1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
12 static void (*oldsignal)(int);
15 /*************************************************
16 * Ensure an fd has a given value *
17 *************************************************/
19 /* This function is called when we want to ensure that a certain fd has a
20 specific value (one of 0, 1, 2). If it hasn't got it already, close the value
21 we want, duplicate the fd, then close the old one.
31 force_fd(int oldfd, int newfd)
33 if (oldfd == newfd) return;
35 (void)dup2(oldfd, newfd);
41 /*************************************************
42 * Build argv list and optionally re-exec Exim *
43 *************************************************/
45 /* This function is called when Exim wants to re-exec (overlay) itself in the
46 current process. This is different to child_open_exim(), which runs another
47 Exim process in parallel (but it then calls this function). The function's
48 basic job is to build the argv list according to the values of current options
49 settings. There is a basic list that all calls require, and an additional list
50 that some do not require. Further additions can be given as additional
51 arguments. An option specifies whether the exec() is actually to happen, and if
52 so, what is to be done if it fails.
55 exec_type CEE_RETURN_ARGV => don't exec; return the argv list
56 CEE_EXEC_EXIT => just exit() on exec failure
57 CEE_EXEC_PANIC => panic-die on exec failure
58 kill_v if TRUE, don't pass on the D_v flag
59 pcount if not NULL, points to extra size of argv required, and if
60 CEE_RETURN_ARGV is specified, it is updated to give the
62 minimal TRUE if only minimal argv is required
63 acount number of additional arguments
64 ... further values to add to argv
66 Returns: if CEE_RETURN_ARGV is given, returns a pointer to argv;
67 otherwise, does not return
71 child_exec_exim(int exec_type, BOOL kill_v, int *pcount, BOOL minimal,
74 int first_special = -1;
76 int extra = pcount ? *pcount : 0;
79 argv = store_get((extra + acount + MAX_CLMACROS + 24) * sizeof(char *), FALSE);
81 /* In all case, the list starts out with the path, any macros, and a changed
84 argv[n++] = exim_path;
85 if (clmacro_count > 0)
87 memcpy(argv + n, clmacros, clmacro_count * sizeof(uschar *));
91 { argv[n++] = US"-C"; argv[n++] = config_main_filename; }
93 /* These values are added only for non-minimal cases. If debug_selector is
94 precisely D_v, we have to assume this was started by a non-admin user, and
95 we suppress the flag when requested. (This happens when passing on an SMTP
96 connection, and after ETRN.) If there's more debugging going on, an admin user
97 was involved, so we do pass it on. */
101 if (debug_selector == D_v)
103 if (!kill_v) argv[n++] = US"-v";
107 if (debug_selector != 0)
109 argv[n++] = string_sprintf("-d=0x%x", debug_selector);
112 int flags = fcntl(debug_fd, F_GETFD);
113 if (flags != -1) (void)fcntl(debug_fd, F_SETFD, flags & ~FD_CLOEXEC);
120 if (debug_pretrigger_buf)
121 { argv[n++] = US"-dp"; argv[n++] = string_sprintf("0x%x", debug_pretrigger_bsize); }
122 if (dtrigger_selector != 0)
123 argv[n++] = string_sprintf("-dt=0x%x", dtrigger_selector);
126 argv[n++] = US"-MCd";
127 argv[n++] = US process_purpose;
129 if (!f.testsuite_delays) argv[n++] = US"-odd";
130 if (f.dont_deliver) argv[n++] = US"-N";
131 if (f.queue_smtp) argv[n++] = US"-odqs";
132 if (f.synchronous_delivery) argv[n++] = US"-odi";
133 if (connection_max_messages >= 0)
134 argv[n++] = string_sprintf("-oB%d", connection_max_messages);
136 { argv[n++] = US"-MCG"; argv[n++] = queue_name; }
139 /* Now add in any others that are in the call. Remember which they were,
140 for more helpful diagnosis on failure. */
145 va_start(ap, acount);
148 argv[n++] = va_arg(ap, uschar *);
152 /* Terminate the list, and return it, if that is what is wanted. */
155 if (exec_type == CEE_RETURN_ARGV)
157 if (pcount) *pcount = n;
161 /* Otherwise, do the exec() here, and handle the consequences of an unexpected
162 failure. We know that there will always be at least one extra option in the
163 call when exec() is done here, so it can be used to add to the panic data. */
165 DEBUG(D_exec) debug_print_argv(CUSS argv);
166 exim_nullstd(); /* Make sure std{in,out,err} exist */
167 execv(CS argv[0], (char *const *)argv);
170 LOG_MAIN | ((exec_type == CEE_EXEC_EXIT)? LOG_PANIC : LOG_PANIC_DIE),
171 "re-exec of exim (%s) with %s failed: %s", exim_path, argv[first_special],
174 /* Get here if exec_type == CEE_EXEC_EXIT.
