1 /*

     2  * Copyright (c) 2001, 2017, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  *

    23  */

    24 

    25 #include "precompiled.hpp"

    26 #include "classfile/vmSymbols.hpp"

    27 #include "logging/log.hpp"

    28 #include "memory/allocation.inline.hpp"

    29 #include "memory/resourceArea.hpp"

    30 #include "oops/oop.inline.hpp"

    31 #include "os_windows.inline.hpp"

    32 #include "runtime/handles.inline.hpp"

    33 #include "runtime/os.hpp"

    34 #include "runtime/perfMemory.hpp"

    35 #include "services/memTracker.hpp"

    36 #include "utilities/exceptions.hpp"

    37 

    38 #include <windows.h>

    39 #include <sys/types.h>

    40 #include <sys/stat.h>

    41 #include <errno.h>

    42 #include <lmcons.h>

    43 

    44 typedef BOOL (WINAPI *SetSecurityDescriptorControlFnPtr)(

    45    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,

    46    IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,

    47    IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet);

    48 

    49 // Standard Memory Implementation Details

    50 

    51 // create the PerfData memory region in standard memory.

    52 //

    53 static char* create_standard_memory(size_t size) {

    54 

    55   // allocate an aligned chuck of memory

    56   char* mapAddress = os::reserve_memory(size);

    57 

    58   if (mapAddress == NULL) {

    59     return NULL;

    60   }

    61 

    62   // commit memory

    63   if (!os::commit_memory(mapAddress, size, !ExecMem)) {

    64     if (PrintMiscellaneous && Verbose) {

    65       warning("Could not commit PerfData memory\n");

    66     }

    67     os::release_memory(mapAddress, size);

    68     return NULL;

    69   }

    70 

    71   return mapAddress;

    72 }

    73 

    74 // delete the PerfData memory region

    75 //

    76 static void delete_standard_memory(char* addr, size_t size) {

    77 

    78   // there are no persistent external resources to cleanup for standard

    79   // memory. since DestroyJavaVM does not support unloading of the JVM,

    80   // cleanup of the memory resource is not performed. The memory will be

    81   // reclaimed by the OS upon termination of the process.

    82   //

    83   return;

    84 

    85 }

    86 

    87 // save the specified memory region to the given file

    88 //

    89 static void save_memory_to_file(char* addr, size_t size) {

    90 

    91   const char* destfile = PerfMemory::get_perfdata_file_path();

    92   assert(destfile[0] != '\0', "invalid Perfdata file path");

    93 

    94   int fd = ::_open(destfile, _O_BINARY|_O_CREAT|_O_WRONLY|_O_TRUNC,

    95                    _S_IREAD|_S_IWRITE);

    96 

    97   if (fd == OS_ERR) {

    98     if (PrintMiscellaneous && Verbose) {

    99       warning("Could not create Perfdata save file: %s: %s\n",

   100               destfile, os::strerror(errno));

   101     }

   102   } else {

   103     for (size_t remaining = size; remaining > 0;) {

   104 

   105       int nbytes = ::_write(fd, addr, (unsigned int)remaining);

   106       if (nbytes == OS_ERR) {

   107         if (PrintMiscellaneous && Verbose) {

   108           warning("Could not write Perfdata save file: %s: %s\n",

   109                   destfile, os::strerror(errno));

   110         }

   111         break;

   112       }

   113 

   114       remaining -= (size_t)nbytes;

   115       addr += nbytes;

   116     }

   117 

   118     int result = ::_close(fd);

   119     if (PrintMiscellaneous && Verbose) {

   120       if (result == OS_ERR) {

   121         warning("Could not close %s: %s\n", destfile, os::strerror(errno));

   122       }

   123     }

   124   }

   125 

   126   FREE_C_HEAP_ARRAY(char, destfile);

   127 }

   128 

   129 // Shared Memory Implementation Details

   130 

   131 // Note: the win32 shared memory implementation uses two objects to represent

   132 // the shared memory: a windows kernel based file mapping object and a backing

   133 // store file. On windows, the name space for shared memory is a kernel

   134 // based name space that is disjoint from other win32 name spaces. Since Java

   135 // is unaware of this name space, a parallel file system based name space is

   136 // maintained, which provides a common file system based shared memory name

   137 // space across the supported platforms and one that Java apps can deal with

   138 // through simple file apis.

   139 //

   140 // For performance and resource cleanup reasons, it is recommended that the

   141 // user specific directory and the backing store file be stored in either a

   142 // RAM based file system or a local disk based file system. Network based

   143 // file systems are not recommended for performance reasons. In addition,

   144 // use of SMB network based file systems may result in unsuccesful cleanup

   145 // of the disk based resource on exit of the VM. The Windows TMP and TEMP

   146 // environement variables, as used by the GetTempPath() Win32 API (see

   147 // os::get_temp_directory() in os_win32.cpp), control the location of the

   148 // user specific directory and the shared memory backing store file.

   149 

   150 static HANDLE sharedmem_fileMapHandle = NULL;

   151 static HANDLE sharedmem_fileHandle = INVALID_HANDLE_VALUE;

   152 static char*  sharedmem_fileName = NULL;

   153 

   154 // return the user specific temporary directory name.

   155 //

   156 // the caller is expected to free the allocated memory.

