SPDX: Mass-update to GPL-2.0-or-later

[exim.git] / src / src / child.c

diff --git a/src/src/child.c b/src/src/child.c
index 1c48a4e4c845792bbb95ce595500d701502406ef..359b791e82b9549f42f28e63eeb28b2dd9fd7a2b 100644 (file)
--- a/src/src/child.c
+++ b/src/src/child.c
@@ -1,11 +1,11 @@
-/* $Cambridge: exim/src/src/child.c,v 1.1 2004/10/07 10:39:01 ph10 Exp $ */
-

 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) University of Cambridge 1995 - 2004 */
+/* Copyright (c) The Exim Maintainers 2020 - 2022 */
+/* Copyright (c) University of Cambridge 1995 - 2015 */

 /* See the file NOTICE for conditions of use and distribution. */
 /* See the file NOTICE for conditions of use and distribution. */

+/* SPDX-License-Identifier: GPL-2.0-or-later */

 
 
 #include "exim.h"
 
 
 #include "exim.h"


@@ -28,17 +28,17 @@ Arguments:
 Returns:       nothing
 */
 
 Returns:       nothing
 */
 

-static void
+void

 force_fd(int oldfd, int newfd)
 {
 if (oldfd == newfd) return;
 force_fd(int oldfd, int newfd)
 {
 if (oldfd == newfd) return;

-close(newfd);
-dup2(oldfd, newfd);
-close(oldfd);
+(void)close(newfd);
+(void)dup2(oldfd, newfd);
+(void)close(oldfd);

 }
 
 
 }
 
 

-
+#ifndef STAND_ALONE

 /*************************************************
 *   Build argv list and optionally re-exec Exim  *
 *************************************************/
 /*************************************************
 *   Build argv list and optionally re-exec Exim  *
 *************************************************/


@@ -74,24 +74,22 @@ child_exec_exim(int exec_type, BOOL kill_v, int *pcount, BOOL minimal,
 {
 int first_special = -1;
 int n = 0;
 {
 int first_special = -1;
 int n = 0;

-int extra = (pcount != NULL)? *pcount : 0;
-uschar **argv =
-  store_get((extra + acount + MAX_CLMACROS + 16) * sizeof(char *));
+int extra = pcount ? *pcount : 0;
+uschar **argv;
+
+argv = store_get((extra + acount + MAX_CLMACROS + 24) * sizeof(char *), GET_UNTAINTED);

 
 /* In all case, the list starts out with the path, any macros, and a changed
 config file. */
 
 
 /* In all case, the list starts out with the path, any macros, and a changed
 config file. */
 

-argv[n++] = exim_path;
+argv[n++] = exim_path;         /* assume untainted */

 if (clmacro_count > 0)
   {
   memcpy(argv + n, clmacros, clmacro_count * sizeof(uschar *));
   n += clmacro_count;
   }
 if (clmacro_count > 0)
   {
   memcpy(argv + n, clmacros, clmacro_count * sizeof(uschar *));
   n += clmacro_count;
   }

-if (config_changed)
-  {
-  argv[n++] = US"-C";
-  argv[n++] = config_main_filename;
-  }
+if (f.config_changed)
+  { argv[n++] = US"-C"; argv[n++] = config_main_filename; }

 
 /* These values are added only for non-minimal cases. If debug_selector is
 precisely D_v, we have to assume this was started by a non-admin user, and
 
 /* These values are added only for non-minimal cases. If debug_selector is
 precisely D_v, we have to assume this was started by a non-admin user, and


@@ -108,13 +106,35 @@ if (!minimal)
   else
     {
     if (debug_selector != 0)
   else
     {
     if (debug_selector != 0)

+      {

       argv[n++] = string_sprintf("-d=0x%x", debug_selector);
       argv[n++] = string_sprintf("-d=0x%x", debug_selector);

