Commit Graph

1416 Commits

Author SHA1 Message Date
William Hubbs
02b064a591 src/swclock: make the reference file a required argument 2022-12-08 09:56:50 -06:00
Mike Gilbert
1364e6631c start-stop-daemon: use a pipe to sync parent/child processes
This fixes #557.
2022-12-07 17:12:24 -06:00
Sam James
0525de4f18 librc-depend: fix -Wmismatched-dealloc
Despite this being a 'deptree', it's actually
xmalloc'd in the same function (rc_deptree_update),
and so should be free'd, not rc_deptree_free'd,
as rc_deptree_load* wasn't used to allocate it.

```
[71/213] Compiling C object src/librc/librc.so.1.p/librc-depend.c.o
../src/librc/librc-depend.c: In function ‘rc_deptree_update’:
../src/librc/librc-depend.c:1077:9: warning: ‘rc_deptree_free’ called on pointer returned from a mismatched allocation function [-Wmismatched-dealloc]
 1077 |         rc_deptree_free(deptree);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../src/shared/misc.h:29,
                 from ../src/librc/librc.h:57,
                 from ../src/librc/librc-depend.c:21:
In function ‘xmalloc’,
    inlined from ‘rc_deptree_update’ at ../src/librc/librc-depend.c:775:12:
../src/shared/helpers.h:64:23: note: returned from ‘malloc’
   64 |         void *value = malloc(size);
      |                       ^~~~~~~~~~~~
```

This fixes #563.
2022-12-07 11:35:16 -06:00
Matt Whitlock
112b69860f start-stop-daemon, supervise-daemon: set autogroup nicelevel
As described in "Why nice levels are a placebo and have been for a very
long time, and no one seems to have noticed"[1], the Linux kernel in its
default configuration on many Linux distributions autogroups tasks by
session ID and "fairly" allocates CPU time among such autogroups. The
nice levels of tasks within each autogroup are only relative to
other tasks within the same autogroup. Effectively, this means that the
traditional nice level is rendered moot for tools like start-stop-daemon
and supervise-daemon, which start each daemon in its own session and
thus in its own autogroup. Linux does provide a means to change the
niceness of autogroups relative to each other, so let's have start-stop-
daemon and supervise-daemon make use of this feature where available so
that -N,--nicelevel/SSD_NICELEVEL will actually do what the user
intends. On systems where autogroups are not supported or are disabled,
this commit introduces no change in behavior.

Note that the setsid() call in the child process of start-stop-daemon is
moved to much earlier. This is necessary so that the new process will be
assigned to a new autogroup before the autogroup nicelevel is set. To
avoid inadvertently acquiring /dev/tty as the controlling terminal of
the new session after setsid() has given up the controlling terminal
inherited from the parent process, tty_fd is opened before the call to
setsid().

[1] https://www.reddit.com/r/linux/comments/d7hx2c/why_nice_levels_are_a_placebo_and_have_been_for_a/
This fixes #542.
2022-09-06 17:26:22 -05:00
William Hubbs
9b08de926b Revert "start-stop-daemon: use vfork to avoid races"
This is broken, so revert it and reopen #532.

This reverts commit 9e5ce59a21.
2022-09-02 17:27:39 -05:00
Arusekk
9e5ce59a21 start-stop-daemon: use vfork to avoid races
While running `rc-service start docker` on Gentoo,
I found that the command does not start the service 90% of the time,
with an enigmatic 'service crashed' message.

The root cause of this is apparently rc-service spawning a pty,
running start-stop-daemon inside that pty, and exitting,
before start-stop-daemon child process calls setsid(),
which results in the child process being killed with SIGHUP (SI_KERNEL).

Theoretically this bug was present ever since the file was created in
5af58b4514 ("Rewrite the core parts in C. We now provide...")
(or even before that), but it should have been only a minor issue before
45bd125dcc ("Use a pty for prefixed output instead of pipes for...").
Not sure why nobody has had the issue so far (it has been present for
almost 15 years).

As here setsid() is the last call before execve(), the most natural
locking mechanism is vfork(), as it gives back control to parent
process only after execve() or process termination.
So this way the bug can be fixed by adding a single letter. :-)

Another way to ensure this would be using an O_CLOEXEC file descriptor
or some custom lock, which would need to be released not before setsid().

