SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tree-wide: Migrate to pidref_safe_fork()

Browse Source 
Let's migrate all remaining callers of safe_fork()
to pidref_safe_fork() and get rid of safe_fork().
This commit is contained in:
Daan De Meyer
2026-01-02 20:08:41 +01:00
committed by DaanDeMeyer
parent e6703a9aa4
commit 52ecf376fa
60 changed files with 321 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/test-argv-util.c
+2 -2
View File
@@ -63,7 +63,7 @@ static void test_rename_process_one(const char *p, int ret) {
log_info("/* %s(%s) */", __func__, p);
r = ASSERT_OK(safe_fork("(rename)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(rename)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
if (r == 0) {
/* child */
@@ -80,7 +80,7 @@ TEST(rename_process_invalid) {
TEST(rename_process_multi) {
int r;
r = ASSERT_OK(safe_fork("(rename)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(rename)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
if (r == 0) {
/* child */
src/test/test-async.c
+8 -4
View File
@@ -42,8 +42,10 @@ TEST(asynchronous_close) {
asynchronous_close(fd);
wait_fd_closed(fd);
r = safe_fork("(subreaper)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(subreaper)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT,
NULL));
if (r == 0) {
/* child */
@@ -84,8 +86,10 @@ TEST(asynchronous_rm_rf) {
/* Do this once more, from a subreaper. Which is nice, because we can watch the async child even
* though detached */
r = safe_fork("(subreaper)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REOPEN_LOG|FORK_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(subreaper)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REOPEN_LOG|FORK_LOG|FORK_WAIT,
NULL));
if (r == 0) {
_cleanup_free_ char *tt = NULL, *kk = NULL;
src/test/test-capability-util.c
+4 -2
View File
@@ -224,8 +224,10 @@ static void test_capability_get_ambient(void) {
if (r <= 0)
return (void) log_tests_skipped("Lacking CAP_LINUX_IMMUTABLE, skipping getambient test.");
r = safe_fork("(getambient)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(getambient)",
FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG,
NULL));
if (r == 0) {
int x, y;
src/test/test-env-util.c
+1 -1
View File
@@ -494,7 +494,7 @@ TEST(setenv_systemd_exec_pid) {
TEST(getenv_steal_erase) {
int r;
r = safe_fork("(sd-getenvstealerase)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
r = pidref_safe_fork("(sd-getenvstealerase)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
if (r == 0) {
_cleanup_strv_free_ char **l = NULL;
src/test/test-execute.c
+23 -21
View File
@@ -17,6 +17,7 @@
#include "cpu-set-util.h"
#include "dropin.h"
#include "errno-list.h"
#include "event-util.h"
#include "extract-word.h"
#include "fd-util.h"
#include "fileio.h"
@@ -671,11 +672,9 @@ reenable:
}
static int on_spawn_timeout(sd_event_source *s, uint64_t usec, void *userdata) {
pid_t *pid = userdata;
PidRef *pidref = ASSERT_PTR(userdata);
ASSERT_NOT_NULL(pid);
(void) kill(*pid, SIGKILL);
(void) pidref_kill(pidref, SIGKILL);
return 1;
}
@@ -700,7 +699,6 @@ static int find_libraries(const char *exec, char ***ret) {
_cleanup_close_pair_ int outpipe[2] = EBADF_PAIR, errpipe[2] = EBADF_PAIR;
_cleanup_strv_free_ char **libraries = NULL;
_cleanup_free_ char *result = NULL;
pid_t pid;
int r;
ASSERT_NOT_NULL(exec);
@@ -709,10 +707,13 @@ static int find_libraries(const char *exec, char ***ret) {
ASSERT_OK_ERRNO(pipe2(outpipe, O_NONBLOCK|O_CLOEXEC));
ASSERT_OK_ERRNO(pipe2(errpipe, O_NONBLOCK|O_CLOEXEC));
r = safe_fork_full("(spawn-ldd)",
(int[]) { -EBADF, outpipe[1], errpipe[1] },
NULL, 0,