+      if (debug_fd > 2)
+       {
+       int flags = fcntl(debug_fd, F_GETFD);
+       if (flags != -1) (void)fcntl(debug_fd, F_SETFD, flags & ~FD_CLOEXEC);
+       close(2);
+       dup2(debug_fd, 2);
+       close(debug_fd);
+       }
+      }
+    }
+  if (debug_pretrigger_buf)
+    { argv[n++] = US"-dp"; argv[n++] = string_sprintf("0x%x", debug_pretrigger_bsize); }
+  if (dtrigger_selector != 0)
+    argv[n++] = string_sprintf("-dt=0x%x", dtrigger_selector);
+  DEBUG(D_any)
+    {
+    argv[n++] = US"-MCd";
+    argv[n++] = US process_purpose;

     }
     }

-  if (dont_deliver) argv[n++] = US"-N";
-  if (queue_smtp) argv[n++] = US"-odqs";
-  if (synchronous_delivery) argv[n++] = US"-odi";
+  if (!f.testsuite_delays)     argv[n++] = US"-odd";
+  if (f.dont_deliver)          argv[n++] = US"-N";
+  if (f.queue_smtp)            argv[n++] = US"-odqs";
+  if (f.synchronous_delivery)  argv[n++] = US"-odi";

   if (connection_max_messages >= 0)
     argv[n++] = string_sprintf("-oB%d", connection_max_messages);
   if (connection_max_messages >= 0)
     argv[n++] = string_sprintf("-oB%d", connection_max_messages);

+  if (*queue_name)
+    { argv[n++] = US"-MCG"; argv[n++] = queue_name; }

   }
 
 /* Now add in any others that are in the call. Remember which they were,
   }
 
 /* Now add in any others that are in the call. Remember which they were,


@@ -135,7 +155,7 @@ if (acount > 0)
 argv[n] = NULL;
 if (exec_type == CEE_RETURN_ARGV)
   {
 argv[n] = NULL;
 if (exec_type == CEE_RETURN_ARGV)
   {

-  if (pcount != NULL) *pcount = n;
+  if (pcount) *pcount = n;

   return argv;
   }
 
   return argv;
   }
 


@@ -143,12 +163,12 @@ if (exec_type == CEE_RETURN_ARGV)
 failure. We know that there will always be at least one extra option in the
 call when exec() is done here, so it can be used to add to the panic data. */
 
 failure. We know that there will always be at least one extra option in the
 call when exec() is done here, so it can be used to add to the panic data. */
 

-DEBUG(D_exec) debug_print_argv(argv);
+DEBUG(D_exec) debug_print_argv(CUSS argv);

 exim_nullstd();                            /* Make sure std{in,out,err} exist */
 execv(CS argv[0], (char *const *)argv);
 
 log_write(0,
 exim_nullstd();                            /* Make sure std{in,out,err} exist */
 execv(CS argv[0], (char *const *)argv);
 
 log_write(0,

-  LOG_MAIN | ((exec_type == CEE_EXEC_EXIT)? LOG_PANIC : LOG_PANIC_DIE),
+  LOG_MAIN | (exec_type == CEE_EXEC_EXIT ? LOG_PANIC : LOG_PANIC_DIE),

   "re-exec of exim (%s) with %s failed: %s", exim_path, argv[first_special],
   strerror(errno));
 
   "re-exec of exim (%s) with %s failed: %s", exim_path, argv[first_special],
   strerror(errno));
 


@@ -174,12 +194,39 @@ the new process, and returns that to the caller via fdptr. The function returns
 the pid of the new process, or -1 if things go wrong. If debug_fd is
 non-negative, it is passed as stderr.
 
 the pid of the new process, or -1 if things go wrong. If debug_fd is
 non-negative, it is passed as stderr.
 

