remove explicit locking to prevent __synccall setuid during posix_spawn

for the duration of the vm-sharing clone used by posix_spawn, all
signals are blocked in the parent process, including
implementation-internal signals. since __synccall cannot do anything
until successfully signaling all threads, the fact that signals are
blocked automatically yields the necessary safety.

aside from debloating and general simplification, part of the
motivation for removing the explicit lock is to simplify the
synchronization logic of __synccall in hopes that it can be made
async-signal-safe, which is needed to make setuid and setgid, which
depend on __synccall, conform to the standard. whether this will be
possible remains to be seen.

diff --git a/src/process/posix_spawn.c b/src/process/posix_spawn.c
index dd45012..e6a031c 100644 (file)
--- a/src/process/posix_spawn.c
+++ b/src/process/posix_spawn.c
@@ -10,12 +10,6 @@
 #include "fdop.h"
 #include "libc.h"
 
-static void dummy_0()
-{
-}
-weak_alias(dummy_0, __acquire_ptc);
-weak_alias(dummy_0, __release_ptc);
-
 struct args {
        int p[2];
        sigset_t oldmask;
@@ -144,10 +138,6 @@ int __posix_spawnx(pid_t *restrict res, const char *restrict path,
        args.envp = envp;
        pthread_sigmask(SIG_BLOCK, SIGALL_SET, &args.oldmask);
 
-       /* This lock prevents setuid/setgid operations while the parent
-        * is sharing memory with the child. Situations where processes
-        * with different permissions share VM are fundamentally unsafe. */
-       __acquire_ptc();
        pid = __clone(child, stack+sizeof stack, CLONE_VM|SIGCHLD, &args);
        close(args.p[1]);
 
@@ -158,9 +148,6 @@ int __posix_spawnx(pid_t *restrict res, const char *restrict path,
                ec = -pid;
        }
 
-       /* At this point, the child has either exited or successfully
-        * performed exec, so the lock may be released. */
-       __release_ptc();
        close(args.p[0]);
 
        if (!ec) *res = pid;