   157 //

   158 static char* get_user_tmp_dir(const char* user) {

   159 

   160   const char* tmpdir = os::get_temp_directory();

   161   const char* perfdir = PERFDATA_NAME;

   162   size_t nbytes = strlen(tmpdir) + strlen(perfdir) + strlen(user) + 3;

   163   char* dirname = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

   164 

   165   // construct the path name to user specific tmp directory

   166   _snprintf(dirname, nbytes, "%s\\%s_%s", tmpdir, perfdir, user);

   167 

   168   return dirname;

   169 }

   170 

   171 // convert the given file name into a process id. if the file

   172 // does not meet the file naming constraints, return 0.

   173 //

   174 static int filename_to_pid(const char* filename) {

   175 

   176   // a filename that doesn't begin with a digit is not a

   177   // candidate for conversion.

   178   //

   179   if (!isdigit(*filename)) {

   180     return 0;

   181   }

   182 

   183   // check if file name can be converted to an integer without

   184   // any leftover characters.

   185   //

   186   char* remainder = NULL;

   187   errno = 0;

   188   int pid = (int)strtol(filename, &remainder, 10);

   189 

   190   if (errno != 0) {

   191     return 0;

   192   }

   193 

   194   // check for left over characters. If any, then the filename is

   195   // not a candidate for conversion.

   196   //

   197   if (remainder != NULL && *remainder != '\0') {

   198     return 0;

   199   }

   200 

   201   // successful conversion, return the pid

   202   return pid;

   203 }

   204 

   205 // check if the given path is considered a secure directory for

   206 // the backing store files. Returns true if the directory exists

   207 // and is considered a secure location. Returns false if the path

   208 // is a symbolic link or if an error occurred.

   209 //

   210 static bool is_directory_secure(const char* path) {

   211 

   212   DWORD fa;

   213 

   214   fa = GetFileAttributes(path);

   215   if (fa == 0xFFFFFFFF) {

   216     DWORD lasterror = GetLastError();

   217     if (lasterror == ERROR_FILE_NOT_FOUND) {

   218       return false;

   219     }

   220     else {

   221       // unexpected error, declare the path insecure

   222       if (PrintMiscellaneous && Verbose) {

   223         warning("could not get attributes for file %s: ",

   224                 " lasterror = %d\n", path, lasterror);

   225       }

   226       return false;

   227     }

   228   }

   229 

   230   if (fa & FILE_ATTRIBUTE_REPARSE_POINT) {

   231     // we don't accept any redirection for the user specific directory

   232     // so declare the path insecure. This may be too conservative,

   233     // as some types of reparse points might be acceptable, but it

   234     // is probably more secure to avoid these conditions.

   235     //

   236     if (PrintMiscellaneous && Verbose) {

   237       warning("%s is a reparse point\n", path);

   238     }

   239     return false;

   240   }

   241 

   242   if (fa & FILE_ATTRIBUTE_DIRECTORY) {

   243     // this is the expected case. Since windows supports symbolic

   244     // links to directories only, not to files, there is no need

   245     // to check for open write permissions on the directory. If the

   246     // directory has open write permissions, any files deposited that

   247     // are not expected will be removed by the cleanup code.

   248     //

   249     return true;

   250   }

   251   else {

   252     // this is either a regular file or some other type of file,

   253     // any of which are unexpected and therefore insecure.

   254     //

   255     if (PrintMiscellaneous && Verbose) {

   256       warning("%s is not a directory, file attributes = "

   257               INTPTR_FORMAT "\n", path, fa);

   258     }

   259     return false;

   260   }

   261 }

   262 

   263 // return the user name for the owner of this process

   264 //

   265 // the caller is expected to free the allocated memory.

   266 //

   267 static char* get_user_name() {

   268 

   269   /* get the user name. This code is adapted from code found in

   270    * the jdk in src/windows/native/java/lang/java_props_md.c

   271    * java_props_md.c  1.29 02/02/06. According to the original

   272    * source, the call to GetUserName is avoided because of a resulting

   273    * increase in footprint of 100K.

   274    */

   275   char* user = getenv("USERNAME");

   276   char buf[UNLEN+1];

   277   DWORD buflen = sizeof(buf);

   278   if (user == NULL || strlen(user) == 0) {

   279     if (GetUserName(buf, &buflen)) {

   280       user = buf;

   281     }

   282     else {

   283       return NULL;

   284     }

   285   }

   286 

   287   char* user_name = NEW_C_HEAP_ARRAY(char, strlen(user)+1, mtInternal);

   288   strcpy(user_name, user);

   289 

   290   return user_name;

   291 }

   292 

   293 // return the name of the user that owns the process identified by vmid.

   294 //

   295 // This method uses a slow directory search algorithm to find the backing

   296 // store file for the specified vmid and returns the user name, as determined

   297 // by the user name suffix of the hsperfdata_<username> directory name.

   298 //

   299 // the caller is expected to free the allocated memory.

   300 //

   301 static char* get_user_name_slow(int vmid) {

   302 

   303   // directory search

   304   char* latest_user = NULL;

   305   time_t latest_ctime = 0;

   306 

   307   const char* tmpdirname = os::get_temp_directory();

   308 

   309   DIR* tmpdirp = os::opendir(tmpdirname);

   310 

   311   if (tmpdirp == NULL) {

   312     return NULL;

   313   }

   314 

   315   // for each entry in the directory that matches the pattern hsperfdata_*,

   316   // open the directory and check if the file for the given vmid exists.

   317   // The file with the expected name and the latest creation date is used

   318   // to determine the user name for the process id.