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REARRANGE_STDIO|FORK_LOG, &pid);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
r = pidref_safe_fork_full(
"(spawn-ldd)",
(int[]) { -EBADF, outpipe[1], errpipe[1] },
NULL, 0,
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REARRANGE_STDIO|FORK_LOG,
&pidref);
ASSERT_OK(r);
if (r == 0) {
execlp("ldd", "ldd", exec, NULL);
@@ -725,12 +726,12 @@ static int find_libraries(const char *exec, char ***ret) {
ASSERT_OK(sd_event_new(&e));
ASSERT_OK(sd_event_add_time_relative(e, NULL, CLOCK_MONOTONIC,
10 * USEC_PER_SEC, USEC_PER_SEC, on_spawn_timeout, &pid));
10 * USEC_PER_SEC, USEC_PER_SEC, on_spawn_timeout, &pidref));
ASSERT_OK(sd_event_add_io(e, &stdout_source, outpipe[0], EPOLLIN, on_spawn_io, &result));
ASSERT_OK(sd_event_source_set_enabled(stdout_source, SD_EVENT_ONESHOT));
ASSERT_OK(sd_event_add_io(e, &stderr_source, errpipe[0], EPOLLIN, on_spawn_io, NULL));
ASSERT_OK(sd_event_source_set_enabled(stderr_source, SD_EVENT_ONESHOT));
ASSERT_OK(sd_event_add_child(e, &sigchld_source, pid, WEXITED, on_spawn_exit, NULL));
ASSERT_OK(event_add_child_pidref(e, &sigchld_source, &pidref, WEXITED, on_spawn_exit, NULL));
/* Child exit should be processed after IO is complete */
ASSERT_OK(sd_event_source_set_priority(sigchld_source, SD_EVENT_PRIORITY_NORMAL + 1));
@@ -1464,16 +1465,17 @@ static void run_tests(RuntimeScope scope, char **patterns) {
static int prepare_ns(const char *process_name) {
int r;
r = safe_fork(process_name,
FORK_RESET_SIGNALS |
FORK_CLOSE_ALL_FDS |
FORK_DEATHSIG_SIGTERM |
FORK_WAIT |
FORK_REOPEN_LOG |
FORK_LOG |
FORK_NEW_MOUNTNS |
FORK_MOUNTNS_SLAVE,
NULL);
r = pidref_safe_fork(
process_name,
FORK_RESET_SIGNALS|
FORK_CLOSE_ALL_FDS|
FORK_DEATHSIG_SIGTERM|
FORK_WAIT|
FORK_REOPEN_LOG|
FORK_LOG|
FORK_NEW_MOUNTNS|
FORK_MOUNTNS_SLAVE,
NULL);
ASSERT_OK(r);
if (r == 0) {
_cleanup_free_ char *unit_dir = NULL, *build_dir = NULL, *build_dir_mount = NULL;
src/test/test-fd-util.c
+6 -6
View File
@@ -157,10 +157,9 @@ TEST(fd_move_above_stdio) {
}
TEST(rearrange_stdio) {
pid_t pid;
int r;
r = safe_fork("rearrange", FORK_WAIT|FORK_LOG, &pid);
r = pidref_safe_fork("rearrange", FORK_WAIT|FORK_LOG, NULL);
assert_se(r >= 0);
if (r == 0) {
@@ -335,27 +334,28 @@ static void test_close_all_fds_inner(int (*func)(const int except[], size_t n_ex
}
TEST(close_all_fds) {
ForkFlags flags = FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT;
int r;
ASSERT_OK(r = safe_fork("(caf-plain)", FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(caf-plain)", flags, NULL));
if (r == 0) {
test_close_all_fds_inner(close_all_fds);
_exit(EXIT_SUCCESS);
}
ASSERT_OK(r = safe_fork("(caf-nomalloc)", FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
ASSERT_OK(r = pidref_safe_fork("(caf-nomalloc)", flags, NULL));
if (r == 0) {
test_close_all_fds_inner(close_all_fds_without_malloc);
_exit(EXIT_SUCCESS);
}
ASSERT_OK(r = safe_fork("(caf-proc)", FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
ASSERT_OK(r = pidref_safe_fork("(caf-proc)", flags, NULL));
if (r == 0) {
test_close_all_fds_inner(close_all_fds_by_proc);
_exit(EXIT_SUCCESS);
}
ASSERT_OK(r = safe_fork("(caf-frugal)", FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
ASSERT_OK(r = pidref_safe_fork("(caf-frugal)", flags, NULL));
if (r == 0) {
test_close_all_fds_inner(close_all_fds_frugal);
_exit(EXIT_SUCCESS);
src/test/test-mempress.c
+5 -3
View File
@@ -12,10 +12,12 @@
#include "bus-locator.h"
#include "bus-wait-for-jobs.h"
#include "event-util.h"
#include "fd-util.h"
#include "format-util.h"
#include "hashmap.h"
#include "path-util.h"
#include "pidref.h"
#include "process-util.h"
#include "random-util.h"
