/*

 * Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 *

 */

#include "precompiled.hpp"

#include "classfile/vmSymbols.hpp"

#include "logging/log.hpp"

#include "memory/allocation.inline.hpp"

#include "memory/resourceArea.hpp"

#include "oops/oop.inline.hpp"

#include "os_bsd.inline.hpp"

#include "runtime/handles.inline.hpp"

#include "runtime/os.hpp"

#include "runtime/perfMemory.hpp"

#include "services/memTracker.hpp"

#include "utilities/exceptions.hpp"

// put OS-includes here

# include <sys/types.h>

# include <sys/mman.h>

# include <errno.h>

# include <stdio.h>

# include <unistd.h>

# include <sys/stat.h>

# include <signal.h>

# include <pwd.h>

static char* backing_store_file_name = NULL;  // name of the backing store

                                              // file, if successfully created.

// Standard Memory Implementation Details

// create the PerfData memory region in standard memory.

//

static char* create_standard_memory(size_t size) {

  // allocate an aligned chuck of memory

  char* mapAddress = os::reserve_memory(size);

  if (mapAddress == NULL) {

    return NULL;

  }

  // commit memory

  if (!os::commit_memory(mapAddress, size, !ExecMem)) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not commit PerfData memory\n");

    }

    os::release_memory(mapAddress, size);

    return NULL;

  }

  return mapAddress;

}

// delete the PerfData memory region

//

static void delete_standard_memory(char* addr, size_t size) {

  // there are no persistent external resources to cleanup for standard

  // memory. since DestroyJavaVM does not support unloading of the JVM,

  // cleanup of the memory resource is not performed. The memory will be

  // reclaimed by the OS upon termination of the process.

  //

  return;

}

// save the specified memory region to the given file

//

// Note: this function might be called from signal handler (by os::abort()),

// don't allocate heap memory.

//

static void save_memory_to_file(char* addr, size_t size) {

 const char* destfile = PerfMemory::get_perfdata_file_path();

 assert(destfile[0] != '\0', "invalid PerfData file path");

  int result;

  RESTARTABLE(::open(destfile, O_CREAT|O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE),

              result);;

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not create Perfdata save file: %s: %s\n",

              destfile, os::strerror(errno));

    }

  } else {

    int fd = result;

    for (size_t remaining = size; remaining > 0;) {

      RESTARTABLE(::write(fd, addr, remaining), result);

      if (result == OS_ERR) {

        if (PrintMiscellaneous && Verbose) {

          warning("Could not write Perfdata save file: %s: %s\n",

                  destfile, os::strerror(errno));

        }

        break;

      }

      remaining -= (size_t)result;

      addr += result;

    }

    result = ::close(fd);

    if (PrintMiscellaneous && Verbose) {

      if (result == OS_ERR) {

        warning("Could not close %s: %s\n", destfile, os::strerror(errno));

      }

    }

  }

  FREE_C_HEAP_ARRAY(char, destfile);

}

// Shared Memory Implementation Details

// Note: the solaris and bsd shared memory implementation uses the mmap

// interface with a backing store file to implement named shared memory.

// Using the file system as the name space for shared memory allows a

// common name space to be supported across a variety of platforms. It

// also provides a name space that Java applications can deal with through

// simple file apis.

//

// The solaris and bsd implementations store the backing store file in

// a user specific temporary directory located in the /tmp file system,

// which is always a local file system and is sometimes a RAM based file

// system.

// return the user specific temporary directory name.

//

// the caller is expected to free the allocated memory.

//

static char* get_user_tmp_dir(const char* user) {

  const char* tmpdir = os::get_temp_directory();

  const char* perfdir = PERFDATA_NAME;

  size_t nbytes = strlen(tmpdir) + strlen(perfdir) + strlen(user) + 3;

  char* dirname = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

  // construct the path name to user specific tmp directory

  snprintf(dirname, nbytes, "%s/%s_%s", tmpdir, perfdir, user);

  return dirname;

}

// convert the given file name into a process id. if the file

// does not meet the file naming constraints, return 0.

//

static pid_t filename_to_pid(const char* filename) {

  // a filename that doesn't begin with a digit is not a

  // candidate for conversion.

  //

  if (!isdigit(*filename)) {

    return 0;

  }

  // check if file name can be converted to an integer without

  // any leftover characters.

  //

  char* remainder = NULL;

  errno = 0;

  pid_t pid = (pid_t)strtol(filename, &remainder, 10);

  if (errno != 0) {

    return 0;

  }

  // check for left over characters. If any, then the filename is

  // not a candidate for conversion.

