Handling argc==0 in the kernel [LWN.net]

Handling argc==0 in the kernel

Posted Jan 28, 2022 15:21 UTC (Fri) by maxfragg (subscriber, #122266)
Parent article: Handling argc==0 in the kernel

For security reasons it would be a good idea to actually break with the rule of "envp == argv + argc + 1" and move env and argv to separate pages, with one guard in between. This convention really is risky and saving 2 pages does not seem worth it today.

Handling argc==0 in the kernel

Posted Jan 28, 2022 16:02 UTC (Fri) by Tobu (subscriber, #24111) [Link]

The way argc / argv[] / envp[] are laid out on the stack by the elf loader is part of the elf ABI (for existing architectures at least). You might be able to shuffle it in userspace, I guess.

Handling argc==0 in the kernel

Posted Jan 28, 2022 16:15 UTC (Fri) by jreiser (subscriber, #11027) [Link]

Breaking envp == (1+ argc + argv) wlll break all current ELF executables that have been statically linked against glibc. [Asking for a system that is highly robust requires that there be at least a few such programs.] It will also break all executable main programs that have been compressed by upx.

Handling argc==0 in the kernel

Posted Jan 28, 2022 17:26 UTC (Fri) by ariadne (subscriber, #138312) [Link] (5 responses)

Breaking contracts like the ELF ABI for security reasons is a bad idea, and this would be a far more severe ABI break than the one I proposed.

Handling argc==0 in the kernel

Posted Jan 28, 2022 20:14 UTC (Fri) by khim (subscriber, #9252) [Link] (4 responses)

Note that while, at one time, both C standard and POSIX allowed argc == 0 both are fixed now and POSIX, in fact, says that explicitly to remove any shadow of doubt:

> The wording, in particular the use of the word should, requires a Strictly Conforming POSIX Application to pass at least one argument to the exec function, thus guaranteeing that argc be one or greater when invoked by such an application.

So yes, it's a mess, kinda, because yes, old standards explicitly allowed this, but these standards were fixed.

Whether Linux can or should take advantage of that change is another story, of course.

Handling argc==0 in the kernel

Posted Jan 28, 2022 21:52 UTC (Fri) by developer122 (guest, #152928) [Link]

People care far less about standards written on paper than all the programs that will break or behave unexpectedly.

Handling argc==0 in the kernel

Posted Jan 29, 2022 0:23 UTC (Sat) by nybble41 (subscriber, #55106) [Link] (1 responses)

Linus's "no user regressions" policy covers *many* programs which are not Strictly Conforming POSIX Applications, so I'm not sure how that change in the standard is relevant. For example, anything that depends on Linux-specific interfaces, or on any implementation-defined behavior not specified by POSIX, is not a Strictly Conforming POSIX Application. (How many Strictly Conforming POSIX Applications are there in an average Linux installation, really?)

If you do claim to be a Strictly Conforming POSIX Application then you can't call exec with less than one argument. However, a Strictly Conforming POSIX Application may be *invoked* with zero arguments, and is required to handle that case as well to qualify as Strictly Conforming since POSIX does not specify that the argument list passed to main() will be non-empty and you can't assume every other program in the system is also Strictly Conforming.

Handling argc==0 in the kernel

Posted Jan 29, 2022 1:43 UTC (Sat) by Paf (subscriber, #91811) [Link]

It’s relevant insofar as the argument - which I believe was made in the article? - that “POSIX allows this” is used in support of it. It’s irrelevant insofar as there are real applications which use it (and one cares about them).

Handling argc==0 in the kernel

Posted Jan 29, 2022 10:43 UTC (Sat) by larkey (guest, #104463) [Link]

Absolutely not, POSIX says, more completely:

> Early proposals required that the value of argc passed to main() be "one or greater". This was driven by the same requirement in drafts of the ISO C standard. In fact, historical implementations have passed a value of zero when no arguments are supplied to the caller of the exec functions. This requirement was removed from the ISO C standard and subsequently removed from this volume of POSIX.1-2017 as well.

There's no hard requirement on argc.

> The wording, in particular the use of the word should, requires a Strictly Conforming POSIX Application to pass at least one argument to the exec function, thus guaranteeing that argc be one or greater when invoked by such an application. In fact, this is good practice, since many existing applications reference argv[0] without first checking the value of argc.

A *strictly* conforming application. This is more than just "plain" POSIX.