   319   //

   320   struct dirent* dentry;

   321   char* tdbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(tmpdirname), mtInternal);

   322   errno = 0;

   323   while ((dentry = os::readdir(tmpdirp, (struct dirent *)tdbuf)) != NULL) {

   324 

   325     // check if the directory entry is a hsperfdata file

   326     if (strncmp(dentry->d_name, PERFDATA_NAME, strlen(PERFDATA_NAME)) != 0) {

   327       continue;

   328     }

   329 

   330     char* usrdir_name = NEW_C_HEAP_ARRAY(char,

   331         strlen(tmpdirname) + strlen(dentry->d_name) + 2, mtInternal);

   332     strcpy(usrdir_name, tmpdirname);

   333     strcat(usrdir_name, "\\");

   334     strcat(usrdir_name, dentry->d_name);

   335 

   336     DIR* subdirp = os::opendir(usrdir_name);

   337 

   338     if (subdirp == NULL) {

   339       FREE_C_HEAP_ARRAY(char, usrdir_name);

   340       continue;

   341     }

   342 

   343     // Since we don't create the backing store files in directories

   344     // pointed to by symbolic links, we also don't follow them when

   345     // looking for the files. We check for a symbolic link after the

   346     // call to opendir in order to eliminate a small window where the

   347     // symlink can be exploited.

   348     //

   349     if (!is_directory_secure(usrdir_name)) {

   350       FREE_C_HEAP_ARRAY(char, usrdir_name);

   351       os::closedir(subdirp);

   352       continue;

   353     }

   354 

   355     struct dirent* udentry;

   356     char* udbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(usrdir_name), mtInternal);

   357     errno = 0;

   358     while ((udentry = os::readdir(subdirp, (struct dirent *)udbuf)) != NULL) {

   359 

   360       if (filename_to_pid(udentry->d_name) == vmid) {

   361         struct stat statbuf;

   362 

   363         char* filename = NEW_C_HEAP_ARRAY(char,

   364            strlen(usrdir_name) + strlen(udentry->d_name) + 2, mtInternal);

   365 

   366         strcpy(filename, usrdir_name);

   367         strcat(filename, "\\");

   368         strcat(filename, udentry->d_name);

   369 

   370         if (::stat(filename, &statbuf) == OS_ERR) {

   371            FREE_C_HEAP_ARRAY(char, filename);

   372            continue;

   373         }

   374 

   375         // skip over files that are not regular files.

   376         if ((statbuf.st_mode & S_IFMT) != S_IFREG) {

   377           FREE_C_HEAP_ARRAY(char, filename);

   378           continue;

   379         }

   380 

   381         // If we found a matching file with a newer creation time, then

   382         // save the user name. The newer creation time indicates that

   383         // we found a newer incarnation of the process associated with

   384         // vmid. Due to the way that Windows recycles pids and the fact

   385         // that we can't delete the file from the file system namespace

   386         // until last close, it is possible for there to be more than

   387         // one hsperfdata file with a name matching vmid (diff users).

   388         //

   389         // We no longer ignore hsperfdata files where (st_size == 0).

   390         // In this function, all we're trying to do is determine the

   391         // name of the user that owns the process associated with vmid

   392         // so the size doesn't matter. Very rarely, we have observed

   393         // hsperfdata files where (st_size == 0) and the st_size field

   394         // later becomes the expected value.

   395         //

   396         if (statbuf.st_ctime > latest_ctime) {

   397           char* user = strchr(dentry->d_name, '_') + 1;

   398 

   399           if (latest_user != NULL) FREE_C_HEAP_ARRAY(char, latest_user);

   400           latest_user = NEW_C_HEAP_ARRAY(char, strlen(user)+1, mtInternal);

   401 

   402           strcpy(latest_user, user);

   403           latest_ctime = statbuf.st_ctime;

   404         }

   405 

   406         FREE_C_HEAP_ARRAY(char, filename);

   407       }

   408     }

   409     os::closedir(subdirp);

   410     FREE_C_HEAP_ARRAY(char, udbuf);

   411     FREE_C_HEAP_ARRAY(char, usrdir_name);

   412   }

   413   os::closedir(tmpdirp);

   414   FREE_C_HEAP_ARRAY(char, tdbuf);

   415 

   416   return(latest_user);

   417 }

   418 

   419 // return the name of the user that owns the process identified by vmid.

   420 //

   421 // note: this method should only be used via the Perf native methods.

   422 // There are various costs to this method and limiting its use to the

   423 // Perf native methods limits the impact to monitoring applications only.

   424 //

   425 static char* get_user_name(int vmid) {

   426 

   427   // A fast implementation is not provided at this time. It's possible

   428   // to provide a fast process id to user name mapping function using

   429   // the win32 apis, but the default ACL for the process object only

   430   // allows processes with the same owner SID to acquire the process

   431   // handle (via OpenProcess(PROCESS_QUERY_INFORMATION)). It's possible

   432   // to have the JVM change the ACL for the process object to allow arbitrary

   433   // users to access the process handle and the process security token.

   434   // The security ramifications need to be studied before providing this

   435   // mechanism.

   436   //

   437   return get_user_name_slow(vmid);

   438 }

   439 

   440 // return the name of the shared memory file mapping object for the

   441 // named shared memory region for the given user name and vmid.

   442 //

   443 // The file mapping object's name is not the file name. It is a name

   444 // in a separate name space.

   445 //

   446 // the caller is expected to free the allocated memory.

   447 //

   448 static char *get_sharedmem_objectname(const char* user, int vmid) {

   449 

   450   // construct file mapping object's name, add 3 for two '_' and a

   451   // null terminator.

