Source code
Revision control
Copy as Markdown
Other Tools
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
#include "nsProfileLock.h"
#include "nsCOMPtr.h"
#include "nsQueryObject.h"
#include "nsString.h"
#include "nsPrintfCString.h"
#include "nsDebug.h"
#if defined(XP_WIN)
# include "ProfileUnlockerWin.h"
#endif
#if defined(XP_MACOSX)
# include <Carbon/Carbon.h>
# include <CoreFoundation/CoreFoundation.h>
#endif
#if defined(MOZ_WIDGET_ANDROID)
# include "ProfileUnlockerAndroid.h"
#endif
#ifdef XP_UNIX
# include <unistd.h>
# include <fcntl.h>
# include <errno.h>
# include <signal.h>
# include <stdlib.h>
# include "prnetdb.h"
# include "prsystem.h"
# include "prenv.h"
# include "mozilla/Printf.h"
#endif
// **********************************************************************
// class nsProfileLock
//
// This code was moved from profile/src/nsProfileAccess.
// **********************************************************************
#if defined(XP_UNIX)
static bool sDisableSignalHandling = false;
#endif
nsProfileLock::nsProfileLock()
: mHaveLock(false),
mReplacedLockTime(0)
#if defined(XP_WIN)
,
mLockFileHandle(INVALID_HANDLE_VALUE)
#elif defined(XP_UNIX)
,
mPidLockFileName(nullptr),
mLockFileDesc(-1)
#endif
{
#if defined(XP_UNIX)
next = prev = this;
sDisableSignalHandling = PR_GetEnv("MOZ_DISABLE_SIG_HANDLER") ? true : false;
#endif
}
nsProfileLock::nsProfileLock(nsProfileLock& src) { *this = src; }
nsProfileLock& nsProfileLock::operator=(nsProfileLock& rhs) {
Unlock();
mHaveLock = rhs.mHaveLock;
rhs.mHaveLock = false;
#if defined(XP_WIN)
mLockFileHandle = rhs.mLockFileHandle;
rhs.mLockFileHandle = INVALID_HANDLE_VALUE;
#elif defined(XP_UNIX)
mLockFileDesc = rhs.mLockFileDesc;
rhs.mLockFileDesc = -1;
mPidLockFileName = rhs.mPidLockFileName;
rhs.mPidLockFileName = nullptr;
if (mPidLockFileName) {
// rhs had a symlink lock, therefore it was on the list.
PR_REMOVE_LINK(&rhs);
PR_APPEND_LINK(this, &mPidLockList);
}
#endif
return *this;
}
nsProfileLock::~nsProfileLock() {
Unlock();
// Note that we don't clean up by default here so on next startup we know when
// the profile was last used based on the modification time of the lock file.
}
#if defined(XP_UNIX)
static int setupPidLockCleanup;
PRCList nsProfileLock::mPidLockList =
PR_INIT_STATIC_CLIST(&nsProfileLock::mPidLockList);
void nsProfileLock::RemovePidLockFiles(bool aFatalSignal) {
while (!PR_CLIST_IS_EMPTY(&mPidLockList)) {
nsProfileLock* lock = static_cast<nsProfileLock*>(mPidLockList.next);
lock->Unlock(aFatalSignal);
}
}
static struct sigaction SIGHUP_oldact;
static struct sigaction SIGINT_oldact;
static struct sigaction SIGQUIT_oldact;
static struct sigaction SIGILL_oldact;
static struct sigaction SIGABRT_oldact;
static struct sigaction SIGSEGV_oldact;
static struct sigaction SIGTERM_oldact;
void nsProfileLock::FatalSignalHandler(int signo
# ifdef SA_SIGINFO
,
siginfo_t* info, void* context
# endif
) {
// Remove any locks still held.