#include "rm-rf.h"
@@ -198,7 +200,6 @@ TEST(real_pressure) {
_cleanup_free_ char *scope = NULL;
const char *object;
int r;
pid_t pid;
r = sd_bus_open_system(&bus);
if (r < 0)
@@ -227,14 +228,15 @@ TEST(real_pressure) {
assert_se(pipe2(pipe_fd, O_CLOEXEC) >= 0);
r = safe_fork("(eat-memory)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM, &pid);
_cleanup_(pidref_done) PidRef pidref = PIDREF_NULL;
r = pidref_safe_fork("(eat-memory)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM, &pidref);
assert_se(r >= 0);
if (r == 0) {
real_pressure_eat_memory(pipe_fd[0]);
_exit(EXIT_SUCCESS);
}
assert_se(sd_event_add_child(e, &cs, pid, WEXITED, real_pressure_child_callback, NULL) >= 0);
assert_se(event_add_child_pidref(e, &cs, &pidref, WEXITED, real_pressure_child_callback, NULL) >= 0);
assert_se(sd_event_source_set_child_process_own(cs, true) >= 0);
assert_se(unsetenv("MEMORY_PRESSURE_WATCH") >= 0);
src/test/test-mkdir.c
+1 -1
View File
@@ -80,7 +80,7 @@ TEST(mkdir_p_safe) {
p = mfree(p);
ASSERT_NOT_NULL(p = path_join(tmp, "zero-mode/should-fail-to-create-child"));
ASSERT_OK(mkdir_parents_safe(tmp, p, 0000, UID_INVALID, GID_INVALID, 0));
ASSERT_OK(r = safe_fork("(test-mkdir-no-cap)", FORK_DEATHSIG_SIGTERM | FORK_WAIT | FORK_LOG, NULL));
r = ASSERT_OK(pidref_safe_fork("(test-mkdir-no-cap)", FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG, NULL));
if (r == 0) {
(void) capability_bounding_set_drop(0, /* right_now= */ true);
ASSERT_ERROR(mkdir_p_safe(tmp, p, 0000, UID_INVALID, GID_INVALID, 0), EACCES);
src/test/test-mount-util.c
+10 -10
View File
@@ -160,7 +160,7 @@ TEST(bind_remount_recursive) {
assert_se(mkdir(subdir, 0755) >= 0);
FOREACH_STRING(p, "/usr", "/sys", "/", tmp) {
ASSERT_OK(r = safe_fork("(bind-remount-recursive)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(bind-remount-recursive)", FORK_COMMON_FLAGS, NULL));
if (r == 0) { /* child */
struct statvfs svfs;
@@ -196,7 +196,7 @@ TEST(bind_remount_one) {
CHECK_PRIV;
ASSERT_OK(r = safe_fork("(remount-one-with-mountinfo)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(remount-one-with-mountinfo)", FORK_COMMON_FLAGS, NULL));
if (r == 0) { /* child */
_cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
@@ -211,7 +211,7 @@ TEST(bind_remount_one) {
_exit(EXIT_SUCCESS);
}
ASSERT_OK(r = safe_fork("(remount-one)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(remount-one)", FORK_COMMON_FLAGS, NULL));
if (r == 0) { /* child */
assert_se(bind_remount_one("/run", MS_RDONLY, MS_RDONLY) >= 0);
assert_se(bind_remount_one("/run", MS_NOEXEC, MS_RDONLY|MS_NOEXEC) >= 0);
@@ -291,7 +291,7 @@ TEST(make_mount_switch_root) {
};
FOREACH_ELEMENT(i, table) {
ASSERT_OK(r = safe_fork("(switch-root)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(switch-root)", FORK_COMMON_FLAGS, NULL));
if (r == 0) {
assert_se(make_mount_point(i->path) >= 0);
assert_se(mount_switch_root_full(i->path, /* mount_propagation_flag= */ 0, i->force_ms_move) >= 0);
@@ -335,7 +335,7 @@ TEST(umount_recursive) {
CHECK_PRIV;
FOREACH_ELEMENT(t, test_table) {
ASSERT_OK(r = safe_fork("(umount-rec)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(umount-rec)", FORK_COMMON_FLAGS, NULL));
if (r == 0) { /* child */
_cleanup_(mnt_free_tablep) struct libmnt_table *table = NULL;
_cleanup_(mnt_free_iterp) struct libmnt_iter *iter = NULL;
@@ -392,7 +392,7 @@ TEST(fd_make_mount_point) {
assert_se(s);
assert_se(mkdir(s, 0700) >= 0);
ASSERT_OK(r = safe_fork("(make-mount-point)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(make-mount-point)", FORK_COMMON_FLAGS, NULL));
if (r == 0) {
_cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
