Re: libffi & fork

[Gaash Hazan <gaash@qwilt.com>]

Hi Andrew,

Thanks for the detailed answer.

I think I found the root cause of the problem. The libffi version that
I use (3.0.5) contains a bug in closures.c:selinux_enabled_check()
that incorrectly detected non-selinux systsem as selinux system.

Because system is detected (incorrectly) as selinux dlmap() does not
attempts to do mmap() for private anonymous block with write-exec
protection. It reverts to the trick with two mmap()s on a tmp file.
But trick does not with fork.

If the system is detected (correctly) as non-selinux, then dlmp()
would use anonymous write-exec mmap() and it would  not use the trick.
Hence the fork problem would not occurred.

The selinux detected problem was fixed in
https://github.com/atgreen/libffi/commit/eaf444eabc4c78703c0f98ac0197b1619c1b1bef#src/closures.c
(closures.c line 149)

Unfortunately Redhat 6.2 and 6.3-bets uses libffi 3.0.5 that has this problem.

Regards,
Gaash


On Thu, Apr 26, 2012 at 1:00 PM, Andrew Haley <aph@redhat.com> wrote:
>
> On 04/25/2012 06:32 PM, Gaash Hazan wrote:
> >> There is, as far as I can see, only one way to remedy this: allow
> >> python to map anonymous memory with both write and execute permission.
> >> Then it should work fine.
> >
> > I believe memory allocation is a service provided by the OS and not by
> > the application or interpreter.
>
> The usual problem is a mechanism such as SELinux that is forbidding
> Python from mmap()ing PROT_WRITE|PROT_EXEC .  If you label the
> executable unconfined_execmem_exec_t it may work because then libffi
> won't bother with all this multiple maps though a shared file
> descriptor business.
>
> > Python does not provide memory allocation service to libffi. In this
> > case libffi creates read-write-exec memory block using mmap to a tmp
> > file. I guess the problem is common to libff users and it is not
> > unique to python.
>
> It's special to Python because Python is the only common libffi client
> that forks and then tries to use the closures.
>
> > libffi uses mmap with MAP_SHARED at libffi:closures.c:dlmap(). What
> > was the reason for using MAP_SHARED  in the first place?
> >
> > I think MAP_PRIVATE would create the desired behavior of copy-on-write
> > when forked. Would that be a proper fix?
>
> No, memory regions that are backed by a real file are always shared
> between processes.  There is a single file descriptor that
> references the block of memory that holds the closures.  The only
> way you'll get it to work is to create a new file.
>
> Andrew.