mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-09-30 11:45:53 +00:00
macOS: harden volume discovery and FUSE-T teardown
Run display discovery asynchronously and bound batched disk-image inventory queries. Filter auxiliary mounts by basename, filesystem and owner, and keep unresolved candidates separate from verified volumes. Allow targeted dismounts despite incomplete discovery while requiring complete results for slot allocation and empty-inventory decisions. Use nonthrowing GUI snapshots with monotonic freshness, completion events and safe window lifetimes. Suspend inactivity decisions while the snapshot is stale, without restarting idle timers: activity counters are cumulative per volume instance. Refresh logout targets and retry only failed ones. Show a progress dialog for interactive unmounts, but keep automatic ones synchronous, so a quit or logout request that arrives meanwhile is handled afterwards rather than refused. Guard core operations against reentry and route wait-dialog requests only from worker threads, so a main-thread message cannot wait for itself. Bind teardown to captured mount and service identities, including process start time. Report a service exit that cannot be confirmed after auxiliary mount removal as a distinct error that keeps the original details. Such volumes are not retried, and a multi-volume unmount reports all of them together with any other failure or a declined prompt. Warn about it after automatic unmounts and at quit, and keep the background application until the warning is acknowledged. Keep rollback responsive, and let services remove their auxiliary directories without probing mounted paths. Preserve released /control compatibility and perform best-effort cleanup for older services. Reap bounded subprocesses as soon as their output ends. A child that survives SIGKILL is reaped by a later call, which starts no new child until then. Keep subjects and subprocess command, status and error output when formatting exceptions for wrapping and logs. Clarify discovery and rollback diagnostics. Fix the localization-dependent busy-volume regression assertion and extend discovery, snapshot, process identity, cleanup, GUI lifecycle, inactivity and teardown coverage.
This commit is contained in:
Mounir IDRASSI
@@ -17,17 +17,193 @@
|
||||
#include <sys/wait.h>
|
||||
#include "Process.h"
|
||||
#include "Platform/Exception.h"
|
||||
#include "Platform/Finally.h"
|
||||
#include "Platform/FileStream.h"
|
||||
#include "Platform/ForEach.h"
|
||||
#include "Platform/MemoryStream.h"
|
||||
#include "Platform/Mutex.h"
|
||||
#include "Platform/SystemException.h"
|
||||
#include "Platform/StringConverter.h"
|
||||
#include "Platform/Unix/Pipe.h"
|
||||
#include "Platform/Unix/Poller.h"
|
||||
#ifdef TC_MACOSX
|
||||
#include <chrono>
|
||||
#include <poll.h>
|
||||
#include <signal.h>
|
||||
#include <spawn.h>
|
||||
#include <crt_externs.h>
|
||||
#include <libproc.h>
|
||||
#endif
|
||||
|
||||
namespace VeraCrypt
|
||||
{
|
||||
|
||||
#ifdef TC_MACOSX
|
||||
uint64 Process::GetProcessStartTime (pid_t processId)
|
||||
{
|
||||
struct proc_bsdinfo info;
|
||||
if (proc_pidinfo (processId, PROC_PIDTBSDINFO, 0, &info, sizeof (info)) != sizeof (info))
|
||||
return 0;
|
||||
return info.pbi_start_tvsec * 1000000ULL + info.pbi_start_tvusec;
|
||||
}
|
||||
|
||||
bool Process::IsProcessRunning (pid_t processId, uint64 expectedStartTime)
|
||||
{
|
||||
if (processId <= 1) throw ParameterIncorrect (SRC_POS);
|
||||
if (kill (processId, 0) == -1 && errno == ESRCH) return false;
|
||||
uint64 startTime = expectedStartTime ? GetProcessStartTime (processId) : 0;
|
||||
// An inaccessible process remains pending. Only absence or a positively
|
||||
// identified replacement proves that the captured instance has exited.
|
||||
return !expectedStartTime || !startTime || startTime == expectedStartTime;
|
||||
}
|
||||
|
||||
// Bounded children that survived SIGKILL, such as a child in uninterruptible
|
||||
// sleep. Later calls reap them and start no new child until then, so repeated
|
||||
// timeouts cannot accumulate stuck children or zombies. Never destroyed: a
|
||||
// detached discovery worker may still run during static destruction.
