rewrite popen to use posix_spawn instead of fragile vfork hacks

diff --git a/src/stdio/popen.c b/src/stdio/popen.c
index ed20f5a1f017c4415303940e435ce61b9caff7b1..28ff23fd1614422bdbeb907529b08c7ec5c6b413 100644 (file)
--- a/src/stdio/popen.c
+++ b/src/stdio/popen.c
@@ -2,28 +2,23 @@
 #include <unistd.h>
 #include <errno.h>
 #include <string.h>
+#include <spawn.h>
 #include "stdio_impl.h"
-#include "pthread_impl.h"
 #include "syscall.h"
 
-static void dummy_0()
-{
-}
-weak_alias(dummy_0, __acquire_ptc);
-weak_alias(dummy_0, __release_ptc);
-
-pid_t __vfork(void);
+extern char **__environ;
 
 FILE *popen(const char *cmd, const char *mode)
 {
-       int p[2], op, i;
+       int p[2], op, e;
        pid_t pid;
        FILE *f;
-       sigset_t old;
-       const char *modes = "rw", *mi = strchr(modes, *mode);
+       posix_spawn_file_actions_t fa;
 
-       if (mi) {
-               op = mi-modes;
+       if (*mode == 'r') {
+               op = 0;
+       } else if (*mode == 'w') {
+               op = 1;
        } else {
                errno = EINVAL;
                return 0;
@@ -36,38 +31,43 @@ FILE *popen(const char *cmd, const char *mode)
                __syscall(SYS_close, p[1]);
                return NULL;
        }
+       FLOCK(f);
 
-       sigprocmask(SIG_BLOCK, SIGALL_SET, &old);
-       
-       __acquire_ptc();
-       pid = __vfork();
-
-       if (pid) {
-               __release_ptc();
-               __syscall(SYS_close, p[1-op]);
-               sigprocmask(SIG_SETMASK, &old, 0);
-               if (pid < 0) {
-                       fclose(f);
-                       return 0;
+       /* If the child's end of the pipe happens to already be on the final
+        * fd number to which it will be assigned (either 0 or 1), it must
+        * be moved to a different fd. Otherwise, there is no safe way to
+        * remove the close-on-exec flag in the child without also creating
+        * a file descriptor leak race condition in the parent. */
+       if (p[1-op] == 1-op) {
+               int tmp = fcntl(F_DUPFD_CLOEXEC, 1-op, 0);
+               if (tmp < 0) {
+                       e = errno;
+                       goto fail;
                }
-               f->pipe_pid = pid;
-               return f;
+               __syscall(SYS_close, p[1-op]);
+               p[1-op] = tmp;
        }
 
-       /* See notes in system.c for why this is needed. */
-       for (i=1; i<=8*__SYSCALL_SSLEN; i++) {
-               struct sigaction sa;
-               __libc_sigaction(i, 0, &sa);
-               if (sa.sa_handler!=SIG_IGN && sa.sa_handler!=SIG_DFL) {
-                       sa.sa_handler = SIG_DFL;
-                       __libc_sigaction(i, &sa, 0);
+       e = ENOMEM;
+       if (!posix_spawn_file_actions_init(&fa)) {
+               if (!posix_spawn_file_actions_adddup2(&fa, p[1-op], 1-op)) {
+                       if (!(e = posix_spawn(&pid, "/bin/sh", &fa, 0,
+                           (char *[]){ "sh", "-c", (char *)cmd, 0 }, __environ))) {
+                               posix_spawn_file_actions_destroy(&fa);
+                               f->pipe_pid = pid;
+                               if (!strchr(mode, 'e'))
+                                       fcntl(p[op], F_SETFD, 0);
+                               __syscall(SYS_close, p[1-op]);
+                               FUNLOCK(f);
+                               return f;
+                       }
                }
+               posix_spawn_file_actions_destroy(&fa);
        }
-       if (dup2(p[1-op], 1-op) < 0) _exit(127);
-       fcntl(1-op, F_SETFD, 0);
-       if (p[0] != 1-op) __syscall(SYS_close, p[0]);
-       if (p[1] != 1-op) __syscall(SYS_close, p[1]);
-       sigprocmask(SIG_SETMASK, &old, 0);
-       execl("/bin/sh", "sh", "-c", cmd, (char *)0);
-       _exit(127);
+fail:
+       fclose(f);
+       __syscall(SYS_close, p[1-op]);
+
+       errno = e;
+       return 0;
 }