Fixes: 5af58b4514 ("Rewrite the core parts in C. We now provide...")
Fixes #532.
2022-09-02 12:41:09 -05:00
xdavidwu
95dc83bfbc openrc: fix help messages
The two lines seem to both belong to --override, but made into seperate
array elements accidentally, making options after --override and their
help mismatch. This fixes it.
2022-07-21 03:53:42 -04:00
William Hubbs
5ffa1c7fd7 librc: fix resource leaks 2022-05-08 17:10:44 -05:00
Sam James
026472ce5e supervise-daemon: fix -Wshadow
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
e82baa17ca checkpath: fix memory leak
```
=================================================================
==22862==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x7f1fd5b12cb7 in __interceptor_malloc /usr/src/debug/sys-devel/gcc-11.2.1_p20220312/gcc-11-20220312/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55556abecea7 in xmalloc ../src/includes/helpers.h:64
    #2 0x55556abecea7 in xasprintf ../src/includes/helpers.h:149
    #3 0x55556abeb6fb in do_check ../src/rc/checkpath.c:206
    #4 0x55556abeb6fb in main ../src/rc/checkpath.c:443
    #5 0x7f1fd58576cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 4096 byte(s) leaked in 1 allocation(s).
```

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
adc1e33f7e checkpath: fix memory leak
```
Direct leak of 4 byte(s) in 1 object(s) allocated from:
    #0 0x7f49539534a7 in __interceptor_strdup /usr/src/debug/sys-devel/gcc-11.2.1_p20220312/gcc-11-20220312/libsanitizer/asan/asan_interceptors.cpp:454
    #1 0x55d76fa66867 in xstrdup ../src/includes/helpers.h:91
    #2 0x55d76fa66867 in get_dirfd ../src/rc/checkpath.c:111
    #3 0x55d76fa66867 in do_check ../src/rc/checkpath.c:206
    #4 0x55d76fa66867 in main ../src/rc/checkpath.c:442
    #5 0x7f49536f06cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
```

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
e7f45ce31f rc-update: style fixes
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
d0a2e30137 rc-update: fix mismatched alloc
Found by GCC 11's -fanalyzer.

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
17496f3c2b rc-status: fix mismatched alloc
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
c47b37ea68 shared/misc.c: free env_allow if returning early from env_filter
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
7b2e8f9efd librc: mark rc_deptree_* functions as mallocs
(This is analogous to the rc_stringlist change.)

This gives a hint to the compiler that allocations (return values)
from this function should be paired with a corresponding dealloc/free
function.

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
000a2c19b4 librc: mark stringlist functions as warn_unused_result
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
17de4e5dfd librc: mark stringlist functions as mallocs
This gives a hint to the compiler that allocations (return values)
from this function should be paired with a corresponding dealloc/free
function

In this case, it means that every rc_stringlist that rc_stringlist_new()
returns should eventually be freed by calling rc_stringlist_free(ptr)
where ptr is the relevant rc_stringlist.

We have to add a test for this into the build system
because only GCC supports this for now. In future, we might
be able to use meson's has_function_attribute (it does support
'malloc', just not AFAICT 'malloc with arguments').

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
1afcc37803 librc: fix potential use-after-free
Both 'pkg' and 'local' are referenced within list,
so we can't free them yet.

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
c4f8b1559c librc: fix double-free
'services' is still referenced by the list
which gets returned. We can't free it.

Thanks to GCC 11's -fanalyzer.