RemovePidLockFiles(true);
// Chain to the old handler, which may exit.
struct sigaction* oldact = nullptr;
switch (signo) {
case SIGHUP:
oldact = &SIGHUP_oldact;
break;
case SIGINT:
oldact = &SIGINT_oldact;
break;
case SIGQUIT:
oldact = &SIGQUIT_oldact;
break;
case SIGILL:
oldact = &SIGILL_oldact;
break;
case SIGABRT:
oldact = &SIGABRT_oldact;
break;
case SIGSEGV:
oldact = &SIGSEGV_oldact;
break;
case SIGTERM:
oldact = &SIGTERM_oldact;
break;
default:
MOZ_ASSERT_UNREACHABLE("bad signo");
break;
}
if (oldact) {
if (oldact->sa_handler == SIG_DFL) {
// Make sure the default sig handler is executed
// We need it to get Mozilla to dump core.
sigaction(signo, oldact, nullptr);
// Now that we've restored the default handler, unmask the
// signal and invoke it.
sigset_t unblock_sigs;
sigemptyset(&unblock_sigs);
sigaddset(&unblock_sigs, signo);
sigprocmask(SIG_UNBLOCK, &unblock_sigs, nullptr);
raise(signo);
}
# ifdef SA_SIGINFO
else if (oldact->sa_sigaction &&
(oldact->sa_flags & SA_SIGINFO) == SA_SIGINFO) {
oldact->sa_sigaction(signo, info, context);
}
# endif
else if (oldact->sa_handler && oldact->sa_handler != SIG_IGN) {
oldact->sa_handler(signo);
}
}
// Backstop exit call, just in case.
_exit(signo);
}
nsresult nsProfileLock::LockWithFcntl(nsIFile* aLockFile,
nsIProfileUnlocker** aUnlocker) {
nsresult rv = NS_OK;
nsAutoCString lockFilePath;
rv = aLockFile->GetNativePath(lockFilePath);
if (NS_FAILED(rv)) {
NS_ERROR("Could not get native path");
return rv;
}
aLockFile->GetLastModifiedTime(&mReplacedLockTime);
mLockFileDesc = open(lockFilePath.get(), O_WRONLY | O_CREAT | O_TRUNC, 0666);
if (mLockFileDesc != -1) {
struct flock lock;
lock.l_start = 0;
lock.l_len = 0; // len = 0 means entire file
lock.l_type = F_WRLCK;
lock.l_whence = SEEK_SET;
// If fcntl(F_GETLK) fails then the server does not support/allow fcntl(),
// return failure rather than access denied in this case so we fallback
struct flock testlock = lock;
if (fcntl(mLockFileDesc, F_GETLK, &testlock) == -1) {
close(mLockFileDesc);
mLockFileDesc = -1;
rv = NS_ERROR_FAILURE;
} else if (fcntl(mLockFileDesc, F_SETLK, &lock) == -1) {
# ifdef MOZ_WIDGET_ANDROID
MOZ_ASSERT(aUnlocker);
RefPtr<mozilla::ProfileUnlockerAndroid> unlocker(
new mozilla::ProfileUnlockerAndroid(testlock.l_pid));
nsCOMPtr<nsIProfileUnlocker> unlockerInterface(do_QueryObject(unlocker));
unlockerInterface.forget(aUnlocker);
# endif
close(mLockFileDesc);
mLockFileDesc = -1;
// With OS X, on NFS, errno == ENOTSUP
// XXX Check for that and return specific rv for it?
# ifdef DEBUG
printf("fcntl(F_SETLK) failed. errno = %d\n", errno);
# endif
if (errno == EAGAIN || errno == EACCES)
rv = NS_ERROR_FILE_ACCESS_DENIED;
else
rv = NS_ERROR_FAILURE;
}
} else {
NS_ERROR("Failed to open lock file.");
rv = NS_ERROR_FAILURE;
}
return rv;
}
static bool IsSymlinkStaleLock(struct in_addr* aAddr, const char* aFileName,
bool aHaveFcntlLock) {
// the link exists; see if it's from this machine, and if
// so if the process is still active
char buf[1024];
int len = readlink(aFileName, buf, sizeof buf - 1);
if (len > 0) {
buf[len] = '\0';
char* colon = strchr(buf, ':');
if (colon) {
*colon++ = '\0';
unsigned long addr = inet_addr(buf);
if (addr != (unsigned long)-1) {
if (colon[0] == '+' && aHaveFcntlLock) {
// This lock was placed by a Firefox build which would have
// taken the fnctl lock, and we've already taken the fcntl lock,
// so the process that created this obsolete lock must be gone
return true;
}
char* after = nullptr;
pid_t pid = strtol(colon, &after, 0);
if (pid != 0 && *after == '\0') {
if (addr != aAddr->s_addr) {
// Remote lock: give up even if stuck.