+This interface is now a just wrapper for the more complicated function
+child_open_exim2(), which has additional arguments. The wrapper must continue
+to exist, even if all calls from within Exim are changed, because it is
+documented for use from local_scan().
+

 Argument: fdptr   pointer to int for the stdin fd
 Argument: fdptr   pointer to int for the stdin fd

+         purpose of the child process, for debug

 Returns:          pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t
 Returns:          pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t

-child_open_exim(int *fdptr)
+child_open_exim_function(int * fdptr, const uschar * purpose)
+{
+return child_open_exim2_function(fdptr, US"<>", bounce_sender_authentication,
+  purpose);
+}
+
+
+/* This is a more complicated function for creating a child Exim process, with
+more arguments.
+
+Arguments:
+  fdptr                   pointer to int for the stdin fd
+  sender                  for a sender address (data for -f)
+  sender_authentication   authenticated sender address or NULL
+  purpose                of the child process, for debug
+
+Returns:          pid of the created process or -1 if anything has gone wrong
+*/
+
+pid_t
+child_open_exim2_function(int * fdptr, uschar * sender,
+  uschar * sender_authentication, const uschar * purpose)

 {
 int pfd[2];
 int save_errno;
 {
 int pfd[2];
 int save_errno;


@@ -192,32 +239,52 @@ on the wait. */
 
 if (pipe(pfd) != 0) return (pid_t)(-1);
 oldsignal = signal(SIGCHLD, SIG_DFL);
 
 if (pipe(pfd) != 0) return (pid_t)(-1);
 oldsignal = signal(SIGCHLD, SIG_DFL);

-pid = fork();
+pid = exim_fork(purpose);

 
 /* Child process: make the reading end of the pipe into the standard input and
 close the writing end. If debugging, pass debug_fd as stderr. Then re-exec
 
 /* Child process: make the reading end of the pipe into the standard input and
 close the writing end. If debugging, pass debug_fd as stderr. Then re-exec

-Exim. Failure is signalled with EX_EXECFAILED, but this shouldn't occur! */
+Exim with appropriate options. In the test harness, use -odi unless queue_only
+is set, so that the bounce is fully delivered before returning. Failure is
+signalled with EX_EXECFAILED (specified by CEE_EXEC_EXIT), but this shouldn't
+occur. */

 
 if (pid == 0)
   {
   force_fd(pfd[pipe_read], 0);
 
 if (pid == 0)
   {
   force_fd(pfd[pipe_read], 0);

-  close(pfd[pipe_write]);
+  (void)close(pfd[pipe_write]);

   if (debug_fd > 0) force_fd(debug_fd, 2);
   if (debug_fd > 0) force_fd(debug_fd, 2);

-  if (bounce_sender_authentication != NULL)
-    child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 8,
-      US"-t", US"-oem", US"-oi", US"-f", US"<>", US"-oMas",
-      bounce_sender_authentication, message_id_option);
-  else
-    child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 6,
-      US"-t", US"-oem", US"-oi", US"-f", US"<>", message_id_option);
-  /* Control does not return here. */
+  if (f.running_in_test_harness && !queue_only)
+    {
+    if (sender_authentication)
+      child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 9,
+        US "-odi", US"-t", US"-oem", US"-oi", US"-f", sender, US"-oMas",
+        sender_authentication, message_id_option);
+    else
+      child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 7,
+        US "-odi", US"-t", US"-oem", US"-oi", US"-f", sender,
+        message_id_option);
+    /* Control does not return here. */
+    }
+  else   /* Not test harness */
+    {
+    if (sender_authentication)
+      child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 8,
+        US"-t", US"-oem", US"-oi", US"-f", sender, US"-oMas",
+        sender_authentication, message_id_option);
+    else
+      child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 6,
+        US"-t", US"-oem", US"-oi", US"-f", sender, message_id_option);
+    /* Control does not return here. */
+    }

   }
 
   }
 

+testharness_pause_ms(100); /* let child work even longer, for exec */
+

 /* Parent process. Save fork() errno and close the reading end of the stdin
 pipe. */
 
 save_errno = errno;
 /* Parent process. Save fork() errno and close the reading end of the stdin
 pipe. */
 
 save_errno = errno;

-close(pfd[pipe_read]);
+(void)close(pfd[pipe_read]);

 
 /* Fork succeeded */
 
 
 /* Fork succeeded */
 


@@ -229,11 +296,11 @@ if (pid > 0)
 
