src/common/shm.c

   1 /*
   2  * Copyright (C) 2011 David Goulet <david.goulet@polymtl.ca>
   3  * Copyright (C) 2011 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   4  *
   5  * SPDX-License-Identifier: GPL-2.0-only
   6  *
   7  */
   8
   9 #define _LGPL_SOURCE
  10 #include <fcntl.h>
  11 #include <limits.h>
  12 #include <sys/mman.h>
  13 #include <sys/stat.h>
  14 #include <sys/types.h>
  15 #include <sys/wait.h>
  16 #include <unistd.h>
  17 #include <urcu.h>
  18
  19 #include <common/error.h>
  20
  21 #include "shm.h"
  22
  23 /*
  24  * Using fork to set umask in the child process (not multi-thread safe). We
  25  * deal with the shm_open vs ftruncate race (happening when the sessiond owns
  26  * the shm and does not let everybody modify it, to ensure safety against
  27  * shm_unlink) by simply letting the mmap fail and retrying after a few
  28  * seconds. For global shm, everybody has rw access to it until the sessiond
  29  * starts.
  30  */
  31 static int get_wait_shm(char *shm_path, size_t mmap_size, int global)
  32 {
  33         int wait_shm_fd, ret;
  34         mode_t mode;
  35
  36         assert(shm_path);
  37
  38         /* Default permissions */
  39         mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP;
  40
  41         /*
  42          * Change owner of the shm path.
  43          */
  44         if (global) {
  45                 /*
  46                  * If global session daemon, any application can
  47                  * register. Make it initially writeable so applications
  48                  * registering concurrently can do ftruncate() by
  49                  * themselves.
  50                  */
  51                 mode |= S_IROTH | S_IWOTH;
  52         }
  53
  54         /*
  55          * We're alone in a child process, so we can modify the process-wide
  56          * umask.
  57          */
  58         umask(~mode);
  59
  60         /*
  61          * Try creating shm (or get rw access). We don't do an exclusive open,
  62          * because we allow other processes to create+ftruncate it concurrently.
  63          *
  64          * A sysctl, fs.protected_regular may prevent the session daemon from
  65          * opening a previously created shm when the O_CREAT flag is provided.
  66          * Systemd enables this ABI-breaking change by default since v241.
  67          *
  68          * First, attempt to use the create-or-open semantic that is
  69          * desired here. If this fails with EACCES, work around this broken
  70          * behaviour and attempt to open the shm without the O_CREAT flag.
  71          *
  72          * The two attempts are made in this order since applications are
  73          * expected to race with the session daemon to create this shm.
  74          * Attempting an shm_open() without the O_CREAT flag first could fail
  75          * because the file doesn't exist. It could then be created by an
  76          * application, which would cause a second try with the O_CREAT flag to
  77          * fail with EACCES.
  78          *
  79          * Note that this introduces a new failure mode where a user could
  80          * launch an application (creating the shm) and unlink the shm while
  81          * the session daemon is launching, causing the second attempt
  82          * to fail. This is not recovered-from as unlinking the shm will
  83          * prevent userspace tracing from succeeding anyhow: the sessiond would
  84          * use a now-unlinked shm, while the next application would create
  85          * a new named shm.
  86          */
  87         wait_shm_fd = shm_open(shm_path, O_RDWR | O_CREAT, mode);
  88         if (wait_shm_fd < 0) {
  89                 if (errno == EACCES) {
  90                         /* Work around sysctl fs.protected_regular. */
  91                         DBG("shm_open of %s returned EACCES, this may be caused "
  92                                         "by the fs.protected_regular sysctl. "
  93                                         "Attempting to open the shm without "
  94                                         "creating it.", shm_path);
  95                         wait_shm_fd = shm_open(shm_path, O_RDWR, mode);
  96                 }
  97                 if (wait_shm_fd < 0) {
  98                         PERROR("Failed to open \"wait\" shared memory object: path = '%s'", shm_path);
  99                         goto error;
 100                 }
 101         }
 102
 103         ret = ftruncate(wait_shm_fd, mmap_size);
 104         if (ret < 0) {
 105                 PERROR("Failed to truncate \"wait\" shared memory object: fd = %d, size = %zu",
 106                                 wait_shm_fd, mmap_size);
 107                 exit(EXIT_FAILURE);
 108         }
 109
 110         if (global) {
 111                 ret = fchown(wait_shm_fd, 0, 0);
 112                 if (ret < 0) {
 113                         PERROR("Failed to set ownership of \"wait\" shared memory object: fd = %d, owner = 0, group = 0",
 114                                         wait_shm_fd);
 115                         exit(EXIT_FAILURE);
 116                 }
 117                 /*
 118                  * If global session daemon, any application can
 119                  * register so the shm needs to be set in read-only mode
 120                  * for others.
