[HOTFIX] Resolve race condition in exit signal

- Reinstates SIGUSR1 coordination
- Corrects signal dispatch logic
- Simplifies SignalConfig
- Reinstates SpawnDirectory functionality

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bimini"
-version = "0.11.0"
+version = "0.11.1"
 edition = "2021"
 
 [profile.release]

bimini-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bimini-core"
-version = "0.11.0"
+version = "0.11.1"
 edition = "2021"
 
 [dependencies]

bimini-core/src/nix/mod.rs

@@ -9,6 +9,3 @@ pub use groups_iter::GroupsIter;
 
 mod signal_config;
 pub use signal_config::SignalConfig;
-
-mod spawn_directory;
-pub use spawn_directory::SpawnDirectory;

bimini-core/src/nix/signal_config.rs

@@ -1,36 +1,40 @@
-use nix::sys::signal;
-
 use crate::error::BiminiResult;
+use nix::{errno, sys::signal};
 
-#[derive(Clone, Debug)]
+#[derive(Debug, Clone)]
 pub struct SignalConfig {
-    parent_signals: signal::SigSet,
-    source_signals: signal::SigSet,
+    mask_set: signal::SigSet,
+    source_set: signal::SigSet,
     sigttin_action: signal::SigAction,
     sigttou_action: signal::SigAction,
 }
 
-impl SignalConfig {
-    pub fn parent_signals(&self) -> &signal::SigSet {
-        &self.parent_signals
-    }
-
-    pub fn source_signals(&self) -> &signal::SigSet {
-        &self.source_signals
-    }
-
-    pub fn sigttin_action(&self) -> &signal::SigAction {
-        &self.sigttin_action
-    }
-
-    pub fn sigttou_action(&self) -> &signal::SigAction {
-        &self.sigttou_action
+impl Default for SignalConfig {
+    fn default() -> Self {
+        Self::new(&[
+            // Un-blockable signals
+            signal::SIGKILL,
+            signal::SIGSTOP,
+            // Program signals
+            signal::SIGABRT,
+            signal::SIGBUS,
+            #[cfg(not(target_os = "linux"))]
+            signal::SIGEMT,
+            signal::SIGFPE,
+            signal::SIGILL,
+            signal::SIGIOT,
+            signal::SIGSEGV,
+            signal::SIGSYS,
+            signal::SIGTRAP,
+        ])
     }
+}
 
-    pub fn new(protected_signals: Vec<signal::Signal>) -> Self {
-        let mut parent_signals = signal::SigSet::all();
-        for signal in protected_signals {
-            parent_signals.remove(signal)
+impl SignalConfig {
+    pub fn new(protected_signals: &[signal::Signal]) -> Self {
+        let mut mask = signal::SigSet::all();
+        for sig in protected_signals {
+            mask.remove(*sig);
         }
 
         let ignore_action = signal::SigAction::new(
@@ -39,59 +43,49 @@ impl SignalConfig {
             signal::SigSet::empty(),
         );
 
-        SignalConfig {
-            parent_signals,
-            source_signals: signal::SigSet::empty(),
+        Self {
+            mask_set: mask,
+            source_set: signal::SigSet::empty(),
             sigttin_action: ignore_action,
             sigttou_action: ignore_action,
         }
     }
 
-    pub fn mask(&mut self) -> BiminiResult<()> {
-        signal::sigprocmask(
+    pub fn mask(&mut self) -> BiminiResult<&mut Self> {
+        signal::pthread_sigmask(
             signal::SigmaskHow::SIG_SETMASK,
-            Some(&self.parent_signals),
-            Some(&mut self.source_signals),
+            Some(&self.mask_set),
+            Some(&mut self.source_set),
         )?;
 
         unsafe {
             self.sigttin_action = signal::sigaction(signal::SIGTTIN, &self.sigttin_action)?;
             self.sigttou_action = signal::sigaction(signal::SIGTTOU, &self.sigttou_action)?;
         }
 
