Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-12-08 06:09:58 +00:00
Code Issues Projects Releases Packages Wiki Activity
ladybird/Kernel/Syscalls/pledge.cpp

88 lines
2.7 KiB
C++
Raw Normal View History

Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
*
Everything: Move to SPDX license identifiers in all files. SPDX License Identifiers are a more compact / standardized way of representing file license information. See: https://spdx.dev/resources/use/#identifiers This was done with the `ambr` search and replace tool. ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
2021-04-22 01:24:48 -07:00
* SPDX-License-Identifier: BSD-2-Clause
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
*/
#include <AK/StringView.h>
#include <Kernel/Process.h>
namespace Kernel {
Kernel: Fix the return type for syscalls The Process::Handler type has KResultOr<FlatPtr> as its return type. Using a different return type with an equally-sized template parameter sort of works but breaks once that condition is no longer true, e.g. for KResultOr<int> on x86_64. Ideally the syscall handlers would also take FlatPtrs as their args so we can get rid of the reinterpret_cast for the function pointer but I didn't quite feel like cleaning that up as well.
2021-06-28 20:59:35 +02:00
KResultOr<FlatPtr> Process::sys$pledge(Userspace<const Syscall::SC_pledge_params*> user_params)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
{
Kernel: Annotate all syscalls with VERIFY_PROCESS_BIG_LOCK_ACQUIRED Before we start disabling acquisition of the big process lock for specific syscalls, make sure to document and assert that all the lock is held during all syscalls.
2021-07-18 11:20:12 -07:00
VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
Kernel: Use copy_typed_from_user<T> for fetching syscall parameters
2021-09-05 17:51:37 +02:00
auto params = TRY(copy_typed_from_user(user_params));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
if (params.promises.length > 1024 || params.execpromises.length > 1024)
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 13:49:16 +01:00
return E2BIG;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
OwnPtr<KString> promises;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
if (params.promises.characters) {
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
auto promises_or_error = try_copy_kstring_from_user(params.promises);
if (promises_or_error.is_error())
return promises_or_error.error();
promises = promises_or_error.release_value();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
}
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
OwnPtr<KString> execpromises;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
if (params.execpromises.characters) {
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
auto execpromises_or_error = try_copy_kstring_from_user(params.execpromises);
if (execpromises_or_error.is_error())
return execpromises_or_error.error();
execpromises = execpromises_or_error.release_value();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
}
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
auto parse_pledge = [&](auto pledge_spec, u32& mask) {
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
auto parts = pledge_spec.split_view(' ');
for (auto& part : parts) {
#define __ENUMERATE_PLEDGE_PROMISE(x) \
Kernel: Use StringView when parsing pledges in sys$pledge(..) This ensures no potential allocation as in some cases the pledge char* could be promoted to AK::String by the compiler to execute the comparison.
2021-07-23 09:31:08 -07:00
if (part == StringView { #x }) { \
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
mask |= (1u << (u32)Pledge::x); \
continue; \
}
ENUMERATE_PLEDGE_PROMISES
#undef __ENUMERATE_PLEDGE_PROMISE
return false;
}
return true;
};
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 13:13:05 +01:00
ProtectedDataMutationScope scope { *this };
Kernel: Move process pledge promises into protected data
2021-03-10 22:50:00 +01:00
Kernel: Fix bug where we half apply pledges in sys$pledge(..) This bug manifests it self when the caller to sys$pledge() passes valid promises, but invalid execpromises. The code would apply the promises and then return an error for the execpromises. This leaves the user in a confusing state, as the promises were silently applied, but we return an error suggesting the operation has failed. Avoid this situation by tweaking the implementation to only apply the promises / execpromises after all validation has occurred.
2021-07-23 09:21:43 -07:00
u32 new_promises = 0;
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
if (promises) {
if (!parse_pledge(promises->view(), new_promises))
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 13:49:16 +01:00
return EINVAL;
Kernel/Process: Move protected values to the end of the object The compiler can re-order the structure (class) members if that's necessary, so if we make Process to inherit from ProcFSExposedComponent, even if the declaration is to inherit first from ProcessBase, then from ProcFSExposedComponent and last from Weakable<Process>, the members of class ProcFSExposedComponent (including the Ref-counted parts) are the first members of the Process class. This problem made it impossible to safely use the current toggling method with the write-protection bit on the ProcessBase members, so instead of inheriting from it, we make its members the last ones in the Process class so we can safely locate and modify the corresponding page write protection bit of these values. We make sure that the Process class doesn't expand beyond 8192 bytes and the protected values are always aligned on a page boundary.