 /* Fork failed */
 
 
 /* Fork failed */
 

-close(pfd[pipe_write]);
+(void)close(pfd[pipe_write]);

 errno = save_errno;
 return (pid_t)(-1);
 }
 errno = save_errno;
 return (pid_t)(-1);
 }

-
+#endif   /* STAND_ALONE */

 
 
 
 
 
 


@@ -247,7 +314,9 @@ them to the caller. The standard error is cloned to the output. If there are
 any file descriptors "in the way" in the new process, they are closed. A new
 umask is supplied for the process, and an optional new uid and gid are also
 available. These are used by the queryprogram router to set an unprivileged id.
 any file descriptors "in the way" in the new process, they are closed. A new
 umask is supplied for the process, and an optional new uid and gid are also
 available. These are used by the queryprogram router to set an unprivileged id.

-The function returns the pid of the new process, or -1 if things go wrong.
+SIGUSR1 is always disabled in the new process, as it is not going to be running
+Exim (the function child_open_exim() is provided for that). This function
+returns the pid of the new process, or -1 if things go wrong.

 
 Arguments:
   argv        the argv for exec in the new process
 
 Arguments:
   argv        the argv for exec in the new process


@@ -261,25 +330,34 @@ Arguments:
                 process is placed
   wd          if not NULL, a path to be handed to chdir() in the new process
   make_leader if TRUE, make the new process a process group leader
                 process is placed
   wd          if not NULL, a path to be handed to chdir() in the new process
   make_leader if TRUE, make the new process a process group leader

+  purpose     for debug: reason for running the task

 
 Returns:      the pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t
 
 Returns:      the pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t

-child_open_uid(uschar **argv, uschar **envp, int newumask, uid_t *newuid,
-  gid_t *newgid, int *infdptr, int *outfdptr, uschar *wd, BOOL make_leader)
+child_open_uid(const uschar **argv, const uschar **envp, int newumask,
+  uid_t *newuid, gid_t *newgid, int *infdptr, int *outfdptr, uschar *wd,
+  BOOL make_leader, const uschar * purpose)

 {
 int save_errno;
 int inpfd[2], outpfd[2];
 pid_t pid;
 
 {
 int save_errno;
 int inpfd[2], outpfd[2];
 pid_t pid;
 

+if (is_tainted(argv[0]))
+  {
+  log_write(0, LOG_MAIN | LOG_PANIC, "Attempt to exec tainted path: '%s'", argv[0]);
+  errno = EPERM;
+  return (pid_t)(-1);
+  }
+

 /* Create the pipes. */
 
 if (pipe(inpfd) != 0) return (pid_t)(-1);
 if (pipe(outpfd) != 0)
   {
 /* Create the pipes. */
 
 if (pipe(inpfd) != 0) return (pid_t)(-1);
 if (pipe(outpfd) != 0)
   {

-  close(inpfd[pipe_read]);
-  close(inpfd[pipe_write]);
+  (void)close(inpfd[pipe_read]);
+  (void)close(inpfd[pipe_write]);

   return (pid_t)(-1);
   }
 
   return (pid_t)(-1);
   }
 


@@ -288,50 +366,69 @@ that the child process can be waited for. We sometimes get here with it set
 otherwise. Save the old state for resetting on the wait. */
 
 oldsignal = signal(SIGCHLD, SIG_DFL);
 otherwise. Save the old state for resetting on the wait. */
 
 oldsignal = signal(SIGCHLD, SIG_DFL);

-pid = fork();
+pid = exim_fork(purpose);

 
 

-/* The child process becomes a process group leader if requested, and then
-organizes the pipes. Any unexpected failure is signalled with EX_EXECFAILED;
-these are all "should never occur" failures, except perhaps for exec failing
-because the command doesn't exist. */
+/* Handle the child process. First, set the required environment. We must do
+this before messing with the pipes, in order to be able to write debugging
+output when things go wrong. */

 
 if (pid == 0)
   {
 
 if (pid == 0)
   {

-  if (make_leader && setpgid(0,0) < 0) goto CHILD_FAILED;
+  signal(SIGUSR1, SIG_IGN);
+  signal(SIGPIPE, SIG_DFL);