   452   int nbytes = (int)strlen(PERFDATA_NAME) + (int)strlen(user) + 3;

   453 

   454   // the id is converted to an unsigned value here because win32 allows

   455   // negative process ids. However, OpenFileMapping API complains

   456   // about a name containing a '-' characters.

   457   //

   458   nbytes += UINT_CHARS;

   459   char* name = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

   460   _snprintf(name, nbytes, "%s_%s_%u", PERFDATA_NAME, user, vmid);

   461 

   462   return name;

   463 }

   464 

   465 // return the file name of the backing store file for the named

   466 // shared memory region for the given user name and vmid.

   467 //

   468 // the caller is expected to free the allocated memory.

   469 //

   470 static char* get_sharedmem_filename(const char* dirname, int vmid) {

   471 

   472   // add 2 for the file separator and a null terminator.

   473   size_t nbytes = strlen(dirname) + UINT_CHARS + 2;

   474 

   475   char* name = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

   476   _snprintf(name, nbytes, "%s\\%d", dirname, vmid);

   477 

   478   return name;

   479 }

   480 

   481 // remove file

   482 //

   483 // this method removes the file with the given file name.

   484 //

   485 // Note: if the indicated file is on an SMB network file system, this

   486 // method may be unsuccessful in removing the file.

   487 //

   488 static void remove_file(const char* dirname, const char* filename) {

   489 

   490   size_t nbytes = strlen(dirname) + strlen(filename) + 2;

   491   char* path = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

   492 

   493   strcpy(path, dirname);

   494   strcat(path, "\\");

   495   strcat(path, filename);

   496 

   497   if (::unlink(path) == OS_ERR) {

   498     if (PrintMiscellaneous && Verbose) {

   499       if (errno != ENOENT) {

   500         warning("Could not unlink shared memory backing"

   501                 " store file %s : %s\n", path, os::strerror(errno));

   502       }

   503     }

   504   }

   505 

   506   FREE_C_HEAP_ARRAY(char, path);

   507 }

   508 

   509 // returns true if the process represented by pid is alive, otherwise

   510 // returns false. the validity of the result is only accurate if the

   511 // target process is owned by the same principal that owns this process.

   512 // this method should not be used if to test the status of an otherwise

   513 // arbitrary process unless it is know that this process has the appropriate

   514 // privileges to guarantee a result valid.

   515 //

   516 static bool is_alive(int pid) {

   517 

   518   HANDLE ph = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);

   519   if (ph == NULL) {

   520     // the process does not exist.

   521     if (PrintMiscellaneous && Verbose) {

   522       DWORD lastError = GetLastError();

   523       if (lastError != ERROR_INVALID_PARAMETER) {

   524         warning("OpenProcess failed: %d\n", GetLastError());

   525       }

   526     }

   527     return false;

   528   }

   529 

   530   DWORD exit_status;

   531   if (!GetExitCodeProcess(ph, &exit_status)) {

   532     if (PrintMiscellaneous && Verbose) {

   533       warning("GetExitCodeProcess failed: %d\n", GetLastError());

   534     }

   535     CloseHandle(ph);

   536     return false;

   537   }

   538 

   539   CloseHandle(ph);

   540   return (exit_status == STILL_ACTIVE) ? true : false;

   541 }

   542 

   543 // check if the file system is considered secure for the backing store files

   544 //

   545 static bool is_filesystem_secure(const char* path) {

   546 

   547   char root_path[MAX_PATH];

   548   char fs_type[MAX_PATH];

   549 

   550   if (PerfBypassFileSystemCheck) {

   551     if (PrintMiscellaneous && Verbose) {

   552       warning("bypassing file system criteria checks for %s\n", path);

   553     }

   554     return true;

   555   }

   556 

   557   char* first_colon = strchr((char *)path, ':');

   558   if (first_colon == NULL) {

   559     if (PrintMiscellaneous && Verbose) {

   560       warning("expected device specifier in path: %s\n", path);

   561     }

   562     return false;

   563   }

   564 

   565   size_t len = (size_t)(first_colon - path);

   566   assert(len + 2 <= MAX_PATH, "unexpected device specifier length");

   567   strncpy(root_path, path, len + 1);

   568   root_path[len + 1] = '\\';

   569   root_path[len + 2] = '\0';

   570 

   571   // check that we have something like "C:\" or "AA:\"

   572   assert(strlen(root_path) >= 3, "device specifier too short");

   573   assert(strchr(root_path, ':') != NULL, "bad device specifier format");

   574   assert(strchr(root_path, '\\') != NULL, "bad device specifier format");

   575 

   576   DWORD maxpath;

   577   DWORD flags;

   578 

   579   if (!GetVolumeInformation(root_path, NULL, 0, NULL, &maxpath,

   580                             &flags, fs_type, MAX_PATH)) {

   581     // we can't get information about the volume, so assume unsafe.