  //

  if (remainder != NULL && *remainder != '\0') {

    return 0;

  }

  // successful conversion, return the pid

  return pid;

}

// Check if the given statbuf is considered a secure directory for

// the backing store files. Returns true if the directory is considered

// a secure location. Returns false if the statbuf is a symbolic link or

// if an error occurred.

//

static bool is_statbuf_secure(struct stat *statp) {

  if (S_ISLNK(statp->st_mode) || !S_ISDIR(statp->st_mode)) {

    // The path represents a link or some non-directory file type,

    // which is not what we expected. Declare it insecure.

    //

    return false;

  }

  // We have an existing directory, check if the permissions are safe.

  //

  if ((statp->st_mode & (S_IWGRP|S_IWOTH)) != 0) {

    // The directory is open for writing and could be subjected

    // to a symlink or a hard link attack. Declare it insecure.

    //

    return false;

  }

  // If user is not root then see if the uid of the directory matches the effective uid of the process.

  uid_t euid = geteuid();

  if ((euid != 0) && (statp->st_uid != euid)) {

    // The directory was not created by this user, declare it insecure.

    //

    return false;

  }

  return true;

}

// Check if the given path is considered a secure directory for

// the backing store files. Returns true if the directory exists

// and is considered a secure location. Returns false if the path

// is a symbolic link or if an error occurred.

//

static bool is_directory_secure(const char* path) {

  struct stat statbuf;

  int result = 0;

  RESTARTABLE(::lstat(path, &statbuf), result);

  if (result == OS_ERR) {

    return false;

  }

  // The path exists, see if it is secure.

  return is_statbuf_secure(&statbuf);

}

// Check if the given directory file descriptor is considered a secure

// directory for the backing store files. Returns true if the directory

// exists and is considered a secure location. Returns false if the path

// is a symbolic link or if an error occurred.

//

static bool is_dirfd_secure(int dir_fd) {

  struct stat statbuf;

  int result = 0;

  RESTARTABLE(::fstat(dir_fd, &statbuf), result);

  if (result == OS_ERR) {

    return false;

  }

  // The path exists, now check its mode.

  return is_statbuf_secure(&statbuf);

}

// Check to make sure fd1 and fd2 are referencing the same file system object.

//

static bool is_same_fsobject(int fd1, int fd2) {

  struct stat statbuf1;

  struct stat statbuf2;

  int result = 0;

  RESTARTABLE(::fstat(fd1, &statbuf1), result);

  if (result == OS_ERR) {

    return false;

  }

  RESTARTABLE(::fstat(fd2, &statbuf2), result);

  if (result == OS_ERR) {

    return false;

  }

  if ((statbuf1.st_ino == statbuf2.st_ino) &&

      (statbuf1.st_dev == statbuf2.st_dev)) {

    return true;

  } else {

    return false;

  }

}

// Open the directory of the given path and validate it.

// Return a DIR * of the open directory.

//

static DIR *open_directory_secure(const char* dirname) {

  // Open the directory using open() so that it can be verified

  // to be secure by calling is_dirfd_secure(), opendir() and then check

  // to see if they are the same file system object.  This method does not

  // introduce a window of opportunity for the directory to be attacked that

  // calling opendir() and is_directory_secure() does.

  int result;

  DIR *dirp = NULL;

  RESTARTABLE(::open(dirname, O_RDONLY|O_NOFOLLOW), result);

  if (result == OS_ERR) {

    // Directory doesn't exist or is a symlink, so there is nothing to cleanup.

    if (PrintMiscellaneous && Verbose) {

      if (errno == ELOOP) {

        warning("directory %s is a symlink and is not secure\n", dirname);

      } else {

        warning("could not open directory %s: %s\n", dirname, os::strerror(errno));

      }

    }

    return dirp;

  }

  int fd = result;

  // Determine if the open directory is secure.

  if (!is_dirfd_secure(fd)) {

    // The directory is not a secure directory.

    os::close(fd);

    return dirp;

  }

  // Open the directory.

  dirp = ::opendir(dirname);

  if (dirp == NULL) {

    // The directory doesn't exist, close fd and return.

    os::close(fd);

    return dirp;

  }

  // Check to make sure fd and dirp are referencing the same file system object.

  if (!is_same_fsobject(fd, dirfd(dirp))) {

    // The directory is not secure.

    os::close(fd);

    os::closedir(dirp);

    dirp = NULL;

    return dirp;

  }

  // Close initial open now that we know directory is secure

  os::close(fd);

  return dirp;

}

// NOTE: The code below uses fchdir(), open() and unlink() because

// fdopendir(), openat() and unlinkat() are not supported on all

// versions.  Once the support for fdopendir(), openat() and unlinkat()

// is available on all supported versions the code can be changed

// to use these functions.

