src/common/shm.cpp

   1 /*
   2  * Copyright (C) 2011 EfficiOS Inc.
   3  * Copyright (C) 2011 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   4  *
   5  * SPDX-License-Identifier: GPL-2.0-only
   6  *
   7  */
   8
   9 #define _LGPL_SOURCE
  10 #include "shm.hpp"
  11
  12 #include <common/error.hpp>
  13
  14 #include <fcntl.h>
  15 #include <limits.h>
  16 #include <sys/mman.h>
  17 #include <sys/stat.h>
  18 #include <sys/types.h>
  19 #include <sys/wait.h>
  20 #include <unistd.h>
  21 #include <urcu.h>
  22
  23 /*
  24  * We deal with the shm_open vs ftruncate race (happening when the sessiond owns
  25  * the shm and does not let everybody modify it, to ensure safety against
  26  * shm_unlink) by simply letting the mmap fail and retrying after a few
  27  * seconds. For global shm, everybody has rw access to it until the sessiond
  28  * starts.
  29  */
  30 static int get_wait_shm(char *shm_path, size_t mmap_size, int global)
  31 {
  32         int wait_shm_fd, ret;
  33         mode_t mode, old_mode;
  34
  35         LTTNG_ASSERT(shm_path);
  36
  37         /* Default permissions */
  38         mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP;
  39
  40         /*
  41          * Change owner of the shm path.
  42          */
  43         if (global) {
  44                 /*
  45                  * If global session daemon, any application can
  46                  * register. Make it initially writeable so applications
  47                  * registering concurrently can do ftruncate() by
  48                  * themselves.
  49                  */
  50                 mode |= S_IROTH | S_IWOTH;
  51         }
  52
  53         old_mode = umask(~mode);
  54
  55         /*
  56          * Try creating shm (or get rw access). We don't do an exclusive open,
  57          * because we allow other processes to create+ftruncate it concurrently.
  58          *
  59          * A sysctl, fs.protected_regular may prevent the session daemon from
  60          * opening a previously created shm when the O_CREAT flag is provided.
  61          * Systemd enables this ABI-breaking change by default since v241.
  62          *
  63          * First, attempt to use the create-or-open semantic that is
  64          * desired here. If this fails with EACCES, work around this broken
  65          * behaviour and attempt to open the shm without the O_CREAT flag.
  66          *
  67          * The two attempts are made in this order since applications are
  68          * expected to race with the session daemon to create this shm.
  69          * Attempting an shm_open() without the O_CREAT flag first could fail
  70          * because the file doesn't exist. It could then be created by an
  71          * application, which would cause a second try with the O_CREAT flag to
  72          * fail with EACCES.
  73          *
  74          * Note that this introduces a new failure mode where a user could
  75          * launch an application (creating the shm) and unlink the shm while
  76          * the session daemon is launching, causing the second attempt
  77          * to fail. This is not recovered-from as unlinking the shm will
  78          * prevent userspace tracing from succeeding anyhow: the sessiond would
  79          * use a now-unlinked shm, while the next application would create
  80          * a new named shm.
  81          */
  82         wait_shm_fd = shm_open(shm_path, O_RDWR | O_CREAT, mode);
  83         if (wait_shm_fd < 0) {
  84                 if (errno == EACCES) {
  85                         /* Work around sysctl fs.protected_regular. */
  86                         DBG("shm_open of %s returned EACCES, this may be caused "
  87                             "by the fs.protected_regular sysctl. "
  88                             "Attempting to open the shm without "
  89                             "creating it.",
  90                             shm_path);
  91                         wait_shm_fd = shm_open(shm_path, O_RDWR, mode);
  92                 }
  93                 if (wait_shm_fd < 0) {
  94                         PERROR("Failed to open \"wait\" shared memory object: path = '%s'",
  95                                shm_path);
  96                         goto error;
  97                 }
  98         }
  99
 100         ret = ftruncate(wait_shm_fd, mmap_size);
 101         if (ret < 0) {
 102                 PERROR("Failed to truncate \"wait\" shared memory object: fd = %d, size = %zu",
 103                        wait_shm_fd,
 104                        mmap_size);
 105                 goto error;
 106         }
 107
 108         if (global) {
 109                 ret = fchown(wait_shm_fd, 0, 0);
 110                 if (ret < 0) {
 111                         PERROR("Failed to set ownership of \"wait\" shared memory object: fd = %d, owner = 0, group = 0",
 112                                wait_shm_fd);
 113                         goto error;
 114                 }
 115                 /*
 116                  * If global session daemon, any application can
 117                  * register so the shm needs to be set in read-only mode
 118                  * for others.