@@ -423,7 +423,7 @@ TEST(bind_mount_submounts) {
assert_se(mkdtemp_malloc(NULL, &a) >= 0);
assert_se(mkdtemp_malloc(NULL, &b) >= 0);
ASSERT_OK(r = safe_fork("(bind-mount-submounts)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(bind-mount-submounts)", FORK_COMMON_FLAGS, NULL));
if (r == 0) {
char *x;
@@ -512,7 +512,7 @@ TEST(path_is_network_fs_harder) {
_cleanup_(rm_rf_physical_and_freep) char *t = NULL;
assert_se(mkdtemp_malloc("/tmp/test-mount-util.path_is_network_fs_harder.XXXXXXX", &t) >= 0);
ASSERT_OK(r = safe_fork("(path-is-network-fs-harder)", FORK_COMMON_FLAGS, NULL));
r = ASSERT_OK(pidref_safe_fork("(path-is-network-fs-harder)", FORK_COMMON_FLAGS, NULL));
if (r == 0) {
ASSERT_OK(mount_nofollow_verbose(LOG_INFO, "tmpfs", t, "tmpfs", 0, NULL));
ASSERT_OK_ZERO(path_is_network_fs_harder(t));
@@ -554,7 +554,7 @@ TEST(mount_fd_clone) {
/* Set up a socket pair to transfer the mount fd from the child (in a different mountns) to us. */
ASSERT_OK_ERRNO(socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, fds));
r = ASSERT_OK(safe_fork_full(
r = ASSERT_OK(pidref_safe_fork_full(
"(mount-fd-clone-setup)",
/* stdio_fds= */ NULL,
&fds[1], 1,
@@ -588,7 +588,7 @@ TEST(mount_fd_clone) {
_cleanup_free_ char *target = ASSERT_NOT_NULL(path_join(t, "target"));
ASSERT_OK_ERRNO(mkdir(target, 0755));
r = ASSERT_OK(safe_fork_full(
r = ASSERT_OK(pidref_safe_fork_full(
"(mount-fd-clone-verify)",
/* stdio_fds= */ NULL,
&first_clone, 1,
src/test/test-namespace.c
+1 -1
View File
@@ -220,7 +220,7 @@ TEST(protect_kernel_logs) {
}
ASSERT_OK(r);
r = ASSERT_OK(safe_fork("(protect)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(protect)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
if (r == 0) {
_cleanup_close_ int fd = -EBADF;
src/test/test-nss-hosts.c
+1 -1
View File
@@ -490,7 +490,7 @@ static int run(int argc, char **argv) {
/* Testing with several syscalls filtered, and check if the nss modules gracefully handle failures in
* masked syscalls. See issue #38582. */
r = ASSERT_OK(safe_fork("(with-seccomp)", FORK_LOG|FORK_WAIT, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(with-seccomp)", FORK_LOG|FORK_WAIT, /* ret= */ NULL));
if (r == 0) {
_cleanup_hashmap_free_ Hashmap *filter = NULL;
ASSERT_NOT_NULL(filter = hashmap_new(NULL));
src/test/test-path-util.c
+4 -1
View File
@@ -475,7 +475,10 @@ static void test_find_executable_exec_one(const char *path) {
if (path_is_absolute(path))
ASSERT_STREQ(t, path);
r = ASSERT_OK(safe_fork("(find-exec)", FORK_LOG|FORK_DEATHSIG_SIGKILL|FORK_WAIT, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork(
"(find-exec)",
FORK_LOG|FORK_DEATHSIG_SIGKILL|FORK_WAIT,
/* ret= */ NULL));
if (r == 0) {
r = fexecve_or_execve(fd, t, STRV_MAKE(t, "--version"), STRV_MAKE(NULL));
src/test/test-process-util.c
+29 -18
View File
@@ -285,7 +285,7 @@ TEST(pid_get_cmdline_harder) {
}
#endif
r = ASSERT_OK(safe_fork("(cmdline)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(cmdline)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
if (r == 0) {
r = detach_mount_namespace();
if (r < 0) {
@@ -573,7 +573,7 @@ TEST(getpid_cached) {
ASSERT_EQ(a, b);
ASSERT_EQ(a, c);
r = ASSERT_OK(safe_fork("(getpid)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
r = ASSERT_OK(pidref_safe_fork("(getpid)", FORK_WAIT|FORK_LOG|FORK_DEATHSIG_SIGKILL, /* ret= */ NULL));
if (r == 0) {
/* In child */
@@ -619,12 +619,13 @@ TEST(getpid_measure) {
log_info("getpid_cached(): %lf μs each", (double) q / iterations);
}
TEST(safe_fork) {
TEST(pidref_safe_fork) {
_cleanup_(pidref_done) PidRef child = PIDREF_NULL;
siginfo_t status;
pid_t pid;
int r;