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
fbefd68b2d librc: fix mismatched allocs
Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Sam James
14835a2262 librc: fix memory leak in rc_services_in_runlevel_stacked
Seen on running rc-status.

```
=================================================================
==14636==ERROR: LeakSanitizer: detected memory leaks

Indirect leak of 72 byte(s) in 3 object(s) allocated from:
    #0 0x7f443412dcb7 in __interceptor_malloc /usr/src/debug/sys-devel/gcc-11.2.1_p20220312/gcc-11-20220312/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f443400c727 in xmalloc ../src/includes/helpers.h:64
    #2 0x7f443400d1f4 in rc_stringlist_add ../src/librc/librc-stringlist.c:32
    #3 0x7f4433fecc34 in get_runlevel_chain ../src/librc/librc.c:390
    #4 0x7f4433fedc00 in rc_runlevel_stacks ../src/librc/librc.c:519
    #5 0x7f4433ff1d8e in rc_services_in_runlevel_stacked ../src/librc/librc.c:976
    #6 0x55be0e8f9517 in main ../src/rc/rc-status.c:407
    #7 0x7f44334736cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
```

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-08 14:56:26 -05:00
Josh Soref
3054046e18 multiple spelling and typo fixes
This fixes #516.
2022-04-30 21:32:32 -05:00
William Hubbs
b5f713124b seedrng: initialize seed_dir 2022-04-20 20:49:47 -05:00
William Hubbs
c0f5586743 seedrng: more improvements
- drop initialization of some variables.
- use eerrorx where possible
- drop final cleanup instructions
2022-04-20 20:38:03 -05:00
Jason A. Donenfeld
9b16bfe0e7 seedrng: incorporate various improvements
There have been a number of subtle improvements and cleanups to seedrng,
including using openat and locking the directory fd instead of a
separate lock file. Also various stylistic cleanups.

This fixes #519.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-04-20 15:45:20 -05:00
William Hubbs
0b3f8750e7 openrc-shutdown: remove rc- prefix from file names 2022-04-09 22:54:03 -05:00
William Hubbs
82e5478d0e start-stop-daemon: remove rc-prefix from file names 2022-04-07 11:18:56 -05:00
William Hubbs
391d12db48 migrate fully to meson build system
- drop old build system
- move shared include and source files to common directory
- drop "rc-" prefix from shared include and source files
- move executable-specific code to individual directories under src
- adjust top-level .gitignore file for new build system

This closes #489.
2022-04-06 10:51:55 -05:00
Jason A. Donenfeld
586d1c9af3 seedrng: remove environment variables
Now that we have the command line arguments, there's no need for the
environment variables.

This fixes #511.
2022-03-30 22:25:19 -05:00
William Hubbs
df18158e60 seedrng.c: multiple cleanups
This fixes #508.
2022-03-30 13:59:32 -05:00
Jason A. Donenfeld
5e1f180f0b
seedrng: clean up fds and avoid -1 close on exit (#509)
This cleans up the exit path a little bit.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-03-29 16:21:28 -05:00
Jason A. Donenfeld
076c2552ae Use seedrng for seeding the random number generator
The RNG can't actually be seeded from a shell script, due to the
reliance on ioctls. For this reason, the seedrng project provides a
basic script meant to be copy and pasted into projects like OpenRC and
tweaked as needed: https://git.zx2c4.com/seedrng/about/

This commit imports it into OpenRC and wires up /etc/init.d/urandom to
call it. It shouldn't be called by other things on the system, so it
lives in rc_sbindir.

Closes #506.
Closes #507.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-03-26 19:16:27 -05:00
sad-goldfish
270e5c6828
Add Posix Scheduling Support to start-stop-daemon (#497) 2022-03-05 15:48:17 -05:00
Mike Frysinger
d796310456 switch 0x100 constants to enums
This should make the code easier to maintain without having to remember
what the exact 0x100 constant means.
2022-03-05 14:17:14 -05:00
Mike Frysinger
5400dcc509 switch 0x80 to 0x103 for long options
We use 0x100+ to avoid collisions in the 8 bit getopt interface, so
switch 0x80 to align with the other existing 0x100 options we have.
2022-03-05 14:08:02 -05:00
LinkTed
8115f3274e linux: Add support for No New Privs flag
This add No New Privs flag for start-stop-daemon and supervise-daemon
by adding --no-new-privs flag. As a result, the user set the No New
Privs flag for the program should run with.
see PR_SET_NO_NEW_PRIVS prctl(2)
2022-02-06 17:17:46 -05:00
LinkTed
79e5edc1a3 capabilities: Add support for securebits flags
This adds securebits flags for start-stop-daemon and supervise-daemon
by adding --secbits option. As a result, the user can specify
securebits the program should run with. see capabilities(7)
2022-02-06 17:17:46 -05:00
Matt Turner
e6d48ea141 rc-misc.c: Allocate memory for 'file'
This is a partial revert of commit 8e02406d ("rc-misc.c: remove
references to PATH_MAX"), which changed 'file' to a null pointer with no
associated storage.