 
 

-  close(inpfd[pipe_write]);
-  force_fd(inpfd[pipe_read], 0);
+  if (newgid && setgid(*newgid) < 0)
+    {
+    DEBUG(D_any) debug_printf("failed to set gid=%ld in subprocess: %s\n",
+      (long int)(*newgid), strerror(errno));
+    goto CHILD_FAILED;
+    }

 
 

-  close(outpfd[pipe_read]);
-  force_fd(outpfd[pipe_write], 1);
+  if (newuid && setuid(*newuid) < 0)
+    {
+    DEBUG(D_any) debug_printf("failed to set uid=%ld in subprocess: %s\n",
+      (long int)(*newuid), strerror(errno));
+    goto CHILD_FAILED;
+    }
+
+  (void)umask(newumask);

 
 

-  close(2);
-  dup2(1, 2);
+  if (wd && Uchdir(wd) < 0)
+    {
+    DEBUG(D_any) debug_printf("failed to chdir to %s: %s\n", wd,
+      strerror(errno));
+    goto CHILD_FAILED;
+    }

 
 

-  /* Set the required environment. If changing uid, ensure that
-  SIGUSR1 is ignored, as the process won't have the privilege to
-  write to the process log. */
+  /* Becomes a process group leader if requested, and then organize the pipes.
+  Any unexpected failure is signalled with EX_EXECFAILED; these are all "should
+  never occur" failures, except for exec failing because the command doesn't
+  exist. */

 
 

-  if (newgid != NULL && setgid(*newgid) < 0) goto CHILD_FAILED;
-  if (newuid != NULL)
+  if (make_leader && setpgid(0,0) < 0)

     {
     {

-    signal(SIGUSR1, SIG_IGN);
-    if (setuid(*newuid) < 0) goto CHILD_FAILED;
+    DEBUG(D_any) debug_printf("failed to set group leader in subprocess: %s\n",
+      strerror(errno));
+    goto CHILD_FAILED;

     }
     }

-  (void)umask(newumask);

 
 

-  /* Set the working directory if required */
+  (void)close(inpfd[pipe_write]);
+  force_fd(inpfd[pipe_read], 0);
+
+  (void)close(outpfd[pipe_read]);
+  force_fd(outpfd[pipe_write], 1);

 
 

-  if (wd != NULL && Uchdir(wd) < 0) goto CHILD_FAILED;
+  (void)close(2);
+  (void)dup2(1, 2);

 
   /* Now do the exec */
 
 
   /* Now do the exec */
 

-  if (envp == NULL) execv(CS argv[0], (char *const *)argv);
-    else execve(CS argv[0], (char *const *)argv, (char *const *)envp);
+  if (envp) execve(CS argv[0], (char *const *)argv, (char *const *)envp);
+  else execv(CS argv[0], (char *const *)argv);

 
   /* Failed to execv. Signal this failure using EX_EXECFAILED. We are
   losing the actual errno we got back, because there is no way to return
 
   /* Failed to execv. Signal this failure using EX_EXECFAILED. We are
   losing the actual errno we got back, because there is no way to return

-  this. */
+  this information. */

 
   CHILD_FAILED:
   _exit(EX_EXECFAILED);      /* Note: must be _exit(), NOT exit() */
 
   CHILD_FAILED:
   _exit(EX_EXECFAILED);      /* Note: must be _exit(), NOT exit() */


@@ -341,8 +438,8 @@ if (pid == 0)
 stdin pipe, and the writing end of the stdout pipe. */
 
 save_errno = errno;
 stdin pipe, and the writing end of the stdout pipe. */
 
 save_errno = errno;

-close(inpfd[pipe_read]);
-close(outpfd[pipe_write]);
+(void)close(inpfd[pipe_read]);
+(void)close(outpfd[pipe_write]);