2021-08-07 22:30:06 +03:00
if (m_protected_values.has_promises && (new_promises & ~m_protected_values.promises))
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 13:49:16 +01:00
return EPERM;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
}
Kernel: Fix bug where we half apply pledges in sys$pledge(..) This bug manifests it self when the caller to sys$pledge() passes valid promises, but invalid execpromises. The code would apply the promises and then return an error for the execpromises. This leaves the user in a confusing state, as the promises were silently applied, but we return an error suggesting the operation has failed. Avoid this situation by tweaking the implementation to only apply the promises / execpromises after all validation has occurred.
2021-07-23 09:21:43 -07:00
u32 new_execpromises = 0;
Kernel: Migrate sys$pledge to use the KString API This avoids potential unhandled OOM that's possible with the old copy_string_from_user API.
2021-07-23 09:14:35 -07:00
if (execpromises) {
if (!parse_pledge(execpromises->view(), new_execpromises))
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 13:49:16 +01:00
return EINVAL;
Kernel/Process: Move protected values to the end of the object The compiler can re-order the structure (class) members if that's necessary, so if we make Process to inherit from ProcFSExposedComponent, even if the declaration is to inherit first from ProcessBase, then from ProcFSExposedComponent and last from Weakable<Process>, the members of class ProcFSExposedComponent (including the Ref-counted parts) are the first members of the Process class. This problem made it impossible to safely use the current toggling method with the write-protection bit on the ProcessBase members, so instead of inheriting from it, we make its members the last ones in the Process class so we can safely locate and modify the corresponding page write protection bit of these values. We make sure that the Process class doesn't expand beyond 8192 bytes and the protected values are always aligned on a page boundary.
2021-08-07 22:30:06 +03:00
if (m_protected_values.has_execpromises && (new_execpromises & ~m_protected_values.execpromises))
Kernel: Make all syscall functions return KResultOr<T> This makes it a lot easier to return errors since we no longer have to worry about negating EFOO errors and can just return them flat.
2021-03-01 13:49:16 +01:00
return EPERM;
Kernel: Fix bug where we half apply pledges in sys$pledge(..) This bug manifests it self when the caller to sys$pledge() passes valid promises, but invalid execpromises. The code would apply the promises and then return an error for the execpromises. This leaves the user in a confusing state, as the promises were silently applied, but we return an error suggesting the operation has failed. Avoid this situation by tweaking the implementation to only apply the promises / execpromises after all validation has occurred.
2021-07-23 09:21:43 -07:00
}
// Only apply promises after all validation has occurred, this ensures
// we don't introduce logic bugs like applying the promises, and then
// erroring out when parsing the exec promises later. Such bugs silently
// leave the caller in an unexpected state.
if (promises) {
Kernel/Process: Move protected values to the end of the object The compiler can re-order the structure (class) members if that's necessary, so if we make Process to inherit from ProcFSExposedComponent, even if the declaration is to inherit first from ProcessBase, then from ProcFSExposedComponent and last from Weakable<Process>, the members of class ProcFSExposedComponent (including the Ref-counted parts) are the first members of the Process class. This problem made it impossible to safely use the current toggling method with the write-protection bit on the ProcessBase members, so instead of inheriting from it, we make its members the last ones in the Process class so we can safely locate and modify the corresponding page write protection bit of these values. We make sure that the Process class doesn't expand beyond 8192 bytes and the protected values are always aligned on a page boundary.
2021-08-07 22:30:06 +03:00
m_protected_values.has_promises = true;
m_protected_values.promises = new_promises;
Kernel: Fix bug where we half apply pledges in sys$pledge(..) This bug manifests it self when the caller to sys$pledge() passes valid promises, but invalid execpromises. The code would apply the promises and then return an error for the execpromises. This leaves the user in a confusing state, as the promises were silently applied, but we return an error suggesting the operation has failed. Avoid this situation by tweaking the implementation to only apply the promises / execpromises after all validation has occurred.
2021-07-23 09:21:43 -07:00
}
if (execpromises) {
Kernel/Process: Move protected values to the end of the object The compiler can re-order the structure (class) members if that's necessary, so if we make Process to inherit from ProcFSExposedComponent, even if the declaration is to inherit first from ProcessBase, then from ProcFSExposedComponent and last from Weakable<Process>, the members of class ProcFSExposedComponent (including the Ref-counted parts) are the first members of the Process class. This problem made it impossible to safely use the current toggling method with the write-protection bit on the ProcessBase members, so instead of inheriting from it, we make its members the last ones in the Process class so we can safely locate and modify the corresponding page write protection bit of these values. We make sure that the Process class doesn't expand beyond 8192 bytes and the protected values are always aligned on a page boundary.
2021-08-07 22:30:06 +03:00
m_protected_values.has_execpromises = true;
m_protected_values.execpromises = new_execpromises;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 23:38:15 +02:00
}
return 0;
}
}
Reference in a new issue Copy permalink