Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-97514: Authenticate the forkserver control socket. #99309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
Nov 20, 2024
Merged

gh-97514: Authenticate the forkserver control socket. #99309

Changes from 1 commit
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
d82afc8
Authenticate the forkserver control socket.
gpshead Nov 10, 2022
72f3843
improve some error handling and add a test.
gpshead Nov 11, 2022
c83193d
NEWS entry.
gpshead Nov 11, 2022
14f6f4d
Fix refleaks in the test.
gpshead Nov 13, 2022
8c5f7f4
minor news wording tweak.
gpshead Nov 13, 2022
ca47b6f
fix the hang on macOS by removing part of the test.
gpshead Nov 13, 2022
6f8e22f
clear up some comments and an assert
gpshead Nov 15, 2022
3bbbda7
Merge branch 'main' into security/multiprocessing-forkserver-authkey
gpshead Jun 21, 2023
0119b6a
Merge branch 'main' into security/multiprocessing-forkserver-authkey
gpshead Sep 24, 2024
ab9f93d
Add a comment about the fd recv acks.
gpshead Sep 24, 2024
7d41b16
Merge branch 'main' into security/multiprocessing-forkserver-authkey
gpshead Nov 10, 2024
6bb9db4
Address review comments: simplify & comment.
gpshead Nov 10, 2024
9c22c06
Add a whatsnew entry.
gpshead Nov 10, 2024
07c01d4
missing : sphinx-lint
gpshead Nov 10, 2024
a53c01f
Minor edits per @.picnixz code review comments.
gpshead Nov 10, 2024
db29006
Merge branch 'main' into security/multiprocessing-forkserver-authkey
gpshead Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
clear up some comments and an assert
  • Loading branch information
@gpshead
gpshead committed Nov 15, 2022
commit 6f8e22fb016810712d20f70013b718cef9c24a6f
8 changes: 3 additions & 5 deletions Lib/multiprocessing/forkserver.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,8 +177,8 @@ def ensure_running(self):
finally:
os.close(alive_r)
os.close(authkey_r)
# Prevent access from processes not in our process tree that
# have the same shared key for this forkserver.
# Authenticate our control socket to prevent access from
# processes we have not shared this key with.
try:
self._forkserver_authkey = os.urandom(_authkey_len)
os.write(authkey_w, self._forkserver_authkey)
Expand All @@ -196,10 +196,8 @@ def main(listener_fd, alive_r, preload, main_path=None, sys_path=None,
*, authkey_r=None):
"""Run forkserver."""
if authkey_r is not None:
# If there is no authkey, the parent closes the pipe without writing
# anything resulting in an empty authkey of b'' here.
authkey = os.read(authkey_r, _authkey_len)
assert len(authkey) == _authkey_len or not authkey
assert len(authkey) == _authkey_len, f'{len(authkey)} < {_authkey_len}'
os.close(authkey_r)
else:
authkey = b''
Expand Down