IH-533: Remove usage of forkexecd daemon to execute processes

Forkexecd was written to avoid some issues with Ocaml and
multi-threading.
Instead use C code to launch processes and avoid these issues.
Interface remains unchanged from Ocaml side but implemntation rely
entirely on C code.
vfork() is used to avoid performance memory issue.
Reap of the processes are done directly.
Code automatically reap child processes to avoid zombies.
One small helper is used in case syslog redirection is used.
This allows to restart the toolstack and keep launched programs running;
note that even with forkexecd daemon one process was used for this
purpose.
Code tries to keep compability with forkexecd, in particular:
- SIGPIPE is ignored in the parent;
- /dev/null is open with O_WRONLY even for stdin;
- file descriptors are limited to 1024.
We use close_range (if available) to reduce system calls to close
file descriptors.
Cgroup is set to avoid systemd closing processes on toolstack restart.
There's a fuzzer program to check file remapping algorithm; for this
reason the algorithm is in a separate file.

To turn internal debug on you need to set FORKEXECD_DEBUG_LOGS C
preprocessor macro to 1.

Signed-off-by: Frediano Ziglio <frediano.ziglio@cloud.com>

Makefile

@@ -15,6 +15,7 @@ build:
 	dune build @update-dm-lifecycle -j $(JOBS) --profile=$(PROFILE) --auto-promote || dune build @update-dm-lifecycle -j $(JOBS) --profile=$(PROFILE) --auto-promote
 	dune build @install -j $(JOBS) --profile=$(PROFILE)
 	dune build @python --profile=$(PROFILE)
+	$(MAKE) -C ocaml/forkexecd/helper
 
 # Quickly verify that the code compiles, without actually building it
 check:
@@ -246,6 +247,8 @@ install: build doc sdk doc-json
 	install -m 644 _build/default/ocaml/networkd/bin/xcp-networkd.1 $(DESTDIR)/usr/share/man/man1/xcp-networkd.1
 # wsproxy
 	install -m 755 _build/install/default/bin/wsproxy $(DESTDIR)$(LIBEXECDIR)/wsproxy
+# forkexecd
+	install -m 755 ocaml/forkexecd/helper/syslogger $(DESTDIR)/usr/libexec/xapi/syslogger
 # dune can install libraries and several other files into the right locations
 	dune install --destdir=$(DESTDIR) --prefix=$(PREFIX) --libdir=$(LIBDIR) --mandir=$(MANDIR) \
 		xapi-client xapi-schema xapi-consts xapi-cli-protocol xapi-datamodel xapi-types \

ocaml/forkexecd/helper/.gitignore

@@ -0,0 +1 @@
+syslogger

ocaml/forkexecd/helper/Makefile

@@ -0,0 +1,6 @@
+## Set some macro but not override environment ones
+CFLAGS ?= -O2 -g
+LDFLAGS ?=
+
+syslogger: syslogger.c ../lib/close_from.c ../lib/close_from.h
+	gcc $(CFLAGS) $(LDFLAGS) -Wall -Werror -o $@ $< ../lib/close_from.c

