Commit Graph

1188 Commits

Author SHA1 Message Date
Jilles Tjoelker
52981a1694 sh/tests: Add a second kind of binary scripts without #!
One of the reasons for git commit
e0f5c1387d was to make "actually portable
executables" work. Add a test that is more like those.

MFC after:	1 week
2021-01-03 23:53:37 +01:00
Jilles Tjoelker
ab41d7f371 sh: Explain duplicate tcsetpgrp() calls
This is a comment change only.
2020-12-26 15:27:33 +01:00
Jilles Tjoelker
ccd0a51fda sh: Write absolute path in command -vV and type
POSIX is pretty clear that command -v, command -V and type shall write
absolute pathnames. Therefore, we need to prepend the current directory's
name to relative pathnames.

This can happen either when PATH contains a relative pathname or when the
operand contains a slash but is not an absolute pathname.
2020-09-01 13:19:15 +00:00
Jilles Tjoelker
1cffe8b812 sh: Keep ignored SIGINT/SIGQUIT after set in a background job
If job control is not enabled, a background job (... &) ignores SIGINT and
SIGQUIT, but this can be reverted using the trap builtin in the same shell
environment.

Using the set builtin to change options would also revert SIGINT and SIGQUIT
to their previous dispositions.

This broke due to r317298. Calling setsignal() reverts the effect of
ignoresig().

Reported by:	bdrewery
MFC after:	1 week
2020-08-28 15:35:45 +00:00
Piotr Pawel Stefaniak
9b2a97806f sh(1): print a newline when ^D quits sh
I've always found this a little bit confusing:
> sh
$ ^D> sh
$ ^D>

Reviewed by:	0mp, jilles
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D25813
2020-07-27 18:46:20 +00:00
Jilles Tjoelker
bd11190091 sh: Do not ignore INTOFF during a trap
INTOFF postpones SIGINT processing and INTON enables it again. This is
important so an interactive shell can return to the top level prompt when
Ctrl+C is pressed.

Given that INTON is automatically done when a builtin completes, the part
where onsig() ignores suppressint when in_dotrap is true is both unnecessary
and unsafe. If the trap is for some other signal than SIGINT, arbitrary code
could have been interrupted.

Historically, INTOFF remained in effect for longer.

Reviewed by:	bdrewery
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D25270
2020-07-09 20:53:56 +00:00
Mateusz Piotrowski
2c566d312f Fix description of the "\$" sequence for PS1
The manual page documents "\$" to expand to either "$" or "#" followed by
a single space. In reality, the single space character is not appended.

PR:		247791
Submitted by:	kd-dev@pm.me
MFC after:	7 days
2020-07-06 10:05:35 +00:00
Jilles Tjoelker
40276ff30e sh/tests: Re-enable bin.sh.execution.functional_test.bg12.0
This reverts r362646.

PR:		247559
MFC after:	1 week
2020-06-28 21:33:08 +00:00
Jilles Tjoelker
c1602cfd61 sh/tests: Fix flaky execution/bg12.0
When job control is not enabled, the shell ignores SIGINT while waiting for
a foreground process unless that process exits on SIGINT. In this case, the
foreground process is sleep and it does not exit on SIGINT because the
signal is only sent to the shell. Depending on order of events, this could
cause the SIGINT to be unexpectedly ignored.

On lightly loaded bare metal, the chance of this happening tends to be less
than 0.01% but with higher loads and/or virtualization it becomes more
likely.

Starting the sleep in background and using the wait builtin ensures SIGINT
will not be ignored.

PR:		247559
Reported by:	lwhsu
MFC after:	1 week
2020-06-28 21:15:29 +00:00
Li-Wen Hsu
c707e36ef9 Temporarily skip flakey bin.sh.execution.functional_test.bg12 in CI
PR:		238870
Sponsored by:	The FreeBSD Foundation
2020-06-26 09:39:23 +00:00
Jilles Tjoelker
7312c97fa4 sh/tests: Add tests for SIGINT in non-jobc background commands
If job control is not enabled, background commands shall ignore SIGINT and
SIGQUIT, and it shall be possible to override that ignore in the same shell.

