c18n: Redirect vfork to fork and filter rfork flags

Some software like bmake calls sigaction after calling vfork which
corrupts RTLD's signal dispatch table. Securely supporting vfork under
c18n has proven a difficult task and this commit redirects vfork to fork
when c18n is enabled.

rfork may be used when the user intentionally wants vfork-like memory
sharing behaviour. Thus, only calling it with flags deemed to be 'safe'
is allowed under c18n, unless the call is made from libc (as part of the
implementation for posix_spawn).

This commit also partially reverts
50865cd by removing the execve(2) family
of functions from the list of trusted symbols.

lib/libc/aarch64/sys/Makefile.inc

@@ -6,8 +6,3 @@ SRCS+=	__vdso_gettc.c \
 MDASM=	cerror.S \
 	syscall.S \
 	vfork.S
-
-.ifdef RTLD_SANDBOX
-SRCS+=	thr_exit.c
-PSEUDO+=	_thr_exit.o
-.endif

lib/libc/gen/posix_spawn.c

@@ -327,8 +327,12 @@ do_posix_spawn(pid_t *pid, const char *path,
 	 */
 	p = rfork_thread(RFSPAWN, stack + stacksz, _posix_spawn_thr, &psa);
 	free(stack);
+#else
+#if defined(__CHERI_PURE_CAPABILITY__) && defined(RTLD_SANDBOX)
+	p = __sys_rfork(RFSPAWN);
 #else
 	p = rfork(RFSPAWN);
+#endif
 	if (p == 0)
 		/* _posix_spawn_thr does not return */
 		_posix_spawn_thr(&psa);

lib/libc/include/libc_private.h

@@ -462,6 +462,7 @@ struct __nl_cat_d *__catopen_l(const char *name, int type,
 	    struct _xlocale *locale);
 
 #if defined(__CHERI_PURE_CAPABILITY__) && defined(RTLD_SANDBOX)
+__pid_t		__sys_rfork(int);
 int	sigaction_c18n(int, const struct sigaction *, struct sigaction *);
 #endif
 

lib/libc/sys/Makefile.inc

@@ -46,6 +46,11 @@ SRCS+= POSIX2x_Fork.c
 
 SRCS+=	compat-stub.c
 
+.ifdef RTLD_SANDBOX
+SRCS+=	thr_exit_c18n.c	vfork_c18n.c	rfork_c18n.c
+NOASM+=	thr_exit.o
+.endif
+
 INTERPOSED = \
 	accept \
 	accept4 \

lib/libc/sys/rfork_c18n.c

@@ -0,0 +1,49 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2024 Dapeng Gao
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+
+#include <errno.h>
+#include <unistd.h>
+
+#include "libc_private.h"
+
+/*
+ * All rfork flags that do not cause memory-sharing between the child and the
+ * parent. Use a positive list to err on the safe side.
+ */
+#define RFFLAGS_SAFE						\
+	(RFPROC | RFNOWAIT | RFFDG | RFCFDG | RFTHREAD |	\
+	RFTSIGZMB | RFLINUXTHPN | RFTSIGFLAGS(RFTSIGMASK))
+
+pid_t rfork(int flags)
+{
+	if ((flags & RFFLAGS_SAFE) == flags)
+		return (__sys_rfork(flags));
+	errno = EINVAL;
+	return (-1);
+}

lib/libc/aarch64/sys/thr_exit.c → lib/libc/sys/thr_exit_c18n.c

@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#include <sys/types.h>
-
-void thr_exit(long *);
-
 void _rtld_thr_exit(long *);
 
 void

lib/libc/sys/vfork_c18n.c

@@ -0,0 +1,38 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2024 Dapeng Gao
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+
+#include "libc_private.h"
+
+pid_t vfork(void)
+{
+	/*
+	 * Call the raw syscall to avoid the interposing table.
+	 */
+	return (__sys_fork());
+}

libexec/rtld-elf/rtld_c18n_policy.txt

@@ -42,18 +42,6 @@ trust
 	_longjmp
 	sigsetjmp
 	siglongjmp
-	vfork
-	rfork
-	execve
-	fxecve
-	execl
-	execlp
-	execle
-	exect
-	execv
-	execvp
-	execvpe
-	execvP
 	_rtld_thread_start
 
 callee [RTLD]