1 #include <darwintest.h>
2 #include <darwintest_utils.h>
3
4 #include <errno.h>
5 #include <fcntl.h>
6 #include <signal.h>
7 #include <spawn.h>
8 #include <spawn_filtering_private.h>
9 #include <spawn_private.h>
10 #include <stdbool.h>
11 #include <stdint.h>
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <sys/spawn_internal.h>
16 #include <sys/stat.h>
17 #include <sys/sysctl.h>
18 #include <sys/syslimits.h>
19 #include <sysexits.h>
20 #include <unistd.h>
21
22 static char tmp_path_filter_rules[PATH_MAX] = "";
23 static char tmp_path_env_output[PATH_MAX] = "";
24
25 static void
cleanup_tmpfiles(void)26 cleanup_tmpfiles(void)
27 {
28 if (tmp_path_filter_rules[0] != '\0') {
29 unlink(tmp_path_filter_rules);
30 }
31 if (tmp_path_env_output[0] != '\0') {
32 unlink(tmp_path_env_output);
33 }
34 }
35
36 /*
37 * Creates a filtering rules file that says "when launching sh, add this env
38 * var". The we launch "sh -c env", redirect the output to a file, read the file
39 * and check that the added env var is present.
40 */
41 T_DECL(posix_spawn_filtering,
42 "Check posix_spawn_filtering",
43 T_META_ENVVAR("FEATUREFLAGS_ENABLED=Libsystem/posix_spawn_filtering"))
44 {
45 #if POSIX_SPAWN_FILTERING_ENABLED
46 const char *tmpdir = dt_tmpdir();
47 T_LOG("tmpdir: %s\n", tmpdir);
48
49 strlcat(tmp_path_filter_rules, tmpdir ? tmpdir : "/tmp", sizeof(tmp_path_filter_rules));
50 strlcat(tmp_path_filter_rules, "/filter.rules.XXXXX", sizeof(tmp_path_filter_rules));
51 int filter_rules_fd = mkstemp(tmp_path_filter_rules);
52 T_ASSERT_POSIX_SUCCESS(filter_rules_fd, "create temporary file 1");
53
54 const char *filter_rules_contents =
55 "binary_name:sh\n"
56 "add_env:ADDED_VAR=VIA_RULES\n";
57 ssize_t bytes_written = write(filter_rules_fd, filter_rules_contents, strlen(filter_rules_contents));
58 T_ASSERT_EQ(bytes_written, (long)strlen(filter_rules_contents), "write should write all contents");
59 close(filter_rules_fd);
60
61 strlcat(tmp_path_env_output, tmpdir ? tmpdir : "/tmp", sizeof(tmp_path_env_output));
62 strlcat(tmp_path_env_output, "/env.output.XXXXX", sizeof(tmp_path_env_output));
63 int env_output_fd = mkstemp(tmp_path_env_output);
64 T_ASSERT_POSIX_SUCCESS(env_output_fd, "create temporary file 2");
65
66 T_ATEND(cleanup_tmpfiles);
67
68 char * const prog = "/bin/sh";
69 char * const argv_child[] = { prog,
70 "-c",
71 "/usr/bin/env",
72 NULL, };
73
74 char rules_path_env[PATH_MAX + 100] = {0};
75 sprintf(rules_path_env, "POSIX_SPAWN_FILTERING_RULES_PATH=%s", tmp_path_filter_rules);
76 char * const envp_child[] = {
77 "HELLO=WORLD",
78 rules_path_env,
79 NULL,
80 };
81
82 pid_t child_pid;
83
84 posix_spawn_file_actions_t file_actions;
85 T_ASSERT_POSIX_SUCCESS(posix_spawn_file_actions_init(&file_actions), "posix_spawn_file_actions_init");
86 T_ASSERT_POSIX_SUCCESS(posix_spawn_file_actions_adddup2(&file_actions, env_output_fd, STDOUT_FILENO), "posix_spawn_file_actions_addup2");
87
88 int ret;
89 ret = posix_spawn(&child_pid, prog, &file_actions, NULL, argv_child, envp_child);
90 T_ASSERT_POSIX_SUCCESS(ret, "posix_spawn");
91 T_LOG("parent: spawned child with pid %d, waiting for child to exit\n", child_pid);
92
93 ret = posix_spawn_file_actions_destroy(&file_actions);
94 T_QUIET;
95 T_ASSERT_POSIX_SUCCESS(ret, "posix_spawn_file_actions_destroy");
96
97 int status = 0;
98 int waitpid_result = waitpid(child_pid, &status, 0);
99 T_ASSERT_POSIX_SUCCESS(waitpid_result, "waitpid");
100 T_ASSERT_EQ(waitpid_result, child_pid, "waitpid should return child we spawned");
101 T_ASSERT_EQ(WIFEXITED(status), 1, "child should have exited normally");
102 T_ASSERT_EQ(WEXITSTATUS(status), EX_OK, "child should have exited with success");
103
104 T_ASSERT_EQ(lseek(env_output_fd, 0, SEEK_SET), 0ull, "lseek should succeed");
105 struct stat s;
106 T_ASSERT_POSIX_SUCCESS(fstat(env_output_fd, &s), "fstat should succeed");
107 T_ASSERT_GT(s.st_size, 0ll, "s.st_size > 0");
108 char env_file_content[s.st_size + 1];
109 memset(env_file_content, 0, s.st_size + 1);
110 T_ASSERT_EQ((long)read(env_output_fd, env_file_content, (size_t)s.st_size), (long)s.st_size, "read should load the whole file");
111
112 T_ASSERT_NOTNULL(strstr(env_file_content, "HELLO=WORLD\n"), "original env var present");
113 T_ASSERT_NOTNULL(strstr(env_file_content, "ADDED_VAR=VIA_RULES\n"), "added env var present");
114
115 T_PASS("posix_spawn_filtering did succeed to set an env var");
116
117 #else // POSIX_SPAWN_FILTERING_ENABLED
118 T_SKIP("posix_spawn_filtering only supported with POSIX_SPAWN_FILTERING_ENABLED");
119 #endif // POSIX_SPAWN_FILTERING_ENABLED
120 }
121