Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.\"
|
2013-08-28 20:00:25 +00:00
|
|
|
.\" Copyright (c) 2009-2010, 2012-2013 Robert N. M. Watson
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.\" All rights reserved.
|
|
|
|
|
.\"
|
|
|
|
|
.\" This software was developed at the University of Cambridge Computer
|
|
|
|
|
.\" Laboratory with support from a grant from Google, Inc.
|
|
|
|
|
.\"
|
2013-08-28 20:00:25 +00:00
|
|
|
.\" This software was developed by SRI International and the University of
|
|
|
|
|
.\" Cambridge Computer Laboratory under DARPA/AFRL contract (FA8750-10-C-0237)
|
|
|
|
|
.\" ("CTSRD"), as part of the DARPA CRASH research programme.
|
|
|
|
|
.\"
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
|
|
|
.\" modification, are permitted provided that the following conditions
|
|
|
|
|
.\" are met:
|
|
|
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
|
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
|
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
|
|
|
.\"
|
|
|
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
|
.\" SUCH DAMAGE.
|
|
|
|
|
.\"
|
|
|
|
|
.\" $FreeBSD$
|
|
|
|
|
.\"
|
2013-08-28 20:00:25 +00:00
|
|
|
.Dd August 28, 2013
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.Dt PDFORK 2
|
|
|
|
|
.Os
|
|
|
|
|
.Sh NAME
|
|
|
|
|
.Nm pdfork ,
|
|
|
|
|
.Nm pdgetpid ,
|
|
|
|
|
.Nm pdkill ,
|
|
|
|
|
.Nm pdwait4
|
|
|
|
|
.Nd System calls to manage process descriptors
|
|
|
|
|
.Sh LIBRARY
|
|
|
|
|
.Lb libc
|
|
|
|
|
.Sh SYNOPSIS
|
|
|
|
|
.In sys/procdesc.h
|
|
|
|
|
.Ft int
|
|
|
|
|
.Fn pdfork "int *fdp" "int flags"
|
|
|
|
|
.Ft int
|
|
|
|
|
.Fn pdgetpid "int fd" "pid_t *pidp"
|
|
|
|
|
.Ft int
|
|
|
|
|
.Fn pdkill "int fd" "int signum"
|
|
|
|
|
.Ft int
|
|
|
|
|
.Fn pdwait4 "int fd" "int *status" "int options" "struct rusage *rusage"
|
|
|
|
|
.Sh DESCRIPTION
|
|
|
|
|
Process descriptors are special file descriptors that represent processes,
|
|
|
|
|
and are created using
|
|
|
|
|
.Fn pdfork ,
|
|
|
|
|
a variant of
|
|
|
|
|
.Xr fork 2 ,
|
|
|
|
|
which, if successful, returns a process descriptor in the integer pointed to
|
|
|
|
|
by
|
2012-04-30 07:32:39 +00:00
|
|
|
.Fa fdp .
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
Processes created via
|
|
|
|
|
.Fn pdfork
|
|
|
|
|
will not cause
|
|
|
|
|
.Dv SIGCHLD
|
|
|
|
|
on termination.
|
|
|
|
|
.Fn pdfork
|
|
|
|
|
can accept the flags:
|
|
|
|
|
.Bl -tag -width ".Dv PD_DAEMON"
|
|
|
|
|
.It Dv PD_DAEMON
|
|
|
|
|
Instead of the default terminate-on-close behaviour, allow the process to
|
|
|
|
|
live until it is explicitly killed with
|
|
|
|
|
.Xr kill 2 .
|
|
|
|
|
.Pp
|
2013-08-28 20:00:25 +00:00
|
|
|
This option is not permitted in
|
|
|
|
|
.Xr capsicum 4
|
|
|
|
|
capability mode (see
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.Xr cap_enter 2 ) .
|
|
|
|
|
.El
|
|
|
|
|
.Pp
|
|
|
|
|
.Fn pdgetpid
|
2012-04-30 08:00:52 +00:00
|
|
|
queries the process ID (PID) in the process descriptor
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.Fa fd .
|
|
|
|
|
.Pp
|
|
|
|
|
.Fn pdkill
|
|
|
|
|
is functionally identical to
|
|
|
|
|
.Xr kill 2 ,
|
|
|
|
|
except that it accepts a process descriptor,
|
|
|
|
|
.Fa fd ,
|
|
|
|
|
rather than a PID.
|
|
|
|
|
.Pp
|
|
|
|
|
.Fn pdwait4
|
2012-02-25 14:31:25 +00:00
|
|
|
behaves identically to
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.Xr wait4 2 ,
|
|
|
|
|
but operates with respect to a process descriptor argument rather than a PID.
