aboutsummaryrefslogtreecommitdiff
path: root/src/syscall/exec_windows.go
AgeCommit message (Collapse)Author
2022-11-01syscall, os/exec: reject environment variables containing NULsDamien Neil
Check for and reject environment variables containing NULs. The conventions for passing environment variables to subprocesses cause most or all systems to interpret a NUL as a separator. The syscall package rejects environment variables containing a NUL on most systems, but erroniously did not do so on Windows. This causes an environment variable such as "FOO=a\x00BAR=b" to be interpreted as "FOO=a", "BAR=b". Check for and reject NULs in environment variables passed to syscall.StartProcess on Windows. Add a redundant check to os/exec as extra insurance. Fixes #56284 Fixes CVE-2022-41716 Change-Id: I2950e2b0cb14ebd26e5629be1521858f66a7d4ae Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1609434 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/446916 Reviewed-by: Tatiana Bradley <tatiana@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Matthew Dempsky <mdempsky@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-04-01all: fix various doc comment formatting nitsRuss Cox
A run of lines that are indented with any number of spaces or tabs format as a <pre> block. This commit fixes various doc comments that format badly according to that (standard) rule. For example, consider: // - List item. // Second line. // - Another item. Because the - lines are unindented, this is actually two paragraphs separated by a one-line <pre> block. This CL rewrites it to: // - List item. // Second line. // - Another item. Today, that will format as a single <pre> block. In a future release, we hope to format it as a bulleted list. Various other minor fixes as well, all in preparation for reformatting. For #51082. Change-Id: I95cf06040d4186830e571cd50148be3bf8daf189 Reviewed-on: https://go-review.googlesource.com/c/go/+/384257 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-09-17syscall: do not use handle lists on windows when NoInheritHandles is trueJason A. Donenfeld
If NoInheritHandles is passed, then we shouldn't attempt to do anything with handle lists. Otherwise CreateProcess fails with invalid param, because it's being told both to not inherit handles and to inherit certain handles. This commit fixes that by using the same logic for handle lists as it does for enabling or disabling handle inheritance. It also adds a test to make sure this doesn't regress again. Fixes #48040 Change-Id: I507261baeec263091738ab90157a991d917dc92f Reviewed-on: https://go-review.googlesource.com/c/go/+/350411 Reviewed-by: Patrik Nyblom <pnyb@google.com> Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org>
2021-06-04syscall: do not pass console handles to PROC_THREAD_ATTRIBUTE_HANDLE_LIST on ↵Jason A. Donenfeld
Windows 7 On Windows 7 (and below), console handles are not real kernel handles but are rather userspace objects, with information passed via special bits in the handle itself. That means they can't be passed in PROC_THREAD_ATTRIBUTE_HANDLE_LIST, even though they can be inherited. So, we filter the list passed to PROC_THREAD_ATTRIBUTE_HANDLE_LIST to not have any console handles on Windows 7. At the same time, it turns out that the presence of a NULL handle in the list is enough to render PROC_THREAD_ATTRIBUTE_HANDLE_LIST completely useless, so filter these out too. Console handles also can't be duplicated into parent processes, as inhertance always happens from the present process, so duplicate always into the present process even when a parent process is specified. Fixes #45914. Change-Id: I70b4ff4874dbf0507d9ec9278f63b9b4dd4f1999 Reviewed-on: https://go-review.googlesource.com/c/go/+/319310 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Trust: Alex Brainman <alex.brainman@gmail.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2021-03-11syscall: use runtime.KeepAlive for ProcThreadAttributeList argumentsJason A. Donenfeld
It turns out that if you write Go pointers to Go memory, the Go compiler must be involved so that it generates various calls to the GC in the process. Letting Windows write Go pointers to Go memory violated this. So, we replace that with just a boring call to runtime.KeepAlive. That's not a great API, but this is all internal code anyway. We fix it up more elegantly for external consumption in x/sys/windows with CL 300369. Fixes #44900. Change-Id: Id6599a793af9c4815f6c9387b00796923f32cb97 Reviewed-on: https://go-review.googlesource.com/c/go/+/300349 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2021-03-04syscall: treat proc thread attribute lists as unsafe.PointersJason A. Donenfeld
It turns out that the proc thread update function doesn't actually allocate new memory for its arguments and instead just copies the pointer values into the preallocated memory. Since we were allocating that memory as []byte, the garbage collector didn't scan it for pointers to Go allocations and freed them. We _could_ fix this by requiring that all users of this use runtime.KeepAlive for everything they pass to the update function, but that seems harder than necessary. Instead, we can just do the allocation as []unsafe.Pointer, which means the GC can operate as intended and not free these from beneath our feet. In order to ensure this remains true, we also add a test for this. Fixes #44662. Change-Id: Ib392ba8ceacacec94b11379919c8179841cba29f Reviewed-on: https://go-review.googlesource.com/c/go/+/297389 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Trust: Alex Brainman <alex.brainman@gmail.com> Trust: Bryan C. Mills <bcmills@google.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-02-26syscall: introduce SysProcAttr.ParentProcess on WindowsJason A. Donenfeld