r = safe_fork("(test-child)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REARRANGE_STDIO|FORK_REOPEN_LOG, &pid);
r = pidref_safe_fork("(test-child)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_REARRANGE_STDIO|FORK_REOPEN_LOG, &child);
ASSERT_OK(r);
if (r == 0) {
@@ -634,9 +635,6 @@ TEST(safe_fork) {
_exit(88);
}
_cleanup_(pidref_done) PidRef child = PIDREF_NULL;
ASSERT_OK(pidref_set_pid(&child, pid));
ASSERT_OK(pidref_wait_for_terminate(&child, &status));
ASSERT_EQ(status.si_code, CLD_EXITED);
ASSERT_EQ(status.si_status, 88);
@@ -710,8 +708,10 @@ TEST(ioprio_class_from_to_string) {
TEST(setpriority_closest) {
int r;
r = safe_fork("(test-setprio)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG|FORK_REOPEN_LOG, NULL);
r = pidref_safe_fork(
"(test-setprio)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG|FORK_REOPEN_LOG,
NULL);
ASSERT_OK(r);
if (r == 0) {
@@ -909,7 +909,10 @@ TEST(get_process_threads) {
int r;
/* Run this test in a child, so that we can guarantee there's exactly one thread around in the child */
r = safe_fork("(nthreads)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG, NULL);
r = pidref_safe_fork(
"(nthreads)",
FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG,
NULL);
ASSERT_OK(r);
if (r == 0) {
@@ -953,8 +956,10 @@ TEST(get_process_threads) {
TEST(is_reaper_process) {
int r;
r = safe_fork("(regular)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(regular)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT,
NULL));
if (r == 0) {
/* child */
@@ -962,8 +967,10 @@ TEST(is_reaper_process) {
_exit(EXIT_SUCCESS);
}
r = safe_fork("(newpid)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(newpid)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT,
NULL));
if (r == 0) {
/* child */
@@ -974,8 +981,10 @@ TEST(is_reaper_process) {
}
}
r = safe_fork("(newpid1)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(newpid1)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT,
NULL));
if (r == 0) {
/* grandchild, which is PID1 in a pidns */
ASSERT_OK_EQ(getpid_cached(), 1);
@@ -986,8 +995,10 @@ TEST(is_reaper_process) {
_exit(EXIT_SUCCESS);
}
r = safe_fork("(subreaper)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT, NULL);
ASSERT_OK(r);
r = ASSERT_OK(pidref_safe_fork(
"(subreaper)",
FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_REOPEN_LOG|FORK_WAIT,
NULL));
if (r == 0) {
/* child */
ASSERT_OK(make_reaper_process(true));
src/test/test-reread-partition-table.c
+1 -1
View File
@@ -26,7 +26,7 @@ static void sfdisk(const char *sfdisk_path, LoopDevice *loop, const char *defini
_cleanup_close_ int memfd = memfd_new_and_seal("sfdisk", definition, SIZE_MAX);
ASSERT_OK(memfd);
r = safe_fork_full(
r = pidref_safe_fork_full(
"(sfdisk)",
(int[]) { memfd, STDOUT_FILENO, STDERR_FILENO },
/* except_fds= */ NULL,
src/test/test-rlimit-util.c
+4 -3
View File
@@ -155,9 +155,10 @@ TEST(pid_getrlimit) {
assert_se(getrlimit(resource, &direct) >= 0);
/* We fork off a child so that getrlimit() doesn't work anymore */
r = safe_fork("(getrlimit)",
FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT,
/* ret= */ NULL);
r = pidref_safe_fork(
"(getrlimit)",
FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT,
/* ret= */ NULL);
assert_se(r >= 0);
if (r == 0) {
src/test/test-rm-rf.c
+1 -1
View File
@@ -102,7 +102,7 @@ TEST(rm_rf_chmod) {
/* This test only works unpriv (as only then the access mask for the owning user matters),
* hence drop privs here */
ASSERT_OK(r = safe_fork("(setresuid)", FORK_DEATHSIG_SIGTERM|FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(setresuid)", FORK_DEATHSIG_SIGTERM|FORK_WAIT, NULL));
if (r == 0) {