MFC after:	1 week
2020-06-14 19:41:24 +00:00
Kyle Evans
dcef4f65ae vfs: add restrictions to read(2) of a directory [1/2]
Historically, we've allowed read() of a directory and some filesystems will
accommodate (e.g. ufs/ffs, msdosfs). From the history department staffed by
Warner: <<EOF

pdp-7 unix seemed to allow reading directories, but they were weird, special
things there so I'm unsure (my pdp-7 assembler sucks).

1st Edition's sources are lost, mostly. The kernel allows it. The
reconstructed sources from 2nd or 3rd edition read it though.

V6 to V7 changed the filesystem format, and should have been a warning, but
reading directories weren't materially changed.

4.1b BSD introduced readdir because of UFS. UFS broke all directory reading
programs in 1983. ls, du, find, etc all had to be rewritten. readdir() and
friends were introduced here.

SysVr3 picked up readdir() in 1987 for the AT&T fork of Unix. SysVr4 updated
all the directory reading programs in 1988 because different filesystem
types were introduced.

In the 90s, these interfaces became completely ubiquitous as PDP-11s running
V7 faded from view and all the folks that initially started on V7 upgraded
to SysV. Linux never supported this (though I've not done the software
archeology to check) because it has always had a pathological diversity of
filesystems.
EOF

Disallowing read(2) on a directory has the side-effect of masking
application bugs from relying on other implementation's behavior
(e.g. Linux) of rejecting these with EISDIR across the board, but allowing
it has been a vector for at least one stack disclosure bug in the past[0].

By POSIX, this is implementation-defined whether read() handles directories
or not. Popular implementations have chosen to reject them, and this seems
sensible: the data you're reading from a directory is not structured in some
unified way across filesystem implementations like with readdir(2), so it is
impossible for applications to portably rely on this.

With this patch, we will reject most read(2) of a dirfd with EISDIR. Users
that know what they're doing can conscientiously set
bsd.security.allow_read_dir=1 to allow read(2) of directories, as it has
proven useful for debugging or recovery. A future commit will further limit
the sysctl to allow only the system root to read(2) directories, to make it
at least relatively safe to leave on for longer periods of time.

While we're adding logic pertaining to directory vnodes to vn_io_fault, an
additional assertion has also been added to ensure that we're not reaching
vn_io_fault with any write request on a directory vnode. Such request would
be a logical error in the kernel, and must be debugged rather than allowing
it to potentially silently error out.

Commented out shell aliases have been placed in root's chsrc/shrc to promote
awareness that grep may become noisy after this change, depending on your
usage.

A tentative MFC plan has been put together to try and make it as trivial as
possible to identify issues and collect reports; note that this will be
strongly re-evaluated. Tentatively, I will MFC this knob with the default as
it is in HEAD to improve our odds of actually getting reports. The future
priv(9) to further restrict the sysctl WILL NOT BE MERGED BACK, so the knob
will be a faithful reversion on stable/12. We will go into the merge
acknowledging that the sysctl default may be flipped back to restore
historical behavior at *any* point if it's warranted.

[0] https://www.freebsd.org/security/advisories/FreeBSD-SA-19:10.ufs.asc

PR:		246412
Reviewed by:	mckusick, kib, emaste, jilles, cy, phk, imp (all previous)
Reviewed by:	rgrimes (latest version)
MFC after:	1 month (note the MFC plan mentioned above)
Relnotes:	absolutely, but will amend previous RELNOTES entry
Differential Revision:	https://reviews.freebsd.org/D24596
2020-06-04 18:09:55 +00:00
Jilles Tjoelker
e0f5c1387d sh: Allow more scripts without #!
Austin Group bugs #1226 and #1250 changed the requirements for shell scripts
without #! (POSIX does not specify #!; this is about the shell execution
when execve(2) returns an [ENOEXEC] error).

POSIX says we shall allow execution if the initial part intended to be
parsed by the shell consists of characters and does not contain the NUL
character.  This allows concatenating a shell script (ending with exec or
exit) and a binary payload.

In order to reject common binary files such as PNG images, check that there
is a lowercase letter or expansion before the last newline before the NUL
character, in addition to the check for the newline character suggested by
POSIX.
2020-05-30 16:00:49 +00:00
Jilles Tjoelker
40b12a0b78 sh: Remove a comment that was obsoleted by r358152
Since r358152, the read builtin has used a buffer.

Also, remove a space at the end of the line in a comment.