175 Note: this must be _exit(), not exit(). */
177 _exit(EX_EXECFAILED);
179 return NULL; /* To keep compilers happy */
185 /*************************************************
186 * Create a child Exim process *
187 *************************************************/
189 /* This function is called when Exim wants to run a parallel instance of itself
190 in order to inject a message via the standard input. The function creates a
191 child process and runs Exim in it. It sets up a pipe to the standard input of
192 the new process, and returns that to the caller via fdptr. The function returns
193 the pid of the new process, or -1 if things go wrong. If debug_fd is
194 non-negative, it is passed as stderr.
196 This interface is now a just wrapper for the more complicated function
197 child_open_exim2(), which has additional arguments. The wrapper must continue
198 to exist, even if all calls from within Exim are changed, because it is
199 documented for use from local_scan().
201 Argument: fdptr pointer to int for the stdin fd
202 purpose of the child process, for debug
203 Returns: pid of the created process or -1 if anything has gone wrong
207 child_open_exim_function(int * fdptr, const uschar * purpose)
209 return child_open_exim2_function(fdptr, US"<>", bounce_sender_authentication,
214 /* This is a more complicated function for creating a child Exim process, with
218 fdptr pointer to int for the stdin fd
219 sender for a sender address (data for -f)
220 sender_authentication authenticated sender address or NULL
221 purpose of the child process, for debug
223 Returns: pid of the created process or -1 if anything has gone wrong
227 child_open_exim2_function(int * fdptr, uschar * sender,
228 uschar * sender_authentication, const uschar * purpose)
234 /* Create the pipe and fork the process. Ensure that SIGCHLD is set to
235 SIG_DFL before forking, so that the child process can be waited for. We
236 sometimes get here with it set otherwise. Save the old state for resetting
239 if (pipe(pfd) != 0) return (pid_t)(-1);
240 oldsignal = signal(SIGCHLD, SIG_DFL);
241 pid = exim_fork(purpose);
243 /* Child process: make the reading end of the pipe into the standard input and
244 close the writing end. If debugging, pass debug_fd as stderr. Then re-exec
245 Exim with appropriate options. In the test harness, use -odi unless queue_only
246 is set, so that the bounce is fully delivered before returning. Failure is
247 signalled with EX_EXECFAILED (specified by CEE_EXEC_EXIT), but this shouldn't
252 force_fd(pfd[pipe_read], 0);
253 (void)close(pfd[pipe_write]);
254 if (debug_fd > 0) force_fd(debug_fd, 2);
255 if (f.running_in_test_harness && !queue_only)
257 if (sender_authentication)
258 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 9,
259 US "-odi", US"-t", US"-oem", US"-oi", US"-f", sender, US"-oMas",
260 sender_authentication, message_id_option);
262 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 7,
263 US "-odi", US"-t", US"-oem", US"-oi", US"-f", sender,
265 /* Control does not return here. */
267 else /* Not test harness */
269 if (sender_authentication)
270 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 8,
271 US"-t", US"-oem", US"-oi", US"-f", sender, US"-oMas",
272 sender_authentication, message_id_option);
274 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 6,
275 US"-t", US"-oem", US"-oi", US"-f", sender, message_id_option);
276 /* Control does not return here. */
280 testharness_pause_ms(100); /* let child work even longer, for exec */
282 /* Parent process. Save fork() errno and close the reading end of the stdin
286 (void)close(pfd[pipe_read]);
292 *fdptr = pfd[pipe_write]; /* return writing end of stdin pipe */
293 return pid; /* and pid of new process */
298 (void)close(pfd[pipe_write]);
302 #endif /* STAND_ALONE */
306 /*************************************************
307 * Create a non-Exim child process *
308 *************************************************/
310 /* This function creates a child process and runs the given command in it. It
311 sets up pipes to the standard input and output of the new process, and returns
312 them to the caller. The standard error is cloned to the output. If there are
313 any file descriptors "in the way" in the new process, they are closed. A new
314 umask is supplied for the process, and an optional new uid and gid are also
315 available. These are used by the queryprogram router to set an unprivileged id.
316 SIGUSR1 is always disabled in the new process, as it is not going to be running
317 Exim (the function child_open_exim() is provided for that). This function
318 returns the pid of the new process, or -1 if things go wrong.