/* child */
src/test/test-seccomp.c
+14 -14
View File
@@ -197,7 +197,7 @@ TEST(filter_sets) {
log_info("Testing %s", syscall_filter_sets[i].name);
ASSERT_OK(r = safe_fork("(filter_sets)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(filter_sets)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
int fd;
@@ -295,7 +295,7 @@ TEST(restrict_namespace) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(restrict-namespace)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(restrict-namespace)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
@@ -357,7 +357,7 @@ TEST(protect_sysctl) {
if (!streq(seccomp, "0"))
log_warning("Warning: seccomp filter detected, results may be unreliable for %s", __func__);
ASSERT_OK(r = safe_fork("(protect-sysctl)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(protect-sysctl)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
#if defined __NR__sysctl && __NR__sysctl >= 0
assert_se(syscall(__NR__sysctl, NULL) < 0);
@@ -388,7 +388,7 @@ TEST(protect_syslog) {
/* in containers syslog() is likely missing anyway */
CHECK_SECCOMP(/* skip_container= */ true);
ASSERT_OK(r = safe_fork("(protect-syslog)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(protect-syslog)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
#if defined __NR_syslog && __NR_syslog >= 0
assert_se(syscall(__NR_syslog, -1, NULL, 0) < 0);
@@ -411,7 +411,7 @@ TEST(restrict_address_families) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(restrict-address-families)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(restrict-address-families)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
int fd;
Set *s;
@@ -488,7 +488,7 @@ TEST(restrict_realtime) {
/* in containers RT privs are likely missing anyway */
CHECK_SECCOMP(/* skip_container= */ true);
ASSERT_OK(r = safe_fork("(restrict-realtime)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(restrict-realtime)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* On some CI environments, the restriction may be already enabled. */
if (sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0) {
@@ -542,7 +542,7 @@ TEST(memory_deny_write_execute_mmap) {
return;
#endif
ASSERT_OK(r = safe_fork("(memory_deny_write_execute_mmap)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(memory_deny_write_execute_mmap)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
void *p;
@@ -606,7 +606,7 @@ TEST(memory_deny_write_execute_shmat) {
shmid = shmget(IPC_PRIVATE, page_size(), 0);
assert_se(shmid >= 0);
ASSERT_OK(r = safe_fork("(memory-deny-write-execute)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(memory-deny-write-execute)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
void *p;
@@ -648,7 +648,7 @@ TEST(restrict_archs) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(restrict-archs)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(restrict-archs)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
_cleanup_set_free_ Set *s = NULL;
@@ -675,7 +675,7 @@ TEST(load_syscall_filter_set_raw) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(load-filter)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(load-filter)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
_cleanup_hashmap_free_ Hashmap *s = NULL;
@@ -777,7 +777,7 @@ TEST(native_syscalls_filtered) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(native-syscalls)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(native-syscalls)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
_cleanup_set_free_ Set *arch_s = NULL;
_cleanup_hashmap_free_ Hashmap *s = NULL;
@@ -830,7 +830,7 @@ TEST(lock_personality) {