This allows users to specify which process should be used as the parent process when creating a new process. Note that this doesn't just trivially pass the handle onward to PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, because inherited handles must be valid in the parent process, so if we're changing the destination process, then we must also change the origin of the parent handles. And, the StartProcess function must clean up these handles successfully when exiting, regardless of where the duplication happened. So, we take care in this commit to use DuplicateHandle for both duplicating and for closing the inherited handles. The test was taken originally from CL 288272 and adjusted for use here. Fixes #44011. Change-Id: Ib3b132028dcab1aded3dc0e65126c8abebfa35eb Reviewed-on: https://go-review.googlesource.com/c/go/+/288300 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Trust: Alex Brainman <alex.brainman@gmail.com> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2021-02-26syscall: introduce SysProcAttr.AdditionalInheritedHandles on WindowsJason A. Donenfeld
This allows users to specify handles that they explicitly want to be inherited by the new process. These handles must already be marked as inheritable. Updates #44011. Updates #21085. Change-Id: Ib18322e7dc2909e68c4209e80385492804fa15d3 Reviewed-on: https://go-review.googlesource.com/c/go/+/288298 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2021-02-26syscall: restrict inherited handles on WindowsJason A. Donenfeld
Windows does not have CLOEXEC, but rather handles are marked explicitly for being inherited by new processes. This can cause problems when different Windows functions create new processes from different threads. syscall.StartProcess has traditionally used a mutex to prevent races with itself, but this doesn't handle races with other win32 functions. Fortunately there's a solution: PROC_THREAD_ATTRIBUTE_HANDLE_LIST allows us to pass the entire list of handles that we want to be inherited. This lets us get rid of the mutex and also makes process creation safe across the Go runtime, no matter the context. Updates #44011. Change-Id: Ia3424cd2ec64868849cbd6cbb5b0d765224bf4ab Reviewed-on: https://go-review.googlesource.com/c/go/+/288297 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Trust: Alex Brainman <alex.brainman@gmail.com> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2020-11-05syscall: expose bInheritHandles of CreateProcessJohan Knutzen
Certain use cases require this parameter to be false. This includes spawning a child process in a different windows session than session 0. Docs regarding the behavior of this parameter to CreateProcess: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa Fixes #42098 Change-Id: If998f57d6f2962824aacbee75e1b508b255ab293 GitHub-Last-Rev: 584eb13e36a3ef7e0cd959295e92fb129f21d1f8 GitHub-Pull-Request: golang/go#41957 Reviewed-on: https://go-review.googlesource.com/c/go/+/261917 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Trust: Tobias Klauser <tobias.klauser@gmail.com> Trust: Alex Brainman <alex.brainman@gmail.com>
2020-10-08syscall: restore EscapeArg behavior for empty stringIan Lance Taylor
Accidentally broken by CL 259978. For #41825 Change-Id: Id663514e6eefa325faccdb66493d0bb2b3281046 Reviewed-on: https://go-review.googlesource.com/c/go/+/260397 Trust: Ian Lance Taylor <iant@golang.org> Trust: Alex Brainman <alex.brainman@gmail.com> Trust: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-10-07syscall: rewrite Windows makeCmdLine to use []byteIan Lance Taylor
It's faster to append to a []byte and only convert to string at the end then it is to build up a string by concatenating characters. Fixes #41825 Change-Id: I45ddf77dcc62726c919f0533c95d483cee8ba366 Reviewed-on: https://go-review.googlesource.com/c/go/+/259978 Trust: Ian Lance Taylor <iant@golang.org> Trust: Alex Brainman <alex.brainman@gmail.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2019-04-28syscall: allow setting security attributes on processesJason A. Donenfeld
This allows creating processes that can only be debugged/accessed by certain tokens, according to a particular security descriptor. We already had everything ready for this but just neglected to pass through the value from the user-accessible SysProcAttr. Change-Id: I4a3fcc9f5078aa0058b26c103355c984093ae03f Reviewed-on: https://go-review.googlesource.com/c/go/+/174197 Run-TryBot: Jason Donenfeld <Jason@zx2c4.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2018-06-01all: update comment URLs from HTTP to HTTPS, where possibleTim Cooper
Each URL was manually verified to ensure it did not serve up incorrect content. Change-Id: I4dc846227af95a73ee9a3074d0c379ff0fa955df Reviewed-on: https://go-review.googlesource.com/115798 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2017-11-07syscall: change SysProcAttr.Token type to TokenAlex Brainman
CL 75253 introduced new SysProcAttr.Token field as Handle. But we already have exact type for it - Token. Use Token instead of Handle everywhere - it saves few type conversions and provides better documentation for new API. Change-Id: Ibc5407a234a1f49804de15a24b27c8e6a6eba7e0 Reviewed-on: https://go-review.googlesource.com/76314 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-11-06syscall: add Token to Windows SysProcAttrPaul Querna
Fixes #21105 Change-Id: Ia2dea9b82a356795f581ce75616198b46e97abb6 Reviewed-on: https://go-review.googlesource.com/75253 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
2016-08-22syscall: delete unreachable codeJosh Bleecher Snyder
Change-Id: Iacedb792c73591b7fd75e836aab8e0e117c8e738 Reviewed-on: https://go-review.googlesource.com/27494 Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2015-06-29syscall: return error instead of panicking in windows StartProcessAlex Brainman
Fixes #11417 Change-Id: Iacea829a48b39df0a4f751b06b19e918fbb713d0 Reviewed-on: https://go-review.googlesource.com/11604 Reviewed-by: Rob Pike <r@golang.org>
2015-04-08all: fix race when allocating buffer for some windows syscallsAlex Brainman
Fixes #9753 Change-Id: I6c641ed7ef4f687a108e7d937ab4b9c24d5baf5d Reviewed-on: https://go-review.googlesource.com/4940 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2014-09-08build: move package sources from src/pkg to srcRuss Cox
Preparation was in CL 134570043. This CL contains only the effect of 'hg mv src/pkg/* src'. For more about the move, see golang.org/s/go14nopkg.
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 17:39:16 +0000