syd 3.54.1

rock-solid application kernel
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//
// Syd: rock-solid application kernel
// src/kernel/ptrace/event/fork.rs: ptrace(2) fork event handler
//
// Copyright (c) 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

use std::sync::{Arc, RwLock};

use nix::{
    sys::signal::{killpg, Signal},
    unistd::{getpgid, getpgrp, Pid},
};

use crate::{
    confine::SydNotifResp,
    cookie::safe_kill,
    error,
    proc::{proc_task_limit, proc_task_nr_syd, proc_task_nr_sys},
    sandbox::{Action, Capability, Sandbox, SandboxGuard},
    warn,
};

#[expect(clippy::cognitive_complexity)]
pub(crate) fn sysevent_fork(
    pid: Pid,
    cpid: Pid,
    sandbox: &Arc<RwLock<Sandbox>>,
) -> Option<SydNotifResp> {
    #[cfg(feature = "kcov")]
    {
        // KCOV: Inherit KCOV mapping from parent to child.
        crate::kcov::inherit_kcov_tid(pid, cpid);
        crate::kcov::abi::kcov_attach(cpid);
        crate::kcov::abi::kcov_set_syscall(libc::SYS_clone);
        let _ = crate::kcov::abi::kcov_enter_for(cpid);
        crate::kcov_edge!();
    }

    // Read-lock the sandbox.
    let sandbox = SandboxGuard::Read(sandbox.read().unwrap_or_else(|err| err.into_inner()));

    // Check for PID sandboxing.
    //
    // sandbox/pid may be used dynamically after startup.
    if !sandbox.enabled(Capability::CAP_PID) {
        // PID sandboxing disabled, nothing else to do.
        return Some(SydNotifResp::Cont { pid, signal: None });
    }

    let pid_max = if sandbox.pid_max > 0 {
        sandbox.pid_max
    } else {
        // pid/max:0 disables PID sandboxing.
        // pid/max may be used dynamically after startup.
        return Some(SydNotifResp::Cont { pid, signal: None });
    };
    let pid_act = sandbox.default_action(Capability::CAP_PID);
    drop(sandbox); // release the read lock.

    // Check for PID limit.
    let errno = match proc_task_limit(pid, pid_max) {
        Ok(false) => {
            // Limit not exceeded, continue process.
            return Some(SydNotifResp::Cont { pid, signal: None });
        }
        Ok(true) => None,                 // Limit exceeded.
        Err(errno) => Some(errno as i32), // Error during limit check.
    };

    // Report error as necessary.
    let pgid = getpgid(Some(pid)).map(|p| p.as_raw()).unwrap_or(0);
    let syd_pgid = getpgrp().as_raw();
    let kill_gid = pgid != 0 && pgid != syd_pgid;
    if pid_act != Action::Filter {
        let cnt_sys = proc_task_nr_sys().unwrap_or(0);
        let cnt_syd = proc_task_nr_syd().unwrap_or(0);
        let syd_pid = Pid::this().as_raw();
        match pid_act {
            // Allow|Deny|Filter|Panic cannot happen.
            action if action.is_signaling() => {
                // is_signaling() ensures signal() returns Some.
                #[expect(clippy::disallowed_methods)]
                let kill_sig = action.signal().unwrap();
                let kill_it = if kill_gid {
                    format!("kill process group {pgid} with {kill_sig}")
                } else {
                    format!("kill process {pid} with {kill_sig}")
                };
                error!("ctx": "limit_pid",
                    "msg": format!("process limit {pid_max} reached, {kill_it}"),
                    "err": errno.unwrap_or(0), "tip": "increase `pid/max'",
                    "pid_max": pid_max, "sig": kill_sig as libc::c_int,
                    "sys_tasks": cnt_sys,  "syd_tasks": cnt_syd,
                    "pid": cpid.as_raw(), "ppid": pid.as_raw(), "pgid": pgid,
                    "syd_pid": syd_pid, "syd_pgid": syd_pgid);
            }
            Action::Warn => {
                warn!("ctx": "pid_limit",
                    "msg": format!("process limit {pid_max} reached with pid {pid}"),
                    "err": errno.unwrap_or(0), "tip": "increase `pid/max'",
                    "sys_tasks": cnt_sys,  "syd_tasks": cnt_syd,
                    "pid": cpid.as_raw(), "ppid": pid.as_raw(), "pgid": pgid,
                    "syd_pid": syd_pid, "syd_pgid": syd_pgid);
            }
            Action::Exit => {
                let act = pid_act.to_string().to_ascii_lowercase();
                error!("ctx": "limit_pid",
                    "msg": format!("process limit {pid_max} reached with pid {cpid}, {act}ing!"),
                    "err": errno.unwrap_or(0), "tip": "increase `pid/max'",
                    "sys_tasks": cnt_sys,  "syd_tasks": cnt_syd,
                    "pid": cpid.as_raw(), "ppid": pid.as_raw(), "pgid": pgid,
                    "syd_pid": syd_pid, "syd_pgid": syd_pgid);
            }
            _ => unreachable!(),
        };
    }

    #[cfg(feature = "kcov")]
    {
        crate::kcov_edge!();
        let _ = crate::kcov::abi::kcov_exit_for(cpid);
    }

    let kill_sig = match pid_act {
        // Allow|Deny|Panic cannot happen.
        action if action.is_signaling() => action.signal(),
        Action::Filter => Some(Signal::SIGKILL),
        Action::Warn => None,
        Action::Exit => std::process::exit(errno.unwrap_or(libc::EACCES)),
        _ => unreachable!(),
    };

    // Send signal to the process group, unless process shares their
    // process group with the current process.
    if let Some(kill_sig) = kill_sig {
        if kill_gid {
            let _ = killpg(Pid::from_raw(pgid), Some(kill_sig));
        } else {
            let _ = safe_kill(pid, kill_sig as libc::c_int);
        }
        None
    } else {
        Some(SydNotifResp::Cont { pid, signal: None })
    }
}