ocaml/forkexecd/helper/syslogger.c

@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) Citrix Systems Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; version 2.1 only. with the special
+ * exception on linking described in file LICENSE.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <syslog.h>
+#include <stdbool.h>
+#include <fcntl.h>
+#include <sys/wait.h>
+
+#include "../lib/close_from.h"
+
+static inline size_t quoted_length(const char c)
+{
+	return c == '\\' ? 2 :
+		(c >= ' ' && c < 0x7f) ? 1 :
+		4;
+}
+
+static const char hex[] = "0123456789ABCDEF";
+
+static inline void write_quoted(char *const p, const char c)
+{
+	if (c == '\\') {
+		p[0] = p[1] = c;
+	} else if (c >= ' ' && c < 0x7f) {
+		p[0] = c;
+	} else {
+		p[0] = '\\';
+		p[1] = 'x';
+		p[2] = hex[(c>>4)&0xf];
+		p[3] = hex[c&0xf];
+	}
+}
+
+static char quoted_buf[64000];
+static const char *key = NULL;
+static int child_pid;
+
+static void syslog_line(const char *line)
+{
+	syslog(LOG_DAEMON|LOG_INFO, "%s[%d]: %s", key, child_pid, line);
+}
+
+static bool forward_to_syslog(int fd)
+{
+	FILE *f = fdopen(fd, "r");
+	char *dest = quoted_buf;
+	char *const dest_end = quoted_buf + sizeof(quoted_buf) - sizeof(" ...") - 1;
+	bool overflowed = false;
+	while (true) {
+		int ch = getc_unlocked(f);
+
+		if (!overflowed && dest != quoted_buf && (ch == '\n' || ch == EOF)) {
+			*dest = 0;
+			syslog_line(quoted_buf);
+		}
+
+		if (ch == EOF)
+			return !!feof(f);
+
+		if (ch == '\n') {
+			overflowed = false;
+			dest = quoted_buf;
+			continue;
+		}
+
+		if (overflowed)
+			continue;
+
+		const size_t quoted_len = quoted_length(ch);
+		if (dest + quoted_len >= dest_end) {
+			strcpy(dest, " ...");
+			syslog_line(quoted_buf);
+			overflowed = true;
+			continue;
+		}
+		write_quoted(dest, ch);
+		dest += quoted_len;
+	}
+}
+
+// first argument file descriptor for read pipe
+// second option key
+// others just arguments
+int main(int argc, char **argv)
+{
+	int fds[2];
+	int version;
+	int status;
+	int redirect_stderr_to_stdout;
+	pid_t pid;
+
+	if (argc < 4)
+		return 125;
+
+	// first argument, <version>:<redirect>:<file descriptor>
+	if (sscanf(argv[1], "%d:%d:%d", &version, &redirect_stderr_to_stdout, &fds[0]) != 3)
+		return 125;
+	if (version != 1)
+		return 125;
+
+	// second argument, key
+	key = argv[2];
+
+	// others are the arguments
+	argv += 3;
+
+	fds[1] = -1;
+	if (fds[0] < 0) {
+		if (pipe(fds) < 0)
+			return 125;
+	}
+
+	child_pid = (int) getpid();
+
+	pid = fork();
+	if (pid < 0)
+		return 125;
+
+	if (pid == 0) {
+		// child
+		if (fds[1] >= 0)
+			close(fds[1]);
+
+		close(0);
+		close(1);
+		close(2);
+		open("/dev/null", O_RDONLY);
+		open("/dev/null", O_WRONLY);
+		open("/dev/null", O_WRONLY);
+		if (fds[0] != 3) {
+			dup2(fds[0], 3);
+			fds[0] = 3;
+		}
+		close_fds_from(4);
+
+		pid = fork();
+		if (pid < 0)
+			return 125;
+		if (pid > 0)
+			// parent
+			return 0;
+
+		openlog("forkexecd", 0, LOG_DAEMON);
+		forward_to_syslog(fds[0]);
+		return 0;
+	}
+
+	// parent
+	wait(&status);
+	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
+		return 125;
+
+	close(fds[0]);
+	if (fds[1] >= 0)
+		dup2(fds[1], 1);
+	if (fds[1] >= 0 && redirect_stderr_to_stdout)
+		dup2(fds[1], 2);
+	if (fds[1] >= 0)
+		close(fds[1]);
+	execv(argv[0], argv);
+
+	return errno == ENOENT ? 127 : 126;
+}