No functional change is intended.
2020-05-22 14:46:23 +00:00
Jilles Tjoelker
6bc7175f31 sh: Fix double INTON with vfork
The shell maintains a count of the number of times SIGINT processing has
been disabled via INTOFF, so SIGINT processing resumes when all disables
have enabled again (INTON).

If an error occurs in a vfork() child, the processing of the error enables
SIGINT processing again, and the INTON in vforkexecshell() causes the count
to become negative.

As a result, a later INTOFF may not actually disable SIGINT processing. This
might cause memory corruption if a SIGINT arrives at an inopportune time. As
of r360452, it causes the shell to abort when it would unsafely allocate or
free memory in certain ways.

Note that various places such as errors in non-special builtins
unconditionally reset the count to 0, so the problem might still not always
be visible.

PR:		246497
Reported by:	jbeich
MFC after:	2 weeks
2020-05-16 16:29:23 +00:00
Jilles Tjoelker
1bb4b6a76a sh/tests: Test some obscure cases with aliasing keywords 2020-05-12 21:59:21 +00:00
Jilles Tjoelker
9f9c9549fd sh: Assert INTOFF rather than applying it in ck*
As I noted in https://reviews.freebsd.org/D22756, INTOFF should be in effect
when calling ckmalloc/ckrealloc/ckfree to avoid memory leaks and double
frees. Therefore, change the functions to check if INTOFF is in effect
instead of applying it.

Reviewed by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D24599
2020-04-28 20:34:27 +00:00
Jilles Tjoelker
da06ef25e6 sh: Remove remnants to compile out fc completely
r360139 made compiling with NO_HISTORY work. This #define does not remove
the fc and bind builtins completely but makes them always write an error
message.

However, there was also some code in builtins.def and mkbuiltins to remove
the fc builtin entirely (but not the bind builtin). The additional build
system complication to make this work seems not worth it, so remove that
code.
2020-04-22 21:45:43 +00:00
Bryan Drewery
6c346639ba Fix build with NO_HISTORY set
Reviewed by:		jilles
Differential Revision:	https://reviews.freebsd.org/D24458
2020-04-21 00:37:55 +00:00
Adrian Chadd
4d0b267a1f [sh] Fix a "may be unused" warning on mips-gcc
mips-gcc for mips32 was complaining that c was potentially used before
being set.  Setting it to 0 before calling fdgetsc() looks like the right
thing to do in this instance; there's an explicit check for c == 0 later
on.

Tested: mips-gcc mips32 build, running /bin/sh on mips32
2020-04-16 23:31:39 +00:00
Edward Tomasz Napierala
f52c431b18 Bump WARNS for sh(1).
Reviewed by:	jilles
MFC after:	2 weeks
Sponsored by:	DARPA
Differential Revision:	https://reviews.freebsd.org/D24181
2020-04-01 15:12:51 +00:00
Kyle Evans
becf15d7cb sh: remove duplicate el definition
el is declared extern in myhistedit.h and defined in histedit.c. Remove the
duplicate definition in input.c to appease the -fno-common build.

-fno-common will become the default in GCC10/LLVM11.

MFC after:	3 days
2020-03-28 17:02:32 +00:00
Kyle Evans
b63d2d683d sh: fix read builtin on 32-bit systems
Specifically, any system with a 32-bit size_t; -residue is calculated as a
32-bit *then* promoted to the 64-bit off_t and the result is ultimately
wrong. This resulted in what would appear to be truncated output, as only
the first line would be read.

Correct it by just making residue an off_t to begin with, since this is what
lseek will take anyways.

Reported by:	antoine, dim
Triaged by:	cem
Tested by:	kevans
X-MFC-With:	r358152
2020-02-22 03:14:05 +00:00
Hiroki Sato
be860ca2a7 Improve performance of "read" built-in command when using a seekable
fd.

The read built-in command calls read(2) with a 1-byte buffer because
newline characters need to be detected even on a byte stream which
comes from a non-seekable file descriptor.  Because of this, the
following script calls >6,000 read(2) to show a 6KiB file:

 while read IN; do echo "$IN"; done < /COPYRIGHT

When the input byte stream is seekable, it is possible to read a data
block and then reposition the file pointer to where a newline
character found.  This change adds a small buffer to do this and
reduces the number of read(2) calls.