 119                  */
 120                 mode &= ~S_IWOTH;
 121                 ret = fchmod(wait_shm_fd, mode);
 122                 if (ret < 0) {
 123                         PERROR("Failed to set the mode of the \"wait\" shared memory object: fd = %d, mode = %d",
 124                                wait_shm_fd,
 125                                mode);
 126                         goto error;
 127                 }
 128         } else {
 129                 ret = fchown(wait_shm_fd, getuid(), getgid());
 130                 if (ret < 0) {
 131                         PERROR("Failed to set ownership of \"wait\" shared memory object: fd = %d, owner = %d, group = %d",
 132                                wait_shm_fd,
 133                                getuid(),
 134                                getgid());
 135                         goto error;
 136                 }
 137         }
 138
 139         DBG("Wait shared memory file descriptor created successfully: path = '%s', mmap_size = %zu, global = %s, fd = %d",
 140             shm_path,
 141             mmap_size,
 142             global ? "true" : "false",
 143             wait_shm_fd);
 144
 145 end:
 146         (void) umask(old_mode);
 147         return wait_shm_fd;
 148
 149 error:
 150         DBG("Failing to get the wait shm fd");
 151         if (wait_shm_fd >= 0) {
 152                 if (close(wait_shm_fd)) {
 153                         PERROR("Failed to close wait shm file descriptor during error handling");
 154                 }
 155         }
 156
 157         wait_shm_fd = -1;
 158         goto end;
 159 }
 160
 161 /*
 162  * Return the wait shm mmap for UST application notification. The global
 163  * variable is used to indicate if the the session daemon is global
 164  * (root:tracing) or running with an unprivileged user.
 165  *
 166  * This returned value is used by futex_wait_update() in futex.c to WAKE all
 167  * waiters which are UST application waiting for a session daemon.
 168  */
 169 char *shm_ust_get_mmap(char *shm_path, int global)
 170 {
 171         size_t mmap_size;
 172         int wait_shm_fd, ret;
 173         char *wait_shm_mmap;
 174         long sys_page_size;
 175
 176         LTTNG_ASSERT(shm_path);
 177
 178         sys_page_size = sysconf(_SC_PAGE_SIZE);
 179         if (sys_page_size < 0) {
 180                 PERROR("Failed to get PAGE_SIZE of system");
 181                 goto error;
 182         }
 183         mmap_size = sys_page_size;
 184
 185         wait_shm_fd = get_wait_shm(shm_path, mmap_size, global);
 186         if (wait_shm_fd < 0) {
 187                 goto error;
 188         }
 189
 190         wait_shm_mmap = (char *) mmap(
 191                 nullptr, mmap_size, PROT_WRITE | PROT_READ, MAP_SHARED, wait_shm_fd, 0);
 192
 193         /* close shm fd immediately after taking the mmap reference */
 194         ret = close(wait_shm_fd);
 195         if (ret) {
 196                 PERROR("Failed to close \"wait\" shared memory object file descriptor: fd = %d",
 197                        wait_shm_fd);
 198         }
 199
 200         if (wait_shm_mmap == MAP_FAILED) {
 201                 DBG("Failed to mmap the \"wait\" shareed memory object (can be caused by race with ust): path = '%s', global = %s",
 202                     shm_path,
 203                     global ? "true" : "false");
 204                 goto error;
 205         }
 206
 207         return wait_shm_mmap;
 208
 209 error:
 210         return nullptr;
 211 }
 212
 213 /*
 214  * shm_create_anonymous is never called concurrently within a process.
 215  */
 216 int shm_create_anonymous(const char *owner_name)
 217 {
 218         char tmp_name[NAME_MAX];
 219         int shmfd, ret;
 220
 221         ret = snprintf(tmp_name, NAME_MAX, "/shm-%s-%d", owner_name, getpid());
 222         if (ret < 0) {
 223                 PERROR("Failed to format shm path: owner_name = '%s', pid = %d",
 224                        owner_name,
 225                        getpid());
 226                 return -1;
 227         }
 228
 229         /*
 230          * Allocate shm, and immediately unlink its shm oject, keeping only the
 231          * file descriptor as a reference to the object.
 232          */
 233         shmfd = shm_open(tmp_name, O_CREAT | O_EXCL | O_RDWR, 0700);
 234         if (shmfd < 0) {
 235                 PERROR("Failed to open shared memory object: path = '%s'", tmp_name);
 236                 goto error_shm_open;
 237         }
 238
 239         ret = shm_unlink(tmp_name);
 240         if (ret < 0 && errno != ENOENT) {
 241                 PERROR("Failed to unlink shared memory object: path = '%s'", tmp_name);
 242                 goto error_shm_release;
 243         }
 244
 245         return shmfd;
 246
 247 error_shm_release:
 248         ret = close(shmfd);
 249         if (ret) {
 250                 PERROR("Failed to close shared memory object file descriptor: fd = %d, path = '%s'",
 251                        shmfd,
 252                        tmp_name);
 253         }
 254 error_shm_open:
 255         return -1;
 256 }