return false;
}
// kill(pid,0) is a neat trick to check if a
// process exists
if (kill(pid, 0) == 0 || errno != ESRCH) {
// Local process appears to be alive, ass-u-me it
// is another Mozilla instance, or a compatible
// derivative, that's currently using the profile.
// XXX need an "are you Mozilla?" protocol
return false;
}
}
}
}
}
return true;
}
nsresult nsProfileLock::LockWithSymlink(nsIFile* aLockFile,
bool aHaveFcntlLock) {
nsresult rv;
nsAutoCString lockFilePath;
rv = aLockFile->GetNativePath(lockFilePath);
if (NS_FAILED(rv)) {
NS_ERROR("Could not get native path");
return rv;
}
// don't replace an existing lock time if fcntl already got one
if (!mReplacedLockTime)
aLockFile->GetLastModifiedTimeOfLink(&mReplacedLockTime);
struct in_addr inaddr;
inaddr.s_addr = htonl(INADDR_LOOPBACK);
// We still have not loaded the profile, so we may not have proxy information.
// Avoiding a DNS lookup in this stage makes sure any proxy is not bypassed.
// By default, the lookup is enabled, but when it is not, we use 127.0.0.1
// for the IP address portion of the lock signature.
// However, this may cause the browser to refuse to start in the rare case
// that all of the following conditions are met:
// 1. The browser profile is on a network file system.
// 2. The file system does not support fcntl() locking.
// 3. The browser is run from two different computers at the same time.
# ifndef MOZ_PROXY_BYPASS_PROTECTION
char hostname[256];
PRStatus status = PR_GetSystemInfo(PR_SI_HOSTNAME, hostname, sizeof hostname);
if (status == PR_SUCCESS) {
char netdbbuf[PR_NETDB_BUF_SIZE];
PRHostEnt hostent;
status = PR_GetHostByName(hostname, netdbbuf, sizeof netdbbuf, &hostent);
if (status == PR_SUCCESS) memcpy(&inaddr, hostent.h_addr, sizeof inaddr);
}
# endif
mozilla::SmprintfPointer signature =
mozilla::Smprintf("%s:%s%lu", inet_ntoa(inaddr),
aHaveFcntlLock ? "+" : "", (unsigned long)getpid());
const char* fileName = lockFilePath.get();
int symlink_rv, symlink_errno = 0, tries = 0;
// use ns4.x-compatible symlinks if the FS supports them
while ((symlink_rv = symlink(signature.get(), fileName)) < 0) {
symlink_errno = errno;
if (symlink_errno != EEXIST) break;
if (!IsSymlinkStaleLock(&inaddr, fileName, aHaveFcntlLock)) break;
// Lock seems to be bogus: try to claim it. Give up after a large
// number of attempts (100 comes from the 4.x codebase).
(void)unlink(fileName);
if (++tries > 100) break;
}
if (symlink_rv == 0) {
// We exclusively created the symlink: record its name for eventual
// unlock-via-unlink.
rv = NS_OK;
mPidLockFileName = strdup(fileName);
if (mPidLockFileName) {
PR_APPEND_LINK(this, &mPidLockList);
if (!setupPidLockCleanup++) {
// Clean up on normal termination.
// This instanciates a dummy class, and will trigger the class
// destructor when libxul is unloaded. This is equivalent to atexit(),
// but gracefully handles dlclose().
static RemovePidLockFilesExiting r;
// Clean up on abnormal termination, using POSIX sigaction.
