(payload_fd))];
236 iov.iov_base = &dummy_byte;
242 msg.msg_control = cmsg_buf.buf;
243 msg.msg_controllen = sizeof(cmsg_buf.buf);
245 struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
246 cmsg->cmsg_level = SOL_SOCKET;
247 cmsg->cmsg_type = SCM_RIGHTS;
248 cmsg->cmsg_len = CMSG_LEN(sizeof(payload_fd));
249 *(int*)CMSG_DATA(cmsg) = payload_fd;
251 msg.msg_controllen = sizeof(cmsg_buf.buf);
254 ssize_t r = sendmsg(via_fd, &msg, 0);
256 if (errno == EINTR) continue;
264 static void send_request(void) {
265 // Sending these first makes it easier for the script to
266 // use buffered IO for the message.
272 prepare_message(&len, 0);
274 char *m = xmalloc(len + 4);
276 prepare_length(0, &p, len);
277 prepare_message(0, &p);
278 assert(p == m + len + 4);
280 ssize_t sr = fwrite(p, len, 1, call_sock);
281 if (sr != 1) diee("write request (buffer)");
283 if (fflush(call_sock)) diee("write request");
286 static FILE *call_sock_from_fd(int fd) {
289 FILE *call_sock = fdopen(fd, "r+");
290 if (!call_sock) diee("fdopen socket");
292 r = setvbuf(call_sock, 0, _IONBF, 0);
293 if (r) die("setvbuf socket");
298 static bool was_eof(FILE *call_sock) {
299 return feof(call_sock) || errno==ECONNRESET;
303 static int protocol_read_maybe(void *data, size_t sz) {
305 size_t sr = fread(data, sz, 1, call_sock);
307 if (was_eof(call_sock)) return -1;
308 diee("read() on monitor call socket (%zd)", sz);
313 static void protocol_read(void *data, size_t sz) {
314 if (protocol_read_maybe(data, sz) < 0)
315 die("monitor process quit unexpectedly");
318 // Returns 0 if OK, error msg if peer was garbage.
319 static const char *read_greeting(void) {
320 char got_magic[sizeof(header_magic)];
322 if (protocol_read_maybe(&got_magic, sizeof(got_magic)) < 0)
323 return "initial monitor process quit";
325 if (memcmp(got_magic, header_magic, sizeof(header_magic)))
326 die("got unexpected protocol magic 0x%02x%02x%02x%02x",
327 got_magic[0], got_magic[1], got_magic[2], got_magic[3]);
330 protocol_read(&xdata_len, sizeof(xdata_len));
331 void *xdata = xmalloc(xdata_len);
332 protocol_read(xdata, xdata_len);
337 // Returns: call(client-end), or 0 to mean "is garbage"
338 // find_socket_path must have been called
339 static FILE *connect_existing(void) {
343 fd = socket(AF_UNIX, SOCK_STREAM, 0);
344 if (fd==-1) diee("socket() for client");
346 socklen_t salen = sizeof(sockaddr_sun);
347 r = connect(fd, (const struct sockaddr*)&sockaddr_sun, salen);
349 if (errno==ECONNREFUSED || errno==ENOENT) goto x_garbage;
350 diee("connect() %s", socket_path);
353 call_sock = call_sock_from_fd(fd);
362 if (call_sock) { fclose(call_sock); call_sock=0; }
363 if (fd >= 0) close(fd);
367 static void watcher_cb_stdin(uv_poll_t *handle, int status, int events) {
371 if ((errno = -status)) diee("watcher: poll stdin");
375 if (!(errno==EINTR || errno==EWOULDBLOCK || errno==EAGAIN))
376 diee("watcher: read sentinel stdin");
380 static void watcher_cb_sockpath(uv_fs_event_t *handle, const char *filename,
381 int events, int status) {
383 struct stat now_stab;
385 if ((errno = -status)) diee("watcher: poll stdin");
387 r= stat(socket_path, &now_stab);
389 if (errno==ENOENT) _exit(0);
390 if (errno==EINTR) continue;
391 diee("stat socket: %s", socket_path);
393 if (!(now_stab.st_dev == initial_stab.st_dev &&
394 now_stab.st_ino == initial_stab.st_ino))
399 // On entry, stderr is still inherited, but 0 and 1 are the pipes
400 static __attribute__((noreturn))
401 void become_watcher(void) {
403 uv_poll_t uvhandle_stdin;
404 uv_fs_event_t uvhandle_sockpath;
409 errno= -uv_loop_init(&loop);
410 if (errno) diee("watcher: uv_loop_init");
412 errno= -uv_poll_init(&loop, &uvhandle_stdin, 0);
413 if (errno) diee("watcher: uv_poll_init");
414 errno= -uv_poll_start(&uvhandle_stdin,
415 UV_READABLE | UV_WRITABLE | UV_DISCONNECT,
417 if (errno) diee("watcher: uv_poll_start");
419 errno= -uv_fs_event_init(&loop, &uvhandle_sockpath);
420 if (errno) diee("watcher: uv_fs_event_init");
422 errno= -uv_fs_event_start(&uvhandle_sockpath, watcher_cb_sockpath,
424 if (errno) diee("watcher: uv_fs_event_start");
426 // OK everything is set up, let us daemonise
427 if (dup2(1,2) != 2) diee("watcher: set daemonised stderr");
428 r= setvbuf(stderr, 0, _IOLBF, BUFSIZ);
429 if (r) diee("watcher: setvbuf stderr");
431 pid_t child = fork();
432 if (child == (pid_t)-1) diee("watcher: fork");
435 if (setsid() == (pid_t)-1) diee("watcher: setsid");
437 r= uv_run(&loop, UV_RUN_DEFAULT);
438 die("uv_run returned (%d)", r);
441 static __attribute__((noreturn))
442 void become_setup(int sfd, int fake_pair[2],
443 int watcher_stdin, int watcher_stderr) {
445 int call_fd = fake_pair[1];
447 int null_0 = open("/dev/null", O_RDONLY); if (null_0 < 0) diee("open null");
448 if (dup2(null_0, 0)) diee("dup2 /dev/null onto stdin");
449 if (dup2(2, 1) != 1) die("dup2 stderr onto stdout");
453 // Extension could work like this:
455 // We advertise a new protocol (perhaps one which is nearly entirely
456 // different after the connect) by putting a name for it comma-separated
457 // next to "v1". Simple extension can be done by having the script
458 // side say something about it in the ack xdata, which we currently ignore.