   582     if (PrintMiscellaneous && Verbose) {

   583       warning("could not get device information for %s: "

   584               " path = %s: lasterror = %d\n",

   585               root_path, path, GetLastError());

   586     }

   587     return false;

   588   }

   589 

   590   if ((flags & FS_PERSISTENT_ACLS) == 0) {

   591     // file system doesn't support ACLs, declare file system unsafe

   592     if (PrintMiscellaneous && Verbose) {

   593       warning("file system type %s on device %s does not support"

   594               " ACLs\n", fs_type, root_path);

   595     }

   596     return false;

   597   }

   598 

   599   if ((flags & FS_VOL_IS_COMPRESSED) != 0) {

   600     // file system is compressed, declare file system unsafe

   601     if (PrintMiscellaneous && Verbose) {

   602       warning("file system type %s on device %s is compressed\n",

   603               fs_type, root_path);

   604     }

   605     return false;

   606   }

   607 

   608   return true;

   609 }

   610 

   611 // cleanup stale shared memory resources

   612 //

   613 // This method attempts to remove all stale shared memory files in

   614 // the named user temporary directory. It scans the named directory

   615 // for files matching the pattern ^$[0-9]*$. For each file found, the

   616 // process id is extracted from the file name and a test is run to

   617 // determine if the process is alive. If the process is not alive,

   618 // any stale file resources are removed.

   619 //

   620 static void cleanup_sharedmem_resources(const char* dirname) {

   621 

   622   // open the user temp directory

   623   DIR* dirp = os::opendir(dirname);

   624 

   625   if (dirp == NULL) {

   626     // directory doesn't exist, so there is nothing to cleanup

   627     return;

   628   }

   629 

   630   if (!is_directory_secure(dirname)) {

   631     // the directory is not secure, don't attempt any cleanup

   632     os::closedir(dirp);

   633     return;

   634   }

   635 

   636   // for each entry in the directory that matches the expected file

   637   // name pattern, determine if the file resources are stale and if

   638   // so, remove the file resources. Note, instrumented HotSpot processes

   639   // for this user may start and/or terminate during this search and

   640   // remove or create new files in this directory. The behavior of this

   641   // loop under these conditions is dependent upon the implementation of

   642   // opendir/readdir.

   643   //

   644   struct dirent* entry;

   645   char* dbuf = NEW_C_HEAP_ARRAY(char, os::readdir_buf_size(dirname), mtInternal);

   646   errno = 0;

   647   while ((entry = os::readdir(dirp, (struct dirent *)dbuf)) != NULL) {

   648 

   649     int pid = filename_to_pid(entry->d_name);

   650 

   651     if (pid == 0) {

   652 

   653       if (strcmp(entry->d_name, ".") != 0 && strcmp(entry->d_name, "..") != 0) {

   654 

   655         // attempt to remove all unexpected files, except "." and ".."

   656         remove_file(dirname, entry->d_name);

   657       }

   658 

   659       errno = 0;

   660       continue;

   661     }

   662 

   663     // we now have a file name that converts to a valid integer

   664     // that could represent a process id . if this process id

   665     // matches the current process id or the process is not running,

   666     // then remove the stale file resources.

   667     //

   668     // process liveness is detected by checking the exit status

   669     // of the process. if the process id is valid and the exit status

   670     // indicates that it is still running, the file file resources

   671     // are not removed. If the process id is invalid, or if we don't

   672     // have permissions to check the process status, or if the process

   673     // id is valid and the process has terminated, the the file resources

   674     // are assumed to be stale and are removed.

   675     //

   676     if (pid == os::current_process_id() || !is_alive(pid)) {

   677 

   678       // we can only remove the file resources. Any mapped views

   679       // of the file can only be unmapped by the processes that

   680       // opened those views and the file mapping object will not

   681       // get removed until all views are unmapped.

   682       //

   683       remove_file(dirname, entry->d_name);

   684     }

   685     errno = 0;

   686   }

   687   os::closedir(dirp);

   688   FREE_C_HEAP_ARRAY(char, dbuf);

   689 }

   690 

   691 // create a file mapping object with the requested name, and size

   692 // from the file represented by the given Handle object

   693 //

   694 static HANDLE create_file_mapping(const char* name, HANDLE fh, LPSECURITY_ATTRIBUTES fsa, size_t size) {

   695 

   696   DWORD lowSize = (DWORD)size;

   697   DWORD highSize = 0;

   698   HANDLE fmh = NULL;

   699 

   700   // Create a file mapping object with the given name. This function

   701   // will grow the file to the specified size.

   702   //

   703   fmh = CreateFileMapping(

   704                fh,                 /* HANDLE file handle for backing store */

   705                fsa,                /* LPSECURITY_ATTRIBUTES Not inheritable */

   706                PAGE_READWRITE,     /* DWORD protections */

   707                highSize,           /* DWORD High word of max size */

   708                lowSize,            /* DWORD Low word of max size */

   709                name);              /* LPCTSTR name for object */

   710 

   711   if (fmh == NULL) {

   712     if (PrintMiscellaneous && Verbose) {

   713       warning("CreateFileMapping failed, lasterror = %d\n", GetLastError());

   714     }

   715     return NULL;

   716   }

   717 

   718   if (GetLastError() == ERROR_ALREADY_EXISTS) {

   719 

   720     // a stale file mapping object was encountered. This object may be

   721     // owned by this or some other user and cannot be removed until

   722     // the other processes either exit or close their mapping objects

   723     // and/or mapped views of this mapping object.

   724     //

   725     if (PrintMiscellaneous && Verbose) {

   726       warning("file mapping already exists, lasterror = %d\n", GetLastError());

   727     }

   728 

   729     CloseHandle(fmh);

   730     return NULL;

   731   }

   732 

   733   return fmh;

   734 }

   735 

   736 

   737 // method to free the given security descriptor and the contained

   738 // access control list.