321 argv the argv for exec in the new process
322 envp the envp for exec in the new process
323 newumask umask to set in the new process
324 newuid point to uid for the new process or NULL for no change
325 newgid point to gid for the new process or NULL for no change
326 infdptr pointer to int into which the fd of the stdin of the new process
328 outfdptr pointer to int into which the fd of the stdout/stderr of the new
330 wd if not NULL, a path to be handed to chdir() in the new process
331 make_leader if TRUE, make the new process a process group leader
332 purpose for debug: reason for running the task
334 Returns: the pid of the created process or -1 if anything has gone wrong
338 child_open_uid(const uschar **argv, const uschar **envp, int newumask,
339 uid_t *newuid, gid_t *newgid, int *infdptr, int *outfdptr, uschar *wd,
340 BOOL make_leader, const uschar * purpose)
343 int inpfd[2], outpfd[2];
346 /* Create the pipes. */
348 if (pipe(inpfd) != 0) return (pid_t)(-1);
349 if (pipe(outpfd) != 0)
351 (void)close(inpfd[pipe_read]);
352 (void)close(inpfd[pipe_write]);
356 /* Fork the process. Ensure that SIGCHLD is set to SIG_DFL before forking, so
357 that the child process can be waited for. We sometimes get here with it set
358 otherwise. Save the old state for resetting on the wait. */
360 oldsignal = signal(SIGCHLD, SIG_DFL);
361 pid = exim_fork(purpose);
363 /* Handle the child process. First, set the required environment. We must do
364 this before messing with the pipes, in order to be able to write debugging
365 output when things go wrong. */
369 signal(SIGUSR1, SIG_IGN);
370 signal(SIGPIPE, SIG_DFL);
372 if (newgid && setgid(*newgid) < 0)
374 DEBUG(D_any) debug_printf("failed to set gid=%ld in subprocess: %s\n",
375 (long int)(*newgid), strerror(errno));
379 if (newuid && setuid(*newuid) < 0)
381 DEBUG(D_any) debug_printf("failed to set uid=%ld in subprocess: %s\n",
382 (long int)(*newuid), strerror(errno));
386 (void)umask(newumask);
388 if (wd && Uchdir(wd) < 0)
390 DEBUG(D_any) debug_printf("failed to chdir to %s: %s\n", wd,
395 /* Becomes a process group leader if requested, and then organize the pipes.
396 Any unexpected failure is signalled with EX_EXECFAILED; these are all "should
397 never occur" failures, except for exec failing because the command doesn't
400 if (make_leader && setpgid(0,0) < 0)
402 DEBUG(D_any) debug_printf("failed to set group leader in subprocess: %s\n",
407 (void)close(inpfd[pipe_write]);
408 force_fd(inpfd[pipe_read], 0);
410 (void)close(outpfd[pipe_read]);
411 force_fd(outpfd[pipe_write], 1);
416 /* Now do the exec */
418 if (envp) execve(CS argv[0], (char *const *)argv, (char *const *)envp);
419 else execv(CS argv[0], (char *const *)argv);
421 /* Failed to execv. Signal this failure using EX_EXECFAILED. We are
422 losing the actual errno we got back, because there is no way to return
426 _exit(EX_EXECFAILED); /* Note: must be _exit(), NOT exit() */
429 /* Parent process. Save any fork failure code, and close the reading end of the
430 stdin pipe, and the writing end of the stdout pipe. */
433 (void)close(inpfd[pipe_read]);
434 (void)close(outpfd[pipe_write]);
436 /* Fork succeeded; return the input/output pipes and the pid */
440 *infdptr = inpfd[pipe_write];
441 *outfdptr = outpfd[pipe_read];
445 /* Fork failed; reset fork errno before returning */
447 (void)close(inpfd[pipe_write]);
448 (void)close(outpfd[pipe_read]);
456 /*************************************************
457 * Create child process without uid change *
458 *************************************************/
460 /* This function is a wrapper for child_open_uid() that doesn't have the uid,
461 gid and working directory changing arguments. The function is provided so as to
462 have a clean interface for use from local_scan(), but also saves writing NULL
463 arguments several calls that would otherwise use child_open_uid().
466 argv the argv for exec in the new process
467 envp the envp for exec in the new process
468 newumask umask to set in the new process
469 infdptr pointer to int into which the fd of the stdin of the new process
471 outfdptr pointer to int into which the fd of the stdout/stderr of the new
473 make_leader if TRUE, make the new process a process group leader
474 purpose for debug: reason for running the task
476 Returns: the pid of the created process or -1 if anything has gone wrong
480 child_open_function(uschar **argv, uschar **envp, int newumask, int *infdptr,
481 int *outfdptr, BOOL make_leader, const uschar * purpose)
483 return child_open_uid(CUSS argv, CUSS envp, newumask, NULL, NULL,
484 infdptr, outfdptr, NULL, make_leader, purpose);
490 /*************************************************
491 * Close down child process *
492 *************************************************/
494 /* Wait for the given process to finish, with optional timeout.
497 pid: the pid to wait for
498 timeout: maximum time to wait; 0 means for as long as it takes
500 Returns: >= 0 process terminated by exiting; value is process
501 ending status; if an execve() failed, the value
502 is typically 127 (defined as EX_EXECFAILED)
503 < 0 & > -256 process was terminated by a signal; value is the
504 negation of the signal number
506 -257 other error in wait(); errno still set
510 child_close(pid_t pid, int timeout)
516 sigalrm_seen = FALSE;
523 pid_t rc = waitpid(pid, &status, 0);
526 int lowbyte = status & 255;
527 yield = lowbyte == 0 ? (status >> 8) & 255 : -lowbyte;
532 /* This "shouldn't happen" test does happen on MacOS: for some reason
533 I do not understand we seems to get an alarm signal despite not having
534 an active alarm set. There seems to be only one, so just go round again. */
536 if (errno == EINTR && sigalrm_seen && timeout <= 0) continue;
538 yield = (errno == EINTR && sigalrm_seen) ? -256 : -257;
543 if (timeout > 0) ALARM_CLR(0);
545 signal(SIGCHLD, oldsignal); /* restore */