ocaml/forkexecd/lib/.gitignore

@@ -0,0 +1 @@
+fe_stubs_algo_fuzzer

ocaml/forkexecd/lib/Makefile

@@ -0,0 +1,18 @@
+## Makefile for fe_stubs algorithm fuzzer.
+## Fuzzer uses AFL (American Fuzzy Lop).
+##
+## Use "make" to build and launch the fuzzer
+##
+## Use "make show" to look at the first failures (if found).
+
+fuzz::
+	afl-gcc -O2 -Wall -Werror -g -o fe_stubs_algo_fuzzer fe_stubs_algo_fuzzer.c
+	rm -rf testcase_dir
+	mkdir testcase_dir
+	echo maomaoamaoaoao > testcase_dir/test1
+	rm -rf findings_dir/
+	afl-fuzz -i testcase_dir -o findings_dir -- ./fe_stubs_algo_fuzzer
+
+show::
+	cat "$$(ls -1 findings_dir/default/crashes/id* | head -1)" | ./fe_stubs_algo_fuzzer
+

ocaml/forkexecd/lib/close_from.c

@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) Citrix Systems Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; version 2.1 only. with the special
+ * exception on linking described in file LICENSE.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ */
+
+#include "close_from.h"
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <dirent.h>
+#include <sys/types.h>
+#include <sys/resource.h>
+
+#ifdef __linux__
+#include <sys/syscall.h>
+#endif
+
+// try to use close_range on Linux even if not defined by headers
+#if defined(__linux__) && !defined(SYS_close_range)
+#  if defined(__alpha__)
+#    define SYS_close_range 546
+#  elif defined(__amd64__) || defined(__x86_64__) || defined(__arm__) || \
+        defined(__aarch64__) || defined(__hppa__) || defined(__i386__) || \
+        defined(__ia64__) || defined(__m68k__) || defined(__mips__) || \
+        defined(__powerpc__) || defined(__powerpc64__) || defined(__sparc__) || \
+        defined(__s390x__)
+#    define SYS_close_range 436
+#  endif
+#endif
+
+bool
+close_fds_from(int fd_from)
+{
+    // first method, use close_range
+#if (defined(__linux__) && defined(SYS_close_range)) \
+    || (defined(__FreeBSD__) && defined(CLOSE_RANGE_CLOEXEC))
+    static bool close_range_supported = true;
+    if (close_range_supported) {
+#if defined(__linux__)
+        if (syscall(SYS_close_range, fd_from, ~0U, 0) == 0)
+#else
+        if (close_range(fd_from, ~0U, 0) == 0)
+#endif
+            return true;
+
+        if (errno == ENOSYS)
+            close_range_supported = false;
+    }
+#endif
+
+    // second method, read fds list from /proc
+    DIR *dir = opendir("/proc/self/fd");
+    if (dir) {
+        const int dir_fd = dirfd(dir);
+        struct dirent *ent;
+        while ((ent = readdir(dir)) != NULL) {
+            char *end = NULL;
+            unsigned long fd = strtoul(ent->d_name, &end, 10);
+            if (end == NULL || *end)
+                continue;
+            if (fd >= fd_from && fd != dir_fd)
+                close(fd);
+        }
+        closedir(dir);
+        return true;
+    }
+
+    // third method, use just a loop
+    struct rlimit limit;
+    if (getrlimit(RLIMIT_NOFILE, &limit) < 0)
+        return false;
+    for (int fd = fd_from; fd < limit.rlim_cur; ++ fd)
+        close(fd);
+
+    return true;
+}

ocaml/forkexecd/lib/close_from.h

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Citrix Systems Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; version 2.1 only. with the special
+ * exception on linking described in file LICENSE.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ */
+
+#include <stdbool.h>
+
+bool close_fds_from(int fd);

ocaml/forkexecd/lib/dune

@@ -14,5 +14,10 @@
    xapi-stdext-unix
    xapi-tracing
  )
+ (foreign_stubs
+  (language c)
+  (names fe_stubs close_from logs)
+  (flags :standard -Wall -Werror)
+ )
  (preprocess
   (pps ppx_deriving_rpc)))