   739 //

   740 static void free_security_desc(PSECURITY_DESCRIPTOR pSD) {

   741 

   742   BOOL success, exists, isdefault;

   743   PACL pACL;

   744 

   745   if (pSD != NULL) {

   746 

   747     // get the access control list from the security descriptor

   748     success = GetSecurityDescriptorDacl(pSD, &exists, &pACL, &isdefault);

   749 

   750     // if an ACL existed and it was not a default acl, then it must

   751     // be an ACL we enlisted. free the resources.

   752     //

   753     if (success && exists && pACL != NULL && !isdefault) {

   754       FREE_C_HEAP_ARRAY(char, pACL);

   755     }

   756 

   757     // free the security descriptor

   758     FREE_C_HEAP_ARRAY(char, pSD);

   759   }

   760 }

   761 

   762 // method to free up a security attributes structure and any

   763 // contained security descriptors and ACL

   764 //

   765 static void free_security_attr(LPSECURITY_ATTRIBUTES lpSA) {

   766 

   767   if (lpSA != NULL) {

   768     // free the contained security descriptor and the ACL

   769     free_security_desc(lpSA->lpSecurityDescriptor);

   770     lpSA->lpSecurityDescriptor = NULL;

   771 

   772     // free the security attributes structure

   773     FREE_C_HEAP_ARRAY(char, lpSA);

   774   }

   775 }

   776 

   777 // get the user SID for the process indicated by the process handle

   778 //

   779 static PSID get_user_sid(HANDLE hProcess) {

   780 

   781   HANDLE hAccessToken;

   782   PTOKEN_USER token_buf = NULL;

   783   DWORD rsize = 0;

   784 

   785   if (hProcess == NULL) {

   786     return NULL;

   787   }

   788 

   789   // get the process token

   790   if (!OpenProcessToken(hProcess, TOKEN_READ, &hAccessToken)) {

   791     if (PrintMiscellaneous && Verbose) {

   792       warning("OpenProcessToken failure: lasterror = %d \n", GetLastError());

   793     }

   794     return NULL;

   795   }

   796 

   797   // determine the size of the token structured needed to retrieve

   798   // the user token information from the access token.

   799   //

   800   if (!GetTokenInformation(hAccessToken, TokenUser, NULL, rsize, &rsize)) {

   801     DWORD lasterror = GetLastError();

   802     if (lasterror != ERROR_INSUFFICIENT_BUFFER) {

   803       if (PrintMiscellaneous && Verbose) {

   804         warning("GetTokenInformation failure: lasterror = %d,"

   805                 " rsize = %d\n", lasterror, rsize);

   806       }

   807       CloseHandle(hAccessToken);

   808       return NULL;

   809     }

   810   }

   811 

   812   token_buf = (PTOKEN_USER) NEW_C_HEAP_ARRAY(char, rsize, mtInternal);

   813 

   814   // get the user token information

   815   if (!GetTokenInformation(hAccessToken, TokenUser, token_buf, rsize, &rsize)) {

   816     if (PrintMiscellaneous && Verbose) {

   817       warning("GetTokenInformation failure: lasterror = %d,"

   818               " rsize = %d\n", GetLastError(), rsize);

   819     }

   820     FREE_C_HEAP_ARRAY(char, token_buf);

   821     CloseHandle(hAccessToken);

   822     return NULL;

   823   }

   824 

   825   DWORD nbytes = GetLengthSid(token_buf->User.Sid);

   826   PSID pSID = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

   827 

   828   if (!CopySid(nbytes, pSID, token_buf->User.Sid)) {

   829     if (PrintMiscellaneous && Verbose) {

   830       warning("GetTokenInformation failure: lasterror = %d,"

   831               " rsize = %d\n", GetLastError(), rsize);

   832     }

   833     FREE_C_HEAP_ARRAY(char, token_buf);

   834     FREE_C_HEAP_ARRAY(char, pSID);

   835     CloseHandle(hAccessToken);

   836     return NULL;

   837   }

   838 

   839   // close the access token.

   840   CloseHandle(hAccessToken);

   841   FREE_C_HEAP_ARRAY(char, token_buf);

   842 

   843   return pSID;

   844 }

   845 

   846 // structure used to consolidate access control entry information

   847 //

   848 typedef struct ace_data {

   849   PSID pSid;      // SID of the ACE

   850   DWORD mask;     // mask for the ACE

   851 } ace_data_t;

   852 

   853 

   854 // method to add an allow access control entry with the access rights

   855 // indicated in mask for the principal indicated in SID to the given

   856 // security descriptor. Much of the DACL handling was adapted from

   857 // the example provided here:

   858 //      http://support.microsoft.com/kb/102102/EN-US/

   859 //

   860 

   861 static bool add_allow_aces(PSECURITY_DESCRIPTOR pSD,

   862                            ace_data_t aces[], int ace_count) {

   863   PACL newACL = NULL;

   864   PACL oldACL = NULL;

   865 

   866   if (pSD == NULL) {

   867     return false;

   868   }

   869 

   870   BOOL exists, isdefault;

   871 

   872   // retrieve any existing access control list.

   873   if (!GetSecurityDescriptorDacl(pSD, &exists, &oldACL, &isdefault)) {

   874     if (PrintMiscellaneous && Verbose) {

   875       warning("GetSecurityDescriptor failure: lasterror = %d \n",

   876               GetLastError());

   877     }

   878     return false;

   879   }

   880 

   881   // get the size of the DACL

   882   ACL_SIZE_INFORMATION aclinfo;

   883 

   884   // GetSecurityDescriptorDacl may return true value for exists (lpbDaclPresent)

   885   // while oldACL is NULL for some case.