|
||||
static Mutex &GetAbandonedChildrenMutex ()
|
||||
{
|
||||
static Mutex *mutex = new Mutex;
|
||||
return *mutex;
|
||||
}
|
||||
|
||||
static vector <pid_t> &GetAbandonedChildren ()
|
||||
{
|
||||
static vector <pid_t> *children = new vector <pid_t>;
|
||||
return *children;
|
||||
}
|
||||
|
||||
string Process::ExecuteBounded (const string &processName, const list <string> &arguments, int timeOut, size_t outputLimit)
|
||||
{
|
||||
if (processName.empty() || processName[0] != '/' || timeOut <= 0 || outputLimit == 0)
|
||||
throw ParameterIncorrect (SRC_POS);
|
||||
|
||||
{
|
||||
ScopeLock lock (GetAbandonedChildrenMutex());
|
||||
vector <pid_t> &children = GetAbandonedChildren();
|
||||
for (size_t i = 0; i < children.size(); )
|
||||
{
|
||||
pid_t waited = waitpid (children[i], NULL, WNOHANG);
|
||||
if (waited == 0 || (waited == -1 && errno == EINTR))
|
||||
++i;
|
||||
else
|
||||
children.erase (children.begin() + i);
|
||||
}
|
||||
if (!children.empty())
|
||||
throw TimeOut (SRC_POS, StringConverter::ToWide (processName));
|
||||
}
|
||||
|
||||
const auto deadline = chrono::steady_clock::now() + chrono::milliseconds (timeOut);
|
||||
int descriptors[4] = { -1, -1, -1, -1 };
|
||||
finally_do_arg (int *, descriptors, { for (int i = 0; i < 4; ++i) if (finally_arg[i] != -1) close (finally_arg[i]); });
|
||||
throw_sys_if (pipe (descriptors) != 0);
|
||||
throw_sys_if (pipe (descriptors + 2) != 0);
|
||||
for (int i = 0; i < 4; ++i)
|
||||
throw_sys_if (fcntl (descriptors[i], F_SETFD, FD_CLOEXEC) == -1);
|
||||
for (int i = 0; i < 4; i += 2)
|
||||
throw_sys_if (fcntl (descriptors[i], F_SETFL, O_NONBLOCK) == -1);
|
||||
|
||||
posix_spawn_file_actions_t actions;
|
||||
int error = posix_spawn_file_actions_init (&actions);
|
||||
if (error) throw SystemException (SRC_POS, error);
|
||||
finally_do_arg (posix_spawn_file_actions_t *, &actions, { posix_spawn_file_actions_destroy (finally_arg); });
|
||||
posix_spawnattr_t attributes;
|
||||
error = posix_spawnattr_init (&attributes);
|
||||
if (error) throw SystemException (SRC_POS, error);
|
||||
finally_do_arg (posix_spawnattr_t *, &attributes, { posix_spawnattr_destroy (finally_arg); });
|
||||
// Avoid fork-side library calls and leaking service/key-bearing descriptors
|
||||
// when discovery runs on the GUI's worker thread.
|
||||
if ((error = posix_spawnattr_setflags (&attributes, POSIX_SPAWN_CLOEXEC_DEFAULT))
|
||||
|| (error = posix_spawn_file_actions_addopen (&actions, STDIN_FILENO, "/dev/null", O_RDONLY, 0))
|
||||
|| (error = posix_spawn_file_actions_adddup2 (&actions, descriptors[1], STDOUT_FILENO))
|
||||
|| (error = posix_spawn_file_actions_adddup2 (&actions, descriptors[3], STDERR_FILENO)))
|
||||
throw SystemException (SRC_POS, error);
|
||||
|
||||
vector <char *> args;
|
||||
args.push_back (const_cast <char *> (processName.c_str()));
|
||||
for (const string &argument : arguments)
|
||||
args.push_back (const_cast <char *> (argument.c_str()));
|
||||
args.push_back (nullptr);
|
||||
pid_t child;
|
||||
error = posix_spawn (&child, processName.c_str(), &actions, &attributes, &args[0], *_NSGetEnviron());
|
||||
if (error) throw SystemException (SRC_POS, error);
|
||||
finally_do_arg (pid_t *, &child, {
|
||||
if (*finally_arg > 0)
|
||||
{
|
||||
// This is our unreaped child, never a PID recovered from metadata.