-        Ok(())
+        Ok(self)
     }
 
-    pub fn unmask(&mut self) -> BiminiResult<()> {
-        signal::sigprocmask(
+    pub fn unmask(&mut self) -> BiminiResult<&mut Self> {
+        signal::pthread_sigmask(
             signal::SigmaskHow::SIG_SETMASK,
-            Some(&self.source_signals),
+            Some(&self.source_set),
             None,
         )?;
 
-        self.source_signals = signal::SigSet::empty();
-
         unsafe {
             signal::sigaction(signal::SIGTTIN, &self.sigttin_action)?;
             signal::sigaction(signal::SIGTTOU, &self.sigttou_action)?;
         }
 
-        Ok(())
+        Ok(self)
     }
-}
 
-impl Default for SignalConfig {
-    fn default() -> Self {
-        SignalConfig::new(vec![
-            signal::SIGFPE,
-            signal::SIGILL,
-            signal::SIGSEGV,
-            signal::SIGBUS,
-            signal::SIGABRT,
-            signal::SIGTRAP,
-            signal::SIGSYS,
-            signal::SIGTTIN,
-            signal::SIGTTOU,
-        ])
+    pub fn mask_wait(&self) -> Result<signal::Signal, errno::Errno> {
+        self.mask_set.wait()
+    }
+
+    pub fn source_wait(&self) -> Result<signal::Signal, errno::Errno> {
+        self.source_set.wait()
     }
 }

bimini-core/src/nix/user_spec.rs

@@ -8,8 +8,8 @@ use crate::{error::BiminiResult, nix::ToEnv};
 
 #[derive(Clone, Debug)]
 pub struct UserSpec {
-    user: Option<unistd::User>,
-    group: Option<unistd::Group>,
+    pub user: Option<unistd::User>,
+    pub group: Option<unistd::Group>,
 }
 
 impl UserSpec {

bimini-core/src/proc/child.rs

@@ -1,12 +1,13 @@
 use crate::{
     aws::AwsClient,
     error::{BiminiError, BiminiResult},
-    nix::{SignalConfig, SpawnDirectory, ToEnv, UserSpec},
+    nix::{SignalConfig, ToEnv, UserSpec},
+    proc::SpawnDirectory,
     vault::VaultClient,
 };
 use derive_builder::Builder;
 use nix::{errno, unistd};
-use std::{collections::HashMap, env, os::unix::process::CommandExt, process};
+use std::{collections::HashMap, env, os::unix::process::CommandExt, path::PathBuf, process};
 
 #[derive(Builder)]
 #[builder(build_fn(error = "BiminiError"), pattern = "owned")]
@@ -17,7 +18,7 @@ pub struct Child<'a> {
     user_spec: Option<UserSpec>,
 
     #[builder(default)]
-    spawn_directory: Option<SpawnDirectory>,
+    spawn_directory: Option<PathBuf>,
 
     #[builder(default)]
     aws_client: Option<AwsClient>,
@@ -76,15 +77,23 @@ impl<'a> Child<'a> {
             proc.envs(user_spec.to_env());
         }
 
-        if let Some(spawn_directory) = &self.spawn_directory {
-            tracing::debug!("Spawn directory provided, changing proc root");
-            spawn_directory.chdir()?;
-            proc.envs(spawn_directory.to_env());
-        }
-
+        tracing::trace!("Changing proc working directory");
+        let mut spawn_directory = SpawnDirectory::new(
+            self.spawn_directory.clone(),
+            self.user_spec
+                .as_ref()
+                .and_then(|user_spec| user_spec.user.clone()),
+        );
+        spawn_directory.chdir();
+        proc.envs(spawn_directory.to_env());
+
+        tracing::trace!("Creating a new proc group for child");
         self.isolate()?;
+
+        tracing::trace!("Clearing inherited sigmask");
         self.signal_config.unmask()?;
 
+        tracing::trace!("Execing child proc");
         let error = proc.exec();
 
         if let Some(errno) = error.raw_os_error() {
@@ -101,7 +110,7 @@ impl<'a> ToEnv for Child<'a> {
             (String::from("BIMINI"), String::from("true")),
             (
                 String::from("BIMINI_VERSION"),
-                String::from(env!("CARGO_PKG_VERSION")),
+                String::from(crate::PKG_VERSION),
             ),
             (
                 String::from("BIMINI_CHILD_PID"),