 
 /* Fork succeeded; return the input/output pipes and the pid */
 
 
 /* Fork succeeded; return the input/output pipes and the pid */
 


@@ -355,8 +452,8 @@ if (pid > 0)
 
 /* Fork failed; reset fork errno before returning */
 
 
 /* Fork failed; reset fork errno before returning */
 

-close(inpfd[pipe_write]);
-close(outpfd[pipe_read]);
+(void)close(inpfd[pipe_write]);
+(void)close(outpfd[pipe_read]);

 errno = save_errno;
 return (pid_t)(-1);
 }
 errno = save_errno;
 return (pid_t)(-1);
 }


@@ -369,9 +466,9 @@ return (pid_t)(-1);
 *************************************************/
 
 /* This function is a wrapper for child_open_uid() that doesn't have the uid,
 *************************************************/
 
 /* This function is a wrapper for child_open_uid() that doesn't have the uid,

-gid, and working directory changing arguments. It is provided so as to have a
-clean interface for use from local_scan(), but also saves writing NULL
-arguments in other calls.
+gid and working directory changing arguments. The function is provided so as to
+have a clean interface for use from local_scan(), but also saves writing NULL
+arguments several calls that would otherwise use child_open_uid().

 
 Arguments:
   argv        the argv for exec in the new process
 
 Arguments:
   argv        the argv for exec in the new process


@@ -382,16 +479,17 @@ Arguments:
   outfdptr    pointer to int into which the fd of the stdout/stderr of the new
                 process is placed
   make_leader if TRUE, make the new process a process group leader
   outfdptr    pointer to int into which the fd of the stdout/stderr of the new
                 process is placed
   make_leader if TRUE, make the new process a process group leader

+  purpose     for debug: reason for running the task

 
 Returns:      the pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t
 
 Returns:      the pid of the created process or -1 if anything has gone wrong
 */
 
 pid_t

-child_open(uschar **argv, uschar **envp, int newumask, int *infdptr,
-  int *outfdptr, BOOL make_leader)
+child_open_function(uschar **argv, uschar **envp, int newumask, int *infdptr,
+  int *outfdptr, BOOL make_leader, const uschar * purpose)

 {
 {

-return child_open_uid(argv, envp, newumask, NULL, NULL, infdptr, outfdptr,
-  NULL, make_leader);
+return child_open_uid(CUSS argv, CUSS envp, newumask, NULL, NULL,
+  infdptr, outfdptr, NULL, make_leader, purpose);

 }
 
 
 }
 
 


@@ -424,7 +522,7 @@ int yield;
 if (timeout > 0)
   {
   sigalrm_seen = FALSE;
 if (timeout > 0)
   {
   sigalrm_seen = FALSE;

-  alarm(timeout);
+  ALARM(timeout);

   }
 
 for(;;)
   }
 
 for(;;)


@@ -434,18 +532,23 @@ for(;;)
   if (rc == pid)
     {
     int lowbyte = status & 255;
   if (rc == pid)
     {
     int lowbyte = status & 255;

-    if (lowbyte == 0) yield = (status >> 8) & 255;
-      else yield = -lowbyte;
+    yield = lowbyte == 0 ? (status >> 8) & 255 : -lowbyte;

     break;
     }
   if (rc < 0)
     {
     break;
     }
   if (rc < 0)
     {

-    yield = (errno == EINTR && sigalrm_seen)? -256 : -257;
+    /* This "shouldn't happen" test does happen on MacOS: for some reason
+    I do not understand we seems to get an alarm signal despite not having
+    an active alarm set. There seems to be only one, so just go round again. */
+
+    if (errno == EINTR && sigalrm_seen && timeout <= 0) continue;
+
+    yield = (errno == EINTR && sigalrm_seen) ? -256 : -257;

     break;
     }
   }
 
     break;
     }
   }
 

-if (timeout > 0) alarm(0);
+if (timeout > 0) ALARM_CLR(0);

 
 signal(SIGCHLD, oldsignal);   /* restore */
 return yield;
 
 signal(SIGCHLD, oldsignal);   /* restore */
 return yield;