// Don't arm a handler if the signal is being ignored, e.g.,
// because mozilla is run via nohup.
if (!sDisableSignalHandling) {
struct sigaction act, oldact;
# ifdef SA_SIGINFO
act.sa_sigaction = FatalSignalHandler;
act.sa_flags = SA_SIGINFO | SA_ONSTACK;
# else
act.sa_handler = FatalSignalHandler;
# endif
sigfillset(&act.sa_mask);
# define CATCH_SIGNAL(signame) \
PR_BEGIN_MACRO \
if (sigaction(signame, nullptr, &oldact) == 0 && \
oldact.sa_handler != SIG_IGN) { \
sigaction(signame, &act, &signame##_oldact); \
} \
PR_END_MACRO
CATCH_SIGNAL(SIGHUP);
CATCH_SIGNAL(SIGINT);
CATCH_SIGNAL(SIGQUIT);
CATCH_SIGNAL(SIGILL);
CATCH_SIGNAL(SIGABRT);
CATCH_SIGNAL(SIGSEGV);
CATCH_SIGNAL(SIGTERM);
# undef CATCH_SIGNAL
}
}
}
} else if (symlink_errno == EEXIST)
rv = NS_ERROR_FILE_ACCESS_DENIED;
else {
# ifdef DEBUG
printf("symlink() failed. errno = %d\n", errno);
# endif
rv = NS_ERROR_FAILURE;
}
return rv;
}
#endif /* XP_UNIX */
nsresult nsProfileLock::GetReplacedLockTime(PRTime* aResult) {
*aResult = mReplacedLockTime;
return NS_OK;
}
#if defined(XP_MACOSX)
constexpr auto LOCKFILE_NAME = u".parentlock"_ns;
constexpr auto OLD_LOCKFILE_NAME = u"parent.lock"_ns;
#elif defined(XP_UNIX)
constexpr auto OLD_LOCKFILE_NAME = u"lock"_ns;
constexpr auto LOCKFILE_NAME = u".parentlock"_ns;
#else
constexpr auto LOCKFILE_NAME = u"parent.lock"_ns;
#endif
bool nsProfileLock::IsMaybeLockFile(nsIFile* aFile) {
nsAutoString tmp;
if (NS_SUCCEEDED(aFile->GetLeafName(tmp))) {
if (tmp.Equals(LOCKFILE_NAME)) return true;
#if (defined(XP_MACOSX) || defined(XP_UNIX))
if (tmp.Equals(OLD_LOCKFILE_NAME)) return true;
#endif
}
return false;
}
nsresult nsProfileLock::Lock(nsIFile* aProfileDir,
nsIProfileUnlocker** aUnlocker) {
nsresult rv;
if (aUnlocker) *aUnlocker = nullptr;
NS_ENSURE_STATE(!mHaveLock);
bool isDir;
rv = aProfileDir->IsDirectory(&isDir);
if (NS_FAILED(rv)) return rv;
if (!isDir) return NS_ERROR_FILE_NOT_DIRECTORY;
nsCOMPtr<nsIFile> lockFile;
rv = aProfileDir->Clone(getter_AddRefs(lockFile));
if (NS_FAILED(rv)) return rv;
rv = lockFile->Append(LOCKFILE_NAME);
if (NS_FAILED(rv)) return rv;
// Remember the name we're using so we can clean up
rv = lockFile->Clone(getter_AddRefs(mLockFile));
if (NS_FAILED(rv)) return rv;
#if defined(XP_MACOSX)
// First, try locking using fcntl. It is more reliable on
// a local machine, but may not be supported by an NFS server.
rv = LockWithFcntl(lockFile);
if (NS_FAILED(rv) && (rv != NS_ERROR_FILE_ACCESS_DENIED)) {
// If that failed for any reason other than NS_ERROR_FILE_ACCESS_DENIED,
// assume we tried an NFS that does not support it. Now, try with symlink.