   886   if (oldACL == NULL) {

   887     exists = FALSE;

   888   }

   889 

   890   if (exists) {

   891     if (!GetAclInformation(oldACL, &aclinfo,

   892                            sizeof(ACL_SIZE_INFORMATION),

   893                            AclSizeInformation)) {

   894       if (PrintMiscellaneous && Verbose) {

   895         warning("GetAclInformation failure: lasterror = %d \n", GetLastError());

   896         return false;

   897       }

   898     }

   899   } else {

   900     aclinfo.AceCount = 0; // assume NULL DACL

   901     aclinfo.AclBytesFree = 0;

   902     aclinfo.AclBytesInUse = sizeof(ACL);

   903   }

   904 

   905   // compute the size needed for the new ACL

   906   // initial size of ACL is sum of the following:

   907   //   * size of ACL structure.

   908   //   * size of each ACE structure that ACL is to contain minus the sid

   909   //     sidStart member (DWORD) of the ACE.

   910   //   * length of the SID that each ACE is to contain.

   911   DWORD newACLsize = aclinfo.AclBytesInUse +

   912                         (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) * ace_count;

   913   for (int i = 0; i < ace_count; i++) {

   914      assert(aces[i].pSid != 0, "pSid should not be 0");

   915      newACLsize += GetLengthSid(aces[i].pSid);

   916   }

   917 

   918   // create the new ACL

   919   newACL = (PACL) NEW_C_HEAP_ARRAY(char, newACLsize, mtInternal);

   920 

   921   if (!InitializeAcl(newACL, newACLsize, ACL_REVISION)) {

   922     if (PrintMiscellaneous && Verbose) {

   923       warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

   924     }

   925     FREE_C_HEAP_ARRAY(char, newACL);

   926     return false;

   927   }

   928 

   929   unsigned int ace_index = 0;

   930   // copy any existing ACEs from the old ACL (if any) to the new ACL.

   931   if (aclinfo.AceCount != 0) {

   932     while (ace_index < aclinfo.AceCount) {

   933       LPVOID ace;

   934       if (!GetAce(oldACL, ace_index, &ace)) {

   935         if (PrintMiscellaneous && Verbose) {

   936           warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

   937         }

   938         FREE_C_HEAP_ARRAY(char, newACL);

   939         return false;

   940       }

   941       if (((ACCESS_ALLOWED_ACE *)ace)->Header.AceFlags && INHERITED_ACE) {

   942         // this is an inherited, allowed ACE; break from loop so we can

   943         // add the new access allowed, non-inherited ACE in the correct

   944         // position, immediately following all non-inherited ACEs.

   945         break;

   946       }

   947 

   948       // determine if the SID of this ACE matches any of the SIDs

   949       // for which we plan to set ACEs.

   950       int matches = 0;

   951       for (int i = 0; i < ace_count; i++) {

   952         if (EqualSid(aces[i].pSid, &(((ACCESS_ALLOWED_ACE *)ace)->SidStart))) {

   953           matches++;

   954           break;

   955         }

   956       }

   957 

   958       // if there are no SID matches, then add this existing ACE to the new ACL

   959       if (matches == 0) {

   960         if (!AddAce(newACL, ACL_REVISION, MAXDWORD, ace,

   961                     ((PACE_HEADER)ace)->AceSize)) {

   962           if (PrintMiscellaneous && Verbose) {

   963             warning("AddAce failure: lasterror = %d \n", GetLastError());

   964           }

   965           FREE_C_HEAP_ARRAY(char, newACL);

   966           return false;

   967         }

   968       }

   969       ace_index++;

   970     }

   971   }

   972 

   973   // add the passed-in access control entries to the new ACL

   974   for (int i = 0; i < ace_count; i++) {

   975     if (!AddAccessAllowedAce(newACL, ACL_REVISION,

   976                              aces[i].mask, aces[i].pSid)) {

   977       if (PrintMiscellaneous && Verbose) {

   978         warning("AddAccessAllowedAce failure: lasterror = %d \n",

   979                 GetLastError());

   980       }

   981       FREE_C_HEAP_ARRAY(char, newACL);

   982       return false;

   983     }

   984   }

   985 

   986   // now copy the rest of the inherited ACEs from the old ACL

   987   if (aclinfo.AceCount != 0) {

   988     // picking up at ace_index, where we left off in the

   989     // previous ace_index loop

   990     while (ace_index < aclinfo.AceCount) {

   991       LPVOID ace;

   992       if (!GetAce(oldACL, ace_index, &ace)) {

   993         if (PrintMiscellaneous && Verbose) {

   994           warning("InitializeAcl failure: lasterror = %d \n", GetLastError());

   995         }

   996         FREE_C_HEAP_ARRAY(char, newACL);

   997         return false;

   998       }

   999       if (!AddAce(newACL, ACL_REVISION, MAXDWORD, ace,

  1000                   ((PACE_HEADER)ace)->AceSize)) {

  1001         if (PrintMiscellaneous && Verbose) {

  1002           warning("AddAce failure: lasterror = %d \n", GetLastError());

  1003         }

  1004         FREE_C_HEAP_ARRAY(char, newACL);

  1005         return false;

  1006       }

  1007       ace_index++;

  1008     }

  1009   }

  1010 

  1011   // add the new ACL to the security descriptor.

