|
 |
beb317 |
From 5c63b463b87d3c06102a4a7f05f395929d9ea79b Mon Sep 17 00:00:00 2001
|
|
|
beb317 |
From: DJ Delorie <dj@delorie.com>
|
|
|
beb317 |
Date: Wed, 2 Dec 2020 16:14:27 -0500
|
|
|
beb317 |
Subject: Use memfd_create() (#604)
|
|
|
beb317 |
|
|
|
beb317 |
memfd_create creates a file in a memory-only filesystem that may
|
|
|
beb317 |
bypass strict security protocols in filesystem-based temporary
|
|
|
beb317 |
files.
|
|
|
beb317 |
|
|
|
beb317 |
diff -rup a/configure.ac b/configure.ac
|
|
|
beb317 |
--- a/configure.ac 2014-05-11 09:57:49.000000000 -0400
|
|
|
beb317 |
+++ b/configure.ac 2021-11-03 17:41:31.935391831 -0400
|
|
|
beb317 |
@@ -63,6 +63,9 @@ EOF
|
|
|
beb317 |
|
|
|
beb317 |
AM_MAINTAINER_MODE
|
|
|
beb317 |
|
|
|
beb317 |
+AC_CHECK_HEADERS(sys/memfd.h)
|
|
|
beb317 |
+AC_CHECK_FUNCS([memfd_create])
|
|
|
beb317 |
+
|
|
|
beb317 |
AC_CHECK_HEADERS(sys/mman.h)
|
|
|
beb317 |
AC_CHECK_FUNCS(mmap)
|
|
|
beb317 |
AC_FUNC_MMAP_BLACKLIST
|
|
|
beb317 |
diff -rup a/configure b/configure
|
|
|
beb317 |
--- a/configure 2014-05-19 09:44:03.000000000 -0400
|
|
|
beb317 |
+++ b/configure 2021-11-18 17:29:45.484951520 -0500
|
|
|
beb317 |
@@ -16976,6 +16976,30 @@ fi
|
|
|
beb317 |
|
|
|
beb317 |
|
|
|
beb317 |
|
|
|
beb317 |
+for ac_header in sys/memfd.h
|
|
|
beb317 |
+do :
|
|
|
beb317 |
+ ac_fn_c_check_header_mongrel "$LINENO" "sys/memfd.h" "ac_cv_header_sys_memfd_h" "$ac_includes_default"
|
|
|
beb317 |
+if test "x$ac_cv_header_sys_memfd_h" = xyes; then :
|
|
|
beb317 |
+ cat >>confdefs.h <<_ACEOF
|
|
|
beb317 |
+#define HAVE_SYS_MEMFD_H 1
|
|
|
beb317 |
+_ACEOF
|
|
|
beb317 |
+
|
|
|
beb317 |
+fi
|
|
|
beb317 |
+
|
|
|
beb317 |
+done
|
|
|
beb317 |
+
|
|
|
beb317 |
+for ac_func in memfd_create
|
|
|
beb317 |
+do :
|
|
|
beb317 |
+ ac_fn_c_check_func "$LINENO" "memfd_create" "ac_cv_func_memfd_create"
|
|
|
beb317 |
+if test "x$ac_cv_func_memfd_create" = xyes; then :
|
|
|
beb317 |
+ cat >>confdefs.h <<_ACEOF
|
|
|
beb317 |
+#define HAVE_MEMFD_CREATE 1
|
|
|
beb317 |
+_ACEOF
|
|
|
beb317 |
+
|
|
|
beb317 |
+fi
|
|
|
beb317 |
+done
|
|
|
beb317 |
+
|
|
|
beb317 |
+
|
|
|
beb317 |
for ac_header in sys/mman.h
|
|
|
beb317 |
do :
|
|
|
beb317 |
ac_fn_c_check_header_mongrel "$LINENO" "sys/mman.h" "ac_cv_header_sys_mman_h" "$ac_includes_default"
|
|
|
beb317 |
diff -rup a/fficonfig.h.in b/fficonfig.h.in
|
|
|
beb317 |
--- a/fficonfig.h.in 2014-05-19 09:44:04.000000000 -0400
|
|
|
beb317 |
+++ b/fficonfig.h.in 2021-11-18 17:45:39.000000000 -0500
|
|
|
beb317 |
@@ -79,6 +79,9 @@
|
|
|
beb317 |