|
||||
// A child in uninterruptible sleep cannot be reaped within the
|
||||
// deadline; leave it to a later call rather than blocking this one.
|
||||
kill (*finally_arg, SIGKILL);
|
||||
bool finished = false;
|
||||
for (int attempt = 0; attempt < 100 && !finished; ++attempt)
|
||||
{
|
||||
pid_t waited = waitpid (*finally_arg, NULL, WNOHANG);
|
||||
finished = waited == *finally_arg || (waited == -1 && errno != EINTR);
|
||||
if (!finished)
|
||||
poll (nullptr, 0, 10);
|
||||
}
|
||||
if (!finished)
|
||||
{
|
||||
ScopeLock lock (GetAbandonedChildrenMutex());
|
||||
GetAbandonedChildren().push_back (*finally_arg);
|
||||
}
|
||||
}
|
||||
});
|
||||
close (descriptors[1]); descriptors[1] = -1;
|
||||
close (descriptors[3]); descriptors[3] = -1;
|
||||
struct pollfd fds[2] = { { descriptors[0], POLLIN, 0 }, { descriptors[2], POLLIN, 0 } };
|
||||
string output[2];
|
||||
int status = 0;
|
||||
int exitPoll = 1;
|
||||
while (child > 0 || fds[0].fd != -1 || fds[1].fd != -1)
|
||||
{
|
||||
if (child > 0)
|
||||
{
|
||||
pid_t waited = waitpid (child, &status, WNOHANG);
|
||||
if (waited == child) child = -1;
|
||||
else if (waited == -1 && errno != EINTR)
|
||||
{
|
||||
if (errno == ECHILD) child = -1;
|
||||
throw SystemException (SRC_POS);
|
||||
}
|
||||
}
|
||||
if (child == -1 && fds[0].fd == -1 && fds[1].fd == -1)
|
||||
break;
|
||||
auto remaining = chrono::duration_cast <chrono::milliseconds> (deadline - chrono::steady_clock::now()).count();
|
||||
if (remaining <= 0) throw TimeOut (SRC_POS, StringConverter::ToWide (processName));
|
||||
int pollTimeout = static_cast <int> (remaining < 50 ? remaining : 50);
|
||||
if (fds[0].fd == -1 && fds[1].fd == -1)
|
||||
{
|
||||
// Output is complete and the exit status normally follows at once.
|
||||
// Do not sleep a whole output-poll interval before reaping it.
|
||||
if (exitPoll < pollTimeout) pollTimeout = exitPoll;
|
||||
exitPoll = exitPoll < 25 ? exitPoll * 2 : 50;
|
||||
}
|
||||
int result = poll (fds, 2, pollTimeout);
|
||||
if (result == -1 && errno == EINTR) continue;
|
||||
throw_sys_if (result == -1);
|
||||
for (int i = 0; i < 2; ++i)
|
||||
{
|
||||
if (fds[i].fd == -1 || !fds[i].revents) continue;
|
||||
char buffer[8192];
|
||||
ssize_t count = read (fds[i].fd, buffer, sizeof (buffer));
|
||||
if (count > 0)
|
||||
{
|
||||
if (static_cast <size_t> (count) > outputLimit - output[0].size() - output[1].size())
|
||||
throw ParameterTooLarge (SRC_POS);
|
||||
output[i].append (buffer, count);
|
||||
}
|
||||
else if (count == 0) fds[i].fd = -1;
|
||||
else if (errno != EINTR && errno != EAGAIN) throw SystemException (SRC_POS);
|
||||
}
|
||||
}
|
||||
int exitCode = WIFEXITED (status) ? WEXITSTATUS (status) : 1;
|
||||
if (exitCode != 0)
|
||||
throw ExecutedProcessFailed (SRC_POS, processName, exitCode, output[1]);
|
||||
return output[0];
|
||||
}
|
||||
#endif
|
||||
|
||||
bool Process::IsExecutable(const std::string& path) {
|
||||
struct stat sb;
|
||||
if (stat(path.c_str(), &sb) == 0) {
|
||||
|
||||
Reference in New Issue
Block a user