// Open the directory of the given path, validate it and set the

// current working directory to it.

// Return a DIR * of the open directory and the saved cwd fd.

//

static DIR *open_directory_secure_cwd(const char* dirname, int *saved_cwd_fd) {

  // Open the directory.

  DIR* dirp = open_directory_secure(dirname);

  if (dirp == NULL) {

    // Directory doesn't exist or is insecure, so there is nothing to cleanup.

    return dirp;

  }

  int fd = dirfd(dirp);

  // Open a fd to the cwd and save it off.

  int result;

  RESTARTABLE(::open(".", O_RDONLY), result);

  if (result == OS_ERR) {

    *saved_cwd_fd = -1;

  } else {

    *saved_cwd_fd = result;

  }

  // Set the current directory to dirname by using the fd of the directory and

  // handle errors, otherwise shared memory files will be created in cwd.

  result = fchdir(fd);

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("could not change to directory %s", dirname);

    }

    if (*saved_cwd_fd != -1) {

      ::close(*saved_cwd_fd);

      *saved_cwd_fd = -1;

    }

    // Close the directory.

    os::closedir(dirp);

    return NULL;

  } else {

    return dirp;

  }

}

// Close the directory and restore the current working directory.

//

static void close_directory_secure_cwd(DIR* dirp, int saved_cwd_fd) {

  int result;

  // If we have a saved cwd change back to it and close the fd.

  if (saved_cwd_fd != -1) {

    result = fchdir(saved_cwd_fd);

    ::close(saved_cwd_fd);

  }

  // Close the directory.

  os::closedir(dirp);

}

// Check if the given file descriptor is considered a secure.

//

static bool is_file_secure(int fd, const char *filename) {

  int result;

  struct stat statbuf;

  // Determine if the file is secure.

  RESTARTABLE(::fstat(fd, &statbuf), result);

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("fstat failed on %s: %s\n", filename, os::strerror(errno));

    }

    return false;

  }

  if (statbuf.st_nlink > 1) {

    // A file with multiple links is not expected.

    if (PrintMiscellaneous && Verbose) {

      warning("file %s has multiple links\n", filename);

    }

    return false;

  }

  return true;

}

// return the user name for the given user id

//

// the caller is expected to free the allocated memory.

//

static char* get_user_name(uid_t uid) {

  struct passwd pwent;

  // determine the max pwbuf size from sysconf, and hardcode

  // a default if this not available through sysconf.

  //

  long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);

  if (bufsize == -1)

    bufsize = 1024;

  char* pwbuf = NEW_C_HEAP_ARRAY(char, bufsize, mtInternal);

  // POSIX interface to getpwuid_r is used on LINUX

  struct passwd* p;

  int result = getpwuid_r(uid, &pwent, pwbuf, (size_t)bufsize, &p);

  if (result != 0 || p == NULL || p->pw_name == NULL || *(p->pw_name) == '\0') {

    if (PrintMiscellaneous && Verbose) {

      if (result != 0) {

        warning("Could not retrieve passwd entry: %s\n",

                os::strerror(result));

      }

      else if (p == NULL) {

        // this check is added to protect against an observed problem

        // with getpwuid_r() on RedHat 9 where getpwuid_r returns 0,

        // indicating success, but has p == NULL. This was observed when

        // inserting a file descriptor exhaustion fault prior to the call

        // getpwuid_r() call. In this case, error is set to the appropriate

        // error condition, but this is undocumented behavior. This check

        // is safe under any condition, but the use of errno in the output

        // message may result in an erroneous message.

        // Bug Id 89052 was opened with RedHat.

        //

        warning("Could not retrieve passwd entry: %s\n",

                os::strerror(errno));

      }

      else {

        warning("Could not determine user name: %s\n",

                p->pw_name == NULL ? "pw_name = NULL" :

                                     "pw_name zero length");

      }

    }

    FREE_C_HEAP_ARRAY(char, pwbuf);

    return NULL;

  }

  char* user_name = NEW_C_HEAP_ARRAY(char, strlen(p->pw_name) + 1, mtInternal);

  strcpy(user_name, p->pw_name);

  FREE_C_HEAP_ARRAY(char, pwbuf);

  return user_name;

}

// return the name of the user that owns the process identified by vmid.

//

// This method uses a slow directory search algorithm to find the backing

// store file for the specified vmid and returns the user name, as determined

// by the user name suffix of the hsperfdata_<username> directory name.

//

// the caller is expected to free the allocated memory.

//

static char* get_user_name_slow(int vmid, TRAPS) {

  // short circuit the directory search if the process doesn't even exist.

  if (kill(vmid, 0) == OS_ERR) {

    if (errno == ESRCH) {