Theoretically, multiple built-in commands reading the same seekable
byte stream in a single pipe chain can share the buffer.  However,
this change just makes a single invocation of the read built-in
allocate a buffer and deallocate it every time for simplicity.
Although this causes read(2) to read the same regions multiple times,
the performance penalty should be small compared to the reduction of
read(2) calls.

Reviewed by:		jilles
MFC after:		1 week
Differential Revision:	https://reviews.freebsd.org/D23747
2020-02-20 03:01:27 +00:00
Jilles Tjoelker
d3eae2a68e sh: Fix rare memory leak with SIGINT
If getcwd() failed earlier on but later succeeded in the pwd builtin,
there was no INTOFF protection between calling savestr() and storing its
result.

It is quite rare for getcwd() to fail, and rarer for it to succeed later in
the same directory.

Found via code inspection for changing ckmalloc() and similar to assert
INTOFF protection instead of applying it directly (which protects against
corrupting malloc's internal state but allows memory leaks or double frees).

MFC after:	1 week
2020-01-01 12:06:37 +00:00
Jilles Tjoelker
2a55bade0e sh: Test that executing various binary files is rejected
If executing a file fails with an [ENOEXEC] error, the shell executes the
file as a shell script, except that this execution may instead result in an
error message if the file is binary.

Per a recent Austin Group interpretation, we will need to change this to
allow a concatenation of a shell script and a binary payload. See
Austin Group bugs #1226 and #1250.

MFC after:	1 week
2019-12-30 21:32:55 +00:00
Baptiste Daroussin
f370355791 Do not use our custom completion function, it is not needed anymore 2019-09-16 07:31:59 +00:00
Bryan Drewery
c63c5ab001 Fix .depend files to work for build tools.
This is somewhat of a follow-up to r335746.

MFC after:	2 weeks
Sponsored by:	DellEMC
2019-06-15 17:08:13 +00:00
Jilles Tjoelker
56ada93f8a sh/tests: Improve failure messages of expansion/arith15.0 2019-03-07 22:51:58 +00:00
Jilles Tjoelker
484160a9cf sh: Add set -o pipefail
The pipefail option allows checking the exit status of all commands in a
pipeline more easily, at a limited cost of complexity in sh itself. It works
similarly to the option in bash, ksh93 and mksh.

Like ksh93 and unlike bash and mksh, the state of the option is saved when a
pipeline is started. Therefore, even in the case of commands like
  A | B &
a later change of the option does not change the exit status, the same way
  (A | B) &
works.

Since SIGPIPE is not handled specially, more work in the script is required
for a proper exit status for pipelines containing commands such as head that
may terminate successfully without reading all input. This can be something
like

(
        cmd1
        r=$?
        if [ "$r" -gt 128 ] && [ "$(kill -l "$r")" = PIPE ]; then
                exit 0
        else
                exit "$r"
        fi
) | head

PR:		224270
Relnotes:	yes
2019-02-24 21:05:13 +00:00
Jilles Tjoelker
94b793c497 sh: Send normal output from bind builtin to stdout
PR:		233343
Submitted by:	Yuichiro NAITO (original version)
2019-02-19 21:27:30 +00:00
Jilles Tjoelker
aac5464b61 sh: Restore $((x)) error checking after fix for $((-9223372036854775808))
SVN r342880 was designed to fix $((-9223372036854775808)) and things like
$((0x8000000000000000)) but also broke error detection for values of
variables without dollar sign ($((x))).

For compatibility, overflow in plain literals continues to be ignored and
the value is clamped to the boundary (except 9223372036854775808 which is
changed to -9223372036854775808).

Reviewed by:	se (although he would like error checking to be removed)
MFC after:	2 weeks
X-MFC-with:	r342880
Differential Revision:	https://reviews.freebsd.org/D18926
2019-02-10 22:23:05 +00:00
Edward Tomasz Napierala
719fd9fb2c Comment out the default sh(1) aliases for root, introduced in r343416.
The rest of this stuff is still to be discussed, but I think at this
point we have the agreement that the aliases should go.

MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
2019-01-25 17:09:26 +00:00
Edward Tomasz Napierala
60315f8f9d Install .shrc for root, and set PS1 for the toor account.
Reviewed by:	jilles
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D18872
2019-01-24 23:34:51 +00:00
Edward Tomasz Napierala
d81ca439e7 Make sh(1) support \u in PS1. This removes one fork/exec on interactive
shell startup.