rv = LockWithSymlink(lockFile, false);
}
#elif defined(XP_UNIX)
// Get the old lockfile name
nsCOMPtr<nsIFile> oldLockFile;
rv = aProfileDir->Clone(getter_AddRefs(oldLockFile));
if (NS_FAILED(rv)) return rv;
rv = oldLockFile->Append(OLD_LOCKFILE_NAME);
if (NS_FAILED(rv)) return rv;
// First, try locking using fcntl. It is more reliable on
// a local machine, but may not be supported by an NFS server.
rv = LockWithFcntl(lockFile, aUnlocker);
if (NS_SUCCEEDED(rv)) {
// Check to see whether there is a symlink lock held by an older
// Firefox build, and also place our own symlink lock --- but
// mark it "obsolete" so that other newer builds can break the lock
// if they obtain the fcntl lock
rv = LockWithSymlink(oldLockFile, true);
// If the symlink failed for some reason other than it already
// exists, then something went wrong e.g. the file system
// doesn't support symlinks, or we don't have permission to
// create a symlink there. In such cases we should just
// continue because it's unlikely there is an old build
// running with a symlink there and we've already successfully
// placed a fcntl lock.
if (rv != NS_ERROR_FILE_ACCESS_DENIED) rv = NS_OK;
} else if (rv != NS_ERROR_FILE_ACCESS_DENIED) {
// If that failed for any reason other than NS_ERROR_FILE_ACCESS_DENIED,
// assume we tried an NFS that does not support it. Now, try with symlink
// using the old symlink path
rv = LockWithSymlink(oldLockFile, false);
}
#elif defined(XP_WIN)
nsAutoString filePath;
rv = lockFile->GetPath(filePath);
if (NS_FAILED(rv)) return rv;
lockFile->GetLastModifiedTime(&mReplacedLockTime);
// always create the profile lock and never delete it so we can use its
// modification timestamp to detect startup crashes
mLockFileHandle = CreateFileW(filePath.get(), GENERIC_READ | GENERIC_WRITE,
0, // no sharing - of course
nullptr, CREATE_ALWAYS, 0, nullptr);
if (mLockFileHandle == INVALID_HANDLE_VALUE) {
if (aUnlocker) {
RefPtr<mozilla::ProfileUnlockerWin> unlocker(
new mozilla::ProfileUnlockerWin(filePath));
if (NS_SUCCEEDED(unlocker->Init())) {
nsCOMPtr<nsIProfileUnlocker> unlockerInterface(
do_QueryObject(unlocker));
unlockerInterface.forget(aUnlocker);
}
}
return NS_ERROR_FILE_ACCESS_DENIED;
}
#endif
if (NS_SUCCEEDED(rv)) mHaveLock = true;
return rv;
}
nsresult nsProfileLock::Unlock(bool aFatalSignal) {
nsresult rv = NS_OK;
if (mHaveLock) {
#if defined(XP_WIN)
if (mLockFileHandle != INVALID_HANDLE_VALUE) {
CloseHandle(mLockFileHandle);
mLockFileHandle = INVALID_HANDLE_VALUE;
}
#elif defined(XP_UNIX)
if (mPidLockFileName) {
PR_REMOVE_LINK(this);
(void)unlink(mPidLockFileName);
// Only free mPidLockFileName if we're not in the fatal signal
// handler. The problem is that a call to free() might be the
// cause of this fatal signal. If so, calling free() might cause
// us to wait on the malloc implementation's lock. We're already
if (!aFatalSignal) free(mPidLockFileName);
mPidLockFileName = nullptr;
}
if (mLockFileDesc != -1) {
close(mLockFileDesc);
mLockFileDesc = -1;
// Don't remove it
}
#endif
mHaveLock = false;
}
return rv;
}
nsresult nsProfileLock::Cleanup() {
if (mHaveLock) {
return NS_ERROR_FILE_IS_LOCKED;
}
if (mLockFile) {
nsresult rv = mLockFile->Remove(false);
NS_ENSURE_SUCCESS(rv, rv);
mLockFile = nullptr;
}
return NS_OK;
}