459 putenv(m_asprintf("PREFORK_INTERP=v1 %d,%d %s",
460 sfd, call_fd, socket_path, watcher_stdin, watcher_stderr));
462 execvp(executor_argv[0], (char**)executor_argv);
463 diee("execute %s", executor_argv[0]);
466 static void connect_or_spawn(void) {
469 call_sock = connect_existing();
470 if (call_sock) return;
472 int lockfd = acquire_lock();
473 call_sock = connect_existing();
474 if (call_sock) { close(lockfd); return; }
476 // We must start a fresh one, and we hold the lock
478 r = unlink(socket_path);
479 if (r<0 && errno!=ENOENT)
480 diee("failed to remove stale socket %s", socket_path);
482 int sfd = socket(AF_UNIX, SOCK_STREAM, 0);
483 if (sfd<0) diee("socket() for new listener");
485 socklen_t salen = sizeof(sockaddr_sun);
486 r= bind(sfd, (const struct sockaddr*)&sockaddr_sun, salen);
487 if (r<0) diee("bind() on new listener");
489 r= stat(socket_path, &initial_stab);
490 if (r<0) diee("stat() fresh socket");
492 // We never want callers to get ECONNREFUSED. But:
493 // There is a race here: from my RTFM they may get ECONNREFUSED
494 // if they try between our bind() and listen(). But if they do, they'll
495 // acquire the lock (serialising with us) and retry, and then it will work.
496 r = listen(sfd, INT_MAX);
497 if (r<0) diee("listen() for new listener");
501 int watcher_stdin[2];
502 int watcher_stderr[2];
503 if (pipe(watcher_stdin) || pipe(watcher_stderr))
504 diee("pipe() for socket inode watcher");
506 pid_t watcher = fork();
507 if (watcher == (pid_t)-1) diee("fork for watcher");
511 close(watcher_stdin[1]);
512 close(watcher_stderr[0]);
513 if (dup2(watcher_stdin[0], 0) != 0 ||
514 dup2(watcher_stderr[1], 1) != 0)
515 diee("initial dup2() for watcher");
516 close(watcher_stdin[0]);
517 close(watcher_stderr[1]);
521 close(watcher_stdin[0]);
522 close(watcher_stderr[1]);
523 nonblock(watcher_stderr[0]);
528 r = socketpair(AF_UNIX, SOCK_STREAM, 0, fake_pair);
529 if (r<0) diee("socketpair() for fake initial connection");
531 pid_t setup_pid = fork();
532 if (setup_pid == (pid_t)-1) diee("fork for spawn setup");
533 if (!setup_pid) become_setup(sfd, fake_pair,
534 watcher_stdin[1], watcher_stderr[0]);
538 call_sock = call_sock_from_fd(fake_pair[0]);
541 pid_t got = waitpid(setup_pid, &status, 0);
542 if (got == (pid_t)-1) diee("waitpid setup [%ld]", (long)setup_pid);
543 if (got != setup_pid) diee("waitpid setup [%ld] gave [%ld]!",
544 (long)setup_pid, (long)got);
545 if (status != 0) propagate_exit_status(status, "setup");
547 const char *emsg = read_greeting();
548 if (emsg) die("setup failed: %s", emsg);
554 static void make_executor_argv(const char *const *argv) {
555 switch (laundering) {
557 default: die("need -U (specifying unlaundered argument handling)");
561 #define EACH_NEW_ARG(EACH) { \
562 arg = interp; { EACH } \
563 if ((arg = script)) { EACH } \
564 const char *const *walk = argv; \
565 while ((arg = *walk++)) { EACH } \
569 EACH_NEW_ARG( (void)arg; count++; );
571 const char **out = calloc(count, sizeof(char*));
572 executor_argv = (const char* const*)out;
573 if (!executor_argv) diee("allocate for arguments");
575 EACH_NEW_ARG( *out++ = arg; );
579 int main(int argc_unused, const char *const *argv) {
586 // which ought to be passed on to the actual executor.
587 make_executor_argv(argv);
590 FILLZERO(sockaddr_sun);
591 sockaddr_sun.sun_family = AF_UNIX;
592 assert(strlen(socket_path) <= sizeof(sockaddr_sun.sun_path));
593 strncpy(sockaddr_sun.sun_path, socket_path, sizeof(sockaddr_sun.sun_path));
597 // We're committed now, send the request (or bail out)
601 protocol_read(&status, sizeof(status));
603 status = ntohl(status);
604 if (status > INT_MAX) die("status 0x%lx does not fit in an int",
605 (unsigned long)status);
607 propagate_exit_status(status, "invocation");