Reviewed by:	0mp (man page), jilles
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D18790
2019-01-24 11:59:46 +00:00
Edward Tomasz Napierala
ed1cfd30ce Don't mess with BLOCKSIZE in shell startup files - it's set by login.conf(5);
there's no need to even mention it in shell rc files.  Not that it's wrong;
just pointless and somewhat misleading.

Reviewed by:	jilles
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D18809
2019-01-20 22:08:49 +00:00
Jilles Tjoelker
f91d2e2171 sh: Send libedit "ferr" output to fd 2
The libedit "fout" output must be sent to fd 2 since it contains prompts
that POSIX says must be sent to fd 2. However, the libedit "ferr" output
receives error messages such as from "bind" that make no sense to send to fd
1.
2019-01-20 14:25:25 +00:00
Dag-Erling Smørgrav
a96301b673 Fix an edge case when parsing large numbers which resulted in inconsistent
results between an expression that refers to a variable by name and the
same expression that includes the same variable by value.

Submitted by:	se@
MFC after:	1 week
2019-01-09 09:36:54 +00:00
Jilles Tjoelker
993b1e419c sh: Add test for exported but unset variables
PR:		233545
2019-01-03 20:23:12 +00:00
Jilles Tjoelker
56f33d07ce sh: Do not place exported but unset variables into the environment
PR:		233545
Submitted by:	Jan Beich
Obtained from:	NetBSD
2019-01-03 20:22:35 +00:00
Edward Tomasz Napierala
20c9381c98 Make sh(1) collapse $HOME into "~" in PS1.
Reviewed by:	jilles
MFC after:	2 weeks
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D18663
2018-12-28 17:51:40 +00:00
Jilles Tjoelker
1becbc64f8 sh(1): Remove -c string from set builtin documentation
Altering the -c string at run time does not make sense and is not possible.

MFC after:	1 week
2018-12-08 12:49:19 +00:00
Jilles Tjoelker
468ed39612 sh: Fix ${param?} default error message
If word in ${param?word} is missing, the shell shall write a default error
message. So expanding ${param?} when param is not set should write an error
message like

sh: param: parameter not set

This was broken by r316417.

PR:		233585
2018-11-28 20:03:53 +00:00
Jilles Tjoelker
77da4a95e8 sh: Use 126 and 127 exit status for failures opening a script
This affects scripts named on the command line, named with a '.' special
builtin and found via the PATH %func autoloading mechanism.

PR:		231986
2018-11-27 21:49:59 +00:00
Jilles Tjoelker
bb324af62a sh: Unify EXERROR and EXEXEC
The difference between EXERROR and EXEXEC was that EXEXEC passed along
exitstatus and EXERROR set exitstatus to 2 in the handling code.

By changing the places that raised EXERROR to set exitstatus to 2, the
handling of EXERROR and EXEXEC becomes the same.
2018-11-09 14:58:24 +00:00
Jilles Tjoelker
b5532964e7 sh: Use exitstatus instead of exerrno to pass EXEXEC status
No functional change is intended.
2018-10-27 20:17:57 +00:00
Jilles Tjoelker
4269bba2eb sh: Fix formal overflow in pointer arithmetic
The intention is to lower the value of the pointer, which according to ubsan
cannot be done by adding an unsigned quantity.

Reported by:	kevans
Approved by:	re (kib)
MFC after:	1 week
2018-09-05 19:16:09 +00:00
Brad Davis
94ec7ec758 Finish moving dot.cshrc and dot.profile to bin/csh/ and bin/sh/.
Approved by:	re (gjb), will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16770
2018-08-29 16:59:19 +00:00
Brad Davis
3349f8bb8f Revert parts of r337849 and r337857
This fixes the build and I will redo these changes as part of a future review
that organizes them differently.  The way I tried to do it here could be done
better.  Sorry for the noise.

Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16737
2018-08-15 23:18:34 +00:00
Brad Davis
1da0bddb6d Fix build after r337849
This moves the symlink creation to after where the files are installed.

This also inverts the shell change so that it only happens if MK_TCSH is on.

Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16725
2018-08-15 16:22:12 +00:00