/* Define to 1 if you have the `memcpy' function. */
|
|
|
beb317 |
#undef HAVE_MEMCPY
|
|
|
beb317 |
|
|
|
beb317 |
+/* Define to 1 if you have the `memfd_create' function. */
|
|
|
beb317 |
+#undef HAVE_MEMFD_CREATE
|
|
|
beb317 |
+
|
|
|
beb317 |
/* Define to 1 if you have the <memory.h> header file. */
|
|
|
beb317 |
#undef HAVE_MEMORY_H
|
|
|
beb317 |
|
|
|
beb317 |
@@ -109,6 +112,9 @@
|
|
|
beb317 |
/* Define to 1 if you have the <string.h> header file. */
|
|
|
beb317 |
#undef HAVE_STRING_H
|
|
|
beb317 |
|
|
|
beb317 |
+/* Define to 1 if you have the <sys/memfd.h> header file. */
|
|
|
beb317 |
+#undef HAVE_SYS_MEMFD_H
|
|
|
beb317 |
+
|
|
|
beb317 |
/* Define to 1 if you have the <sys/mman.h> header file. */
|
|
|
beb317 |
#undef HAVE_SYS_MMAN_H
|
|
|
beb317 |
|
|
|
beb317 |
diff -rup a/src/closures.c b/src/closures.c
|
|
|
beb317 |
--- a/src/closures.c 2021-11-03 17:37:37.841416436 -0400
|
|
|
beb317 |
+++ b/src/closures.c 2021-11-03 17:43:19.027498783 -0400
|
|
|
beb317 |
@@ -117,6 +117,9 @@
|
|
|
beb317 |
#endif /* HAVE_MNTENT */
|
|
|
beb317 |
#include <sys/param.h>
|
|
|
beb317 |
#include <pthread.h>
|
|
|
beb317 |
+#ifdef HAVE_SYS_MEMFD_H
|
|
|
beb317 |
+#include <sys/memfd.h>
|
|
|
beb317 |
+#endif
|
|
|
beb317 |
|
|
|
beb317 |
/* We don't want sys/mman.h to be included after we redefine mmap and
|
|
|
beb317 |
dlmunmap. */
|
|
|
beb317 |
@@ -263,6 +266,17 @@ static int execfd = -1;
|
|
|
beb317 |
/* The amount of space already allocated from the temporary file. */
|
|
|
beb317 |
static size_t execsize = 0;
|
|
|
beb317 |
|
|
|
beb317 |
+#ifdef HAVE_MEMFD_CREATE
|
|
|
beb317 |
+/* Open a temporary file name, and immediately unlink it. */
|
|
|
beb317 |
+static int
|
|
|
beb317 |
+open_temp_exec_file_memfd (const char *name)
|
|
|
beb317 |
+{
|
|
|
beb317 |
+ int fd;
|
|
|
beb317 |
+ fd = memfd_create (name, MFD_CLOEXEC);
|
|
|
beb317 |
+ return fd;
|
|
|
beb317 |
+}
|
|
|
beb317 |
+#endif
|
|
|
beb317 |
+
|
|
|
beb317 |
/* Open a temporary file name, and immediately unlink it. */
|
|
|
beb317 |
static int
|
|
|
beb317 |
open_temp_exec_file_name (char *name, int flags)
|
|
|
beb317 |
@@ -382,6 +396,9 @@ static struct
|
|
|
beb317 |
const char *arg;
|
|
|
beb317 |
int repeat;
|
|
|
beb317 |
} open_temp_exec_file_opts[] = {
|
|
|
beb317 |
+#ifdef HAVE_MEMFD_CREATE
|
|
|
beb317 |
+ { open_temp_exec_file_memfd, "libffi", 0 },
|
|
|
beb317 |
+#endif
|
|
|
beb317 |
{ open_temp_exec_file_env, "LIBFFI_TMPDIR", 0 },
|
|
|
beb317 |
{ open_temp_exec_file_env, "TMPDIR", 0 },
|
|
|
beb317 |
{ open_temp_exec_file_dir, "/tmp", 0 },
|