|
|
|
|
|
.Pp
|
|
|
|
|
The following system calls also have effects specific to process descriptors:
|
|
|
|
|
.Pp
|
|
|
|
|
.Xr fstat 2
|
|
|
|
|
queries status of a process descriptor; currently only the
|
|
|
|
|
.Fa st_mode ,
|
|
|
|
|
.Fa st_birthtime ,
|
|
|
|
|
.Fa st_atime ,
|
|
|
|
|
.Fa st_ctime
|
|
|
|
|
and
|
|
|
|
|
.Fa st_mtime
|
2012-02-25 15:21:43 +00:00
|
|
|
fields are defined.
|
|
|
|
|
If the owner read, write, and execute bits are set then the
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
process represented by the process descriptor is still alive.
|
|
|
|
|
.Pp
|
|
|
|
|
.Xr poll 2
|
|
|
|
|
and
|
|
|
|
|
.Xr select 2
|
|
|
|
|
allow waiting for process state transitions; currently only
|
|
|
|
|
.Dv POLLHUP
|
|
|
|
|
is defined, and will be raised when the process dies.
|
|
|
|
|
.Pp
|
|
|
|
|
.Xr close 2
|
|
|
|
|
will close the process descriptor unless
|
|
|
|
|
.Dv PD_DAEMON
|
|
|
|
|
is set; if the process is still alive and this is
|
|
|
|
|
the last reference to the process descriptor, the process will be terminated
|
|
|
|
|
with the signal
|
|
|
|
|
.Dv SIGKILL .
|
|
|
|
|
.Sh RETURN VALUES
|
|
|
|
|
.Fn pdfork
|
|
|
|
|
returns a PID, 0 or -1, as
|
|
|
|
|
.Xr fork 2
|
|
|
|
|
does.
|
|
|
|
|
.Pp
|
|
|
|
|
.Fn pdgetpid
|
|
|
|
|
and
|
|
|
|
|
.Fn pdkill
|
|
|
|
|
return 0 on success and -1 on failure.
|
|
|
|
|
.Pp
|
|
|
|
|
.Fn pdwait4
|
|
|
|
|
returns a PID on success and -1 on failure.
|
|
|
|
|
.Sh ERRORS
|
|
|
|
|
These functions may return the same error numbers as their PID-based equivalents
|
|
|
|
|
(e.g.
|
|
|
|
|
.Fn pdfork
|
|
|
|
|
may return the same error numbers as
|
|
|
|
|
.Xr fork 2 ) ,
|
|
|
|
|
with the following additions:
|
|
|
|
|
.Bl -tag -width Er
|
|
|
|
|
.It Bq Er EINVAL
|
|
|
|
|
The signal number given to
|
|
|
|
|
.Fn pdkill
|
|
|
|
|
is invalid.
|
|
|
|
|
.It Bq Er ENOTCAPABLE
|
|
|
|
|
The process descriptor being operated on has insufficient rights (e.g.
|
|
|
|
|
.Dv CAP_PDKILL
|
|
|
|
|
for
|
|
|
|
|
.Fn pdkill ) .
|
|
|
|
|
.El
|
|
|
|
|
.Sh SEE ALSO
|
|
|
|
|
.Xr close 2 ,
|
|
|
|
|
.Xr fork 2 ,
|
|
|
|
|
.Xr fstat 2 ,
|
|
|
|
|
.Xr kill 2 ,
|
|
|
|
|
.Xr poll 2 ,
|
2013-08-28 20:00:25 +00:00
|
|
|
.Xr wait4 2 ,
|
|
|
|
|
.Xr capsicum 4 ,
|
|
|
|
|
.Xr procdesc 4
|
Add experimental support for process descriptors
A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.
New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.
When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.
This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.
Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc
2011-08-18 22:51:30 +00:00
|
|
|
.Sh HISTORY
|
|
|
|
|
The
|
|
|
|
|
.Fn pdfork ,
|
|
|
|
|
.Fn pdgetpid ,
|
|
|
|
|
.Fn pdkill
|
|
|
|
|
and
|
|
|
|
|
.Fn pdwait4
|
|
|
|
|
system calls first appeared in
|
|
|
|
|
.Fx 9.0 .
|
|
|
|
|
.Pp
|
|
|
|
|
Support for process descriptors mode was developed as part of the
|
|
|
|
|
.Tn TrustedBSD
|
|
|
|
|
Project.
|
|
|
|
|
.Sh AUTHORS
|
|
|
|
|
.An -nosplit
|
|
|
|
|
These functions and the capability facility were created by
|
|
|
|
|
.An "Robert N. M. Watson" Aq rwatson@FreeBSD.org
|
|
|
|
|
and
|
|
|
|
|
.An "Jonathan Anderson" Aq jonathan@FreeBSD.org
|
|
|
|
|
at the University of Cambridge Computer Laboratory with support from a grant
|
|
|
|
|
from Google, Inc.
|
|
|
|
|
.Sh BUGS
|
|
|
|
|
.Fn pdwait4
|
|
|
|
|
has not yet been implemented.
|