../openrc-0.44.10/src/rc/rc-misc.c: In function ‘_rc_deptree_load’:
../openrc-0.44.10/src/rc/rc-misc.c:392:33: warning: ‘%s’ directive argument is null [-Wformat-overflow=]
392 |                                 eerror("Clock skew detected with `%s'", file);
    |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes: 8e02406d ("rc-misc.c: remove references to PATH_MAX")
Closes: #493
2022-01-26 20:18:23 -06:00
William Hubbs
0f8fe2a6cb define the pam directory at the top level 2021-12-31 11:01:55 -06:00
William Hubbs
5e9797035b fix libkvm dependency for *bsd 2021-12-30 18:45:39 -06:00
William Hubbs
fd70988587 remove separate pam directory 2021-12-29 19:04:06 -06:00
LinkTed
6e214b2616 capabilities: Add support for Linux capabilities(7)
This adds capabilities for start-stop-daemon by adding --capabilities
option. As a result, the user can specify the inheritable, ambient and
bounding set by define capabilities in the service script.

This fixes #314.
2021-12-23 17:29:10 -05:00
Matt Whitlock
fd1e4a384a add option for OOM score adjustment
This commit adds a new --oom-score-adj option to start-stop-daemon and
supervise-daemon, as well as an equivalent SSD_OOM_SCORE_ADJ environment
variable. If either of these are specified (with the command-line
option taking precedence), then the specified adjustment value is
written to /proc/self/oom_score_adj after forking but prior to exec'ing
the daemon (at the time when nice and ionice are applied).

Additionally, per a suggestion by Mike Frysinger, the suggested values
for the SSD_NICELEVEL, SSD_IONICELEVEL, and SSD_OOM_SCORE_ADJ variables
in the example config file are now given as zeros, which are the
kernel's default values of these process knobs for the init process at
boot. Note that uncommenting any of these zero-valued suggestions will
cause SSD/SD to set the corresponding process knob affirmatively to
zero, whereas leaving the variable unset (and the equivalent command-
line option unspecified) means SSD/SD will not change the corresponding
process knob from its inherited value.

See: https://github.com/OpenRC/openrc/pull/435#discussion_r688310672
This fixes #435.
2021-12-22 10:01:14 -06:00
Matt Whitlock
dd5a6fa60f start-stop-daemon: fix typo in error message 2021-12-21 10:26:29 -06:00
Mike Frysinger
8b247dd5d8 broadcast: fix compiler warnings
Newer gcc reports:
broadcast.c: In function 'broadcast':
broadcast.c:132:15: warning: variable 'tp' might be clobbered by 'longjmp' or 'vfork' [-Wclobbered]
  132 |         FILE *tp;

Move the storage off the stack to avoid.  This makes the function
not safe for multithread use, but we don't do that anywhere, so
who cares!
2021-12-21 01:48:31 -05:00
Matt Whitlock
8ffc4162e2 code style: remove space after unary "not" operator
There are no semantic changes in this commit.

Suggested-by: Mike Frysinger <vapier@gentoo.org>
See: https://github.com/OpenRC/openrc/pull/435#pullrequestreview-727035394
2021-12-21 01:48:04 -05:00
Mike Frysinger
301161a7a4 use HEAD in git URIs to point to the default branch
This makes the URIs shorter and dynamic: whatever the default branch
the repo uses will be used.
2021-12-20 20:07:00 -05:00
Mike Frysinger
04d8234844 drop unused copyright variables
The existing copyright notices in the file headers cover these vars.
2021-12-20 20:04:59 -05:00
Mike Frysinger
d017d5af9c change getopt definition to elide pointer storage
Make this a const pointer to the storage directly instead of a pointer
variable that points to the storage.  Makes the code slightly smaller.
2021-12-20 20:03:35 -05:00