 121                  */
 122                 mode &= ~S_IWOTH;
 123                 ret = fchmod(wait_shm_fd, mode);
 124                 if (ret < 0) {
 125                         PERROR("Failed to set the mode of the \"wait\" shared memory object: fd = %d, mode = %d",
 126                                         wait_shm_fd, mode);
 127                         exit(EXIT_FAILURE);
 128                 }
 129         } else {
 130                 ret = fchown(wait_shm_fd, getuid(), getgid());
 131                 if (ret < 0) {
 132                         PERROR("Failed to set ownership of \"wait\" shared memory object: fd = %d, owner = %d, group = %d",
 133                                         wait_shm_fd, getuid(), getgid());
 134                         exit(EXIT_FAILURE);
 135                 }
 136         }
 137
 138         DBG("Wait shared memory file descriptor created successfully: path = '%s', mmap_size = %zu, global = %s, fd = %d",
 139                         shm_path, mmap_size, global ? "true" : "false",
 140                         wait_shm_fd);
 141
 142         return wait_shm_fd;
 143
 144 error:
 145         DBG("Failed to open shared memory file descriptor: path = '%s', mmap_size = %zu, global = %s",
 146                         shm_path, mmap_size, global ? "true" : "false");
 147
 148         return -1;
 149 }
 150
 151 /*
 152  * Return the wait shm mmap for UST application notification. The global
 153  * variable is used to indicate if the the session daemon is global
 154  * (root:tracing) or running with an unprivileged user.
 155  *
 156  * This returned value is used by futex_wait_update() in futex.c to WAKE all
 157  * waiters which are UST application waiting for a session daemon.
 158  */
 159 LTTNG_HIDDEN
 160 char *shm_ust_get_mmap(char *shm_path, int global)
 161 {
 162         size_t mmap_size;
 163         int wait_shm_fd, ret;
 164         char *wait_shm_mmap;
 165         long sys_page_size;
 166
 167         assert(shm_path);
 168
 169         sys_page_size = sysconf(_SC_PAGE_SIZE);
 170         if (sys_page_size < 0) {
 171                 PERROR("Failed to get PAGE_SIZE of system");
 172                 goto error;
 173         }
 174         mmap_size = sys_page_size;
 175
 176         wait_shm_fd = get_wait_shm(shm_path, mmap_size, global);
 177         if (wait_shm_fd < 0) {
 178                 goto error;
 179         }
 180
 181         wait_shm_mmap = mmap(NULL, mmap_size, PROT_WRITE | PROT_READ,
 182                         MAP_SHARED, wait_shm_fd, 0);
 183
 184         /* close shm fd immediately after taking the mmap reference */
 185         ret = close(wait_shm_fd);
 186         if (ret) {
 187                 PERROR("Failed to close \"wait\" shared memory object file descriptor: fd = %d",
 188                                 wait_shm_fd);
 189         }
 190
 191         if (wait_shm_mmap == MAP_FAILED) {
 192                 DBG("Failed to mmap the \"wait\" shareed memory object (can be caused by race with ust): path = '%s', global = %s",
 193                                 shm_path, global ? "true" : "false");
 194                 goto error;
 195         }
 196
 197         return wait_shm_mmap;
 198
 199 error:
 200         return NULL;
 201 }
 202
 203 /*
 204  * shm_create_anonymous is never called concurrently within a process.
 205  */
 206 LTTNG_HIDDEN
 207 int shm_create_anonymous(const char *owner_name)
 208 {
 209         char tmp_name[NAME_MAX];
 210         int shmfd, ret;
 211
 212         ret = snprintf(tmp_name, NAME_MAX, "/shm-%s-%d", owner_name, getpid());
 213         if (ret < 0) {
 214                 PERROR("Failed to format shm path: owner_name = '%s', pid = %d",
 215                                 owner_name, getpid());
 216                 return -1;
 217         }
 218
 219         /*
 220          * Allocate shm, and immediately unlink its shm oject, keeping only the
 221          * file descriptor as a reference to the object.
 222          */
 223         shmfd = shm_open(tmp_name, O_CREAT | O_EXCL | O_RDWR, 0700);
 224         if (shmfd < 0) {
 225                 PERROR("Failed to open shared memory object: path = '%s'", tmp_name);
 226                 goto error_shm_open;
 227         }
 228
 229         ret = shm_unlink(tmp_name);
 230         if (ret < 0 && errno != ENOENT) {
 231                 PERROR("Failed to unlink shared memory object: path = '%s'",
 232                                 tmp_name);
 233                 goto error_shm_release;
 234         }
 235
 236         return shmfd;
 237
 238 error_shm_release:
 239         ret = close(shmfd);
 240         if (ret) {
 241                 PERROR("Failed to close shared memory object file descriptor: fd = %d, path = '%s'",
 242                                 shmfd, tmp_name);
 243         }
 244 error_shm_open:
 245         return -1;
 246 }