  1012   if (!SetSecurityDescriptorDacl(pSD, TRUE, newACL, FALSE)) {

  1013     if (PrintMiscellaneous && Verbose) {

  1014       warning("SetSecurityDescriptorDacl failure:"

  1015               " lasterror = %d \n", GetLastError());

  1016     }

  1017     FREE_C_HEAP_ARRAY(char, newACL);

  1018     return false;

  1019   }

  1020 

  1021   // if running on windows 2000 or later, set the automatic inheritance

  1022   // control flags.

  1023   SetSecurityDescriptorControlFnPtr _SetSecurityDescriptorControl;

  1024   _SetSecurityDescriptorControl = (SetSecurityDescriptorControlFnPtr)

  1025        GetProcAddress(GetModuleHandle(TEXT("advapi32.dll")),

  1026                       "SetSecurityDescriptorControl");

  1027 

  1028   if (_SetSecurityDescriptorControl != NULL) {

  1029     // We do not want to further propagate inherited DACLs, so making them

  1030     // protected prevents that.

  1031     if (!_SetSecurityDescriptorControl(pSD, SE_DACL_PROTECTED,

  1032                                             SE_DACL_PROTECTED)) {

  1033       if (PrintMiscellaneous && Verbose) {

  1034         warning("SetSecurityDescriptorControl failure:"

  1035                 " lasterror = %d \n", GetLastError());

  1036       }

  1037       FREE_C_HEAP_ARRAY(char, newACL);

  1038       return false;

  1039     }

  1040   }

  1041    // Note, the security descriptor maintains a reference to the newACL, not

  1042    // a copy of it. Therefore, the newACL is not freed here. It is freed when

  1043    // the security descriptor containing its reference is freed.

  1044    //

  1045    return true;

  1046 }

  1047 

  1048 // method to create a security attributes structure, which contains a

  1049 // security descriptor and an access control list comprised of 0 or more

  1050 // access control entries. The method take an array of ace_data structures

  1051 // that indicate the ACE to be added to the security descriptor.

  1052 //

  1053 // the caller must free the resources associated with the security

  1054 // attributes structure created by this method by calling the

  1055 // free_security_attr() method.

  1056 //

  1057 static LPSECURITY_ATTRIBUTES make_security_attr(ace_data_t aces[], int count) {

  1058 

  1059   // allocate space for a security descriptor

  1060   PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)

  1061      NEW_C_HEAP_ARRAY(char, SECURITY_DESCRIPTOR_MIN_LENGTH, mtInternal);

  1062 

  1063   // initialize the security descriptor

  1064   if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) {

  1065     if (PrintMiscellaneous && Verbose) {

  1066       warning("InitializeSecurityDescriptor failure: "

  1067               "lasterror = %d \n", GetLastError());

  1068     }

  1069     free_security_desc(pSD);

  1070     return NULL;

  1071   }

  1072 

  1073   // add the access control entries

  1074   if (!add_allow_aces(pSD, aces, count)) {

  1075     free_security_desc(pSD);

  1076     return NULL;

  1077   }

  1078 

  1079   // allocate and initialize the security attributes structure and

  1080   // return it to the caller.

  1081   //

  1082   LPSECURITY_ATTRIBUTES lpSA = (LPSECURITY_ATTRIBUTES)

  1083     NEW_C_HEAP_ARRAY(char, sizeof(SECURITY_ATTRIBUTES), mtInternal);

  1084   lpSA->nLength = sizeof(SECURITY_ATTRIBUTES);

  1085   lpSA->lpSecurityDescriptor = pSD;

  1086   lpSA->bInheritHandle = FALSE;

  1087 

  1088   return(lpSA);

  1089 }

  1090 

  1091 // method to create a security attributes structure with a restrictive

  1092 // access control list that creates a set access rights for the user/owner

  1093 // of the securable object and a separate set access rights for everyone else.

  1094 // also provides for full access rights for the administrator group.

  1095 //

  1096 // the caller must free the resources associated with the security

  1097 // attributes structure created by this method by calling the

  1098 // free_security_attr() method.

  1099 //

  1100 

  1101 static LPSECURITY_ATTRIBUTES make_user_everybody_admin_security_attr(

  1102                                 DWORD umask, DWORD emask, DWORD amask) {

  1103 

  1104   ace_data_t aces[3];

  1105 

  1106   // initialize the user ace data

  1107   aces[0].pSid = get_user_sid(GetCurrentProcess());

  1108   aces[0].mask = umask;

  1109 

  1110   if (aces[0].pSid == 0)

  1111     return NULL;

  1112 

  1113   // get the well known SID for BUILTIN\Administrators

  1114   PSID administratorsSid = NULL;

  1115   SID_IDENTIFIER_AUTHORITY SIDAuthAdministrators = SECURITY_NT_AUTHORITY;

  1116 

  1117   if (!AllocateAndInitializeSid( &SIDAuthAdministrators, 2,

  1118            SECURITY_BUILTIN_DOMAIN_RID,

  1119            DOMAIN_ALIAS_RID_ADMINS,

  1120            0, 0, 0, 0, 0, 0, &administratorsSid)) {

  1121 

  1122     if (PrintMiscellaneous && Verbose) {

  1123       warning("AllocateAndInitializeSid failure: "

  1124               "lasterror = %d \n", GetLastError());

  1125     }

  1126     return NULL;

  1127   }

  1128 

  1129   // initialize the ace data for administrator group

  1130   aces[1].pSid = administratorsSid;

  1131   aces[1].mask = amask;

  1132 

  1133   // get the well known SID for the universal Everybody

  1134   PSID everybodySid = NULL;