Re:The Unix process API is unreliable and unsafe
by stevenhuang on Thursday March 23, 2023 @12:14AM
(#35270471)
> Ironically the best to way manage all of this nonsense is to create a child process first thing in main
That's a sensible strategy. Do you know if this design pattern has a name, of creating this "clean" process image base for forks via ipc?
Re:The Unix process API is unreliable and unsafe
by cryptonector on Thursday March 23, 2023 @01:01AM
(#35270715)
I would call it a spawn server, based on the "open server" or "doas" pattern, where you have a process that creates children to setuid() (etc.) which then set a private IPC service that open()s files and sends back the open FD to the caller.
Re:The Unix process API is unreliable and unsafe
by robocat on Thursday March 23, 2023 @03:57AM
(#35271667)
To add, two good links on issues to beware of with fork():
https://lwn.net/Articles/785430/
https://www.microsoft.com/en-us/research/uploads/prod/2019/0...
The way both APIs handle file inheritance is absolutely horrendous, especially since most libcs don’t set the necessary flags. posix_spawn doesn't solve this either, since posix_atfork can open more files in the child, and multithreaded programs can have a TOCTOU bug if another thread opens files between the call to posix_spawn_file_actions and posix_spawn. TBF Windows is actually worse in this regard, since it’s race condition is a little more subtle. Ironically the best to way manage all of this nonsense is to create a child process first thing in main (another binary), which isn’t multithreaded, closes almost all files (uses a whitelist of fds) upfront, and spawns processes on behalf of the parent when requested (IPC). Ideally you would write this in C, minimize usage of libc, and avoid allocating tons of memory.