log_info("current personality=0x%lX", (unsigned long) safe_personality(PERSONALITY_INVALID));
log_info("current opinionated personality=0x%lX", current_opinionated);
ASSERT_OK(r = safe_fork("(lock-personality)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(lock-personality)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
unsigned long current;
@@ -900,7 +900,7 @@ TEST(restrict_suid_sgid) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(suid-sgid)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(suid-sgid)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
char path[] = "/tmp/suidsgidXXXXXX", dir[] = "/tmp/suidsgiddirXXXXXX";
int fd = -EBADF, k = -EBADF;
@@ -1124,7 +1124,7 @@ TEST(seccomp_suppress_sync) {
CHECK_SECCOMP(/* skip_container= */ false);
ASSERT_OK(r = safe_fork("(suppress-sync)", FORK_LOG | FORK_WAIT, NULL));
r = ASSERT_OK(pidref_safe_fork("(suppress-sync)", FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
test_seccomp_suppress_sync_child();
_exit(EXIT_SUCCESS);
src/test/test-socket-util.c
+7 -13
View File
@@ -153,8 +153,7 @@ TEST(in_addr_is_multicast) {
TEST(getpeercred_getpeergroups) {
int r;
r = safe_fork("(getpeercred)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(getpeercred)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
static const gid_t gids[] = { 3, 4, 5, 6, 7 };
@@ -220,8 +219,7 @@ TEST(passfd_read) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(passfd_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(passfd_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* Child */
@@ -262,8 +260,7 @@ TEST(passfd_contents_read) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(passfd_contents_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(passfd_contents_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* Child */
@@ -314,8 +311,7 @@ TEST(pass_many_fds_contents_read) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(passfd_contents_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(passfd_contents_read)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* Child */
@@ -374,7 +370,7 @@ TEST(receive_nopassfd) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(receive_nopassfd)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
r = ASSERT_OK(pidref_safe_fork("(receive_nopassfd)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
assert_se(r >= 0);
if (r == 0) {
@@ -410,8 +406,7 @@ TEST(send_nodata_nofd) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(send_nodata_nofd)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(send_nodata_nofd)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* Child */
@@ -443,8 +438,7 @@ TEST(send_emptydata) {
assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) >= 0);
r = safe_fork("(send_emptydata)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL);
assert_se(r >= 0);
r = ASSERT_OK(pidref_safe_fork("(send_emptydata)", FORK_DEATHSIG_SIGTERM|FORK_LOG|FORK_WAIT, NULL));
if (r == 0) {
/* Child */
src/test/test-terminal-util.c
+6 -5
View File
@@ -385,11 +385,12 @@ TEST(terminal_new_session) {
ASSERT_OK(pty_fd = openpt_allocate(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NONBLOCK, NULL));
ASSERT_OK(peer_fd = pty_open_peer(pty_fd, O_RDWR|O_NOCTTY|O_CLOEXEC));
r = safe_fork_full("test-term-session",
(int[]) { peer_fd, peer_fd, peer_fd },
NULL, 0,
FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT|FORK_REARRANGE_STDIO,
NULL);
r = pidref_safe_fork_full(
"test-term-session",
(int[]) { peer_fd, peer_fd, peer_fd },
NULL, 0,
FORK_DEATHSIG_SIGKILL|FORK_LOG|FORK_WAIT|FORK_REARRANGE_STDIO,
NULL);
ASSERT_OK(r);
if (r == 0) {
ASSERT_OK(terminal_new_session());