public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "mtk.manpages at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug libc/27053] New: Conformance regression in system(3) (and probably also pclose(3))
Date: Fri, 11 Dec 2020 14:08:01 +0000	[thread overview]
Message-ID: <bug-27053-131@http.sourceware.org/bugzilla/> (raw)

https://sourceware.org/bugzilla/show_bug.cgi?id=27053

            Bug ID: 27053
           Summary: Conformance regression in system(3) (and probably also
                    pclose(3))
           Product: glibc
           Version: 2.33
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: mtk.manpages at gmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 13037
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13037&action=edit
Test program to examine return value of system()

According to the POSIX specification of the system() function:

       If some error prevents the command language
       interpreter from executing after the child process is
       created, the return value from system() shall be as if
       the command language interpreter had terminated using
       exit(127) or _exit(127).

Thus, for example, if no shell is present, or the shell pathname is not
executable, then the return value from system() should be as though the child
had done _exit(127).

This was once true in the glibc implementation, but is no longer true. I think
the change must have come in glibc 2.29, with 

commit 5fb7fc96350575c9adb1316833e48ca11553be49
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Oct 24 16:29:38 2018 -0300

    posix: Use posix_spawn on system

That commit removed these lines from sysdeps/posix/system.c:

-      /* Exec the shell.  */
-      (void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);
-      _exit (127);

I suspect, but have not tested, that a similar nonconformance to the spec has
been triggered in pclose() with the following commit:

commit 14d0e87d9b8caaa2eca7ca81f1189596671fe4fb
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Sep 12 10:32:05 2018 -0300

    posix: Use posix_spawn on popen

====

I've attached a test program. Here's a demo run:

$ ls -l /bin/sh
lrwxrwxrwx. 1 root root 4 Jul 27 15:18 /bin/sh -> bash
$ sudo chmod 0 /bin/bash
$ ./a.out date
system() returned: status=0xffffffff (-1,255)
system: Permission denied

The expected output when running the test program was:

system() returned: status=0x7f00 (127,0)
(Probably) could not invoke shell

-- 
You are receiving this mail because:
You are on the CC list for the bug.

             reply	other threads:[~2020-12-11 14:08 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-11 14:08 mtk.manpages at gmail dot com [this message]
2020-12-11 14:08 ` [Bug libc/27053] " mtk.manpages at gmail dot com
2020-12-11 14:27 ` adhemerval.zanella at linaro dot org
2021-01-11 16:44 ` adhemerval.zanella at linaro dot org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-27053-131@http.sourceware.org/bugzilla/ \
    --to=sourceware-bugzilla@sourceware.org \
    --cc=glibc-bugs@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).