This should launch a new browser window with debugging enabled..
Underlying exception:
-{ex}
+{WebUtility.HtmlEncode(ex.ToString())}
");
return;
diff --git a/src/native/corehost/dotnet/CMakeLists.txt b/src/native/corehost/dotnet/CMakeLists.txt
index dab92ad6518576..55602c0f70c18e 100644
--- a/src/native/corehost/dotnet/CMakeLists.txt
+++ b/src/native/corehost/dotnet/CMakeLists.txt
@@ -24,6 +24,10 @@ add_executable(dotnet ${SOURCES})
target_link_libraries(dotnet PRIVATE hostmisc fxr_resolver)
+if(CLR_CMAKE_TARGET_OSX)
+ set_macos_bundle_identifier(dotnet com.microsoft.dotnet.dotnet)
+endif()
+
add_sanitizer_runtime_support(dotnet)
if(NOT CLR_CMAKE_TARGET_WIN32)
diff --git a/src/native/corehost/hostmisc/pal.unix.cpp b/src/native/corehost/hostmisc/pal.unix.cpp
index 3663716c232fcd..be613a0c688e58 100644
--- a/src/native/corehost/hostmisc/pal.unix.cpp
+++ b/src/native/corehost/hostmisc/pal.unix.cpp
@@ -186,9 +186,7 @@ bool pal::get_default_breadcrumb_store(string_t* recv)
if (!pal::directory_exists(ext))
{
trace::info(_X("Directory core breadcrumbs [%s] was not specified or found"), ext.c_str());
- ext.clear();
- append_path(&ext, _X("opt"));
- append_path(&ext, _X("corebreadcrumbs"));
+ ext.assign(DIR_SEPARATOR_STR _X("opt") DIR_SEPARATOR_STR _X("corebreadcrumbs"));
if (!pal::directory_exists(ext))
{
trace::info(_X("Fallback directory core breadcrumbs at [%s] was not found"), ext.c_str());
@@ -196,9 +194,11 @@ bool pal::get_default_breadcrumb_store(string_t* recv)
}
}
- if (access(ext.c_str(), (R_OK | W_OK)) != 0)
+ // Writing breadcrumbs creates files at known paths, which requires write and search permission on the directory.
+ if (access(ext.c_str(), (W_OK | X_OK)) != 0)
{
- trace::info(_X("Breadcrumb store [%s] is not ACL-ed with rw-"), ext.c_str());
+ trace::info(_X("Breadcrumb store [%s] is not writable"), ext.c_str());
+ return false;
}
recv->assign(ext);
@@ -218,9 +218,7 @@ bool pal::get_default_servicing_directory(string_t* recv)
if (!pal::directory_exists(ext))
{
trace::info(_X("Directory core servicing at [%s] was not specified or found"), ext.c_str());
- ext.clear();
- append_path(&ext, _X("opt"));
- append_path(&ext, _X("coreservicing"));
+ ext.assign(DIR_SEPARATOR_STR _X("opt") DIR_SEPARATOR_STR _X("coreservicing"));
if (!pal::directory_exists(ext))
{
trace::info(_X("Fallback directory core servicing at [%s] was not found"), ext.c_str());
@@ -228,9 +226,11 @@ bool pal::get_default_servicing_directory(string_t* recv)
}
}
- if (access(ext.c_str(), R_OK) != 0)
+ // Servicing assets are looked up by known path, which requires search permission on the directory.
+ if (access(ext.c_str(), X_OK) != 0)
{
- trace::info(_X("Directory core servicing at [%s] was not ACL-ed properly"), ext.c_str());
+ trace::info(_X("Directory core servicing at [%s] is not accessible"), ext.c_str());
+ return false;
}
recv->assign(ext);
diff --git a/src/native/corehost/hostpolicy/args.h b/src/native/corehost/hostpolicy/args.h
index 0539e7e3d1edc4..279f158ebd7159 100644
--- a/src/native/corehost/hostpolicy/args.h
+++ b/src/native/corehost/hostpolicy/args.h
@@ -67,7 +67,9 @@ struct probe_config_t
, probe_deps_json(nullptr)
, fx_level(-1)
, only_runtime_assets(false)
- { }
+ {
+ assert(probe_type == type::app || pal::is_path_fully_qualified(probe_dir));
+ }
bool is_lookup() const
{
diff --git a/src/native/libs/System.Native/entrypoints.c b/src/native/libs/System.Native/entrypoints.c
index 78e08565015511..79380d874dd302 100644
--- a/src/native/libs/System.Native/entrypoints.c
+++ b/src/native/libs/System.Native/entrypoints.c
@@ -61,9 +61,11 @@ static const Entry s_sysNative[] =
DllImportEntry(SystemNative_Stat)
DllImportEntry(SystemNative_LStat)
DllImportEntry(SystemNative_Open)
+ DllImportEntry(SystemNative_OpenAt)
DllImportEntry(SystemNative_Close)
DllImportEntry(SystemNative_Dup)
DllImportEntry(SystemNative_Unlink)
+ DllImportEntry(SystemNative_UnlinkAt)
DllImportEntry(SystemNative_IsMemfdSupported)
DllImportEntry(SystemNative_MemfdCreate)
DllImportEntry(SystemNative_ShmOpen)
@@ -81,6 +83,7 @@ static const Entry s_sysNative[] =
DllImportEntry(SystemNative_FcntlSetIsNonBlocking)
DllImportEntry(SystemNative_FcntlGetIsNonBlocking)
DllImportEntry(SystemNative_MkDir)
+ DllImportEntry(SystemNative_MkDirAt)
DllImportEntry(SystemNative_ChMod)
DllImportEntry(SystemNative_FChMod)
DllImportEntry(SystemNative_FSync)
diff --git a/src/native/libs/System.Native/pal_io.c b/src/native/libs/System.Native/pal_io.c
index ebfb79d6287032..1ae712017d94cc 100644
--- a/src/native/libs/System.Native/pal_io.c
+++ b/src/native/libs/System.Native/pal_io.c
@@ -306,7 +306,7 @@ static int32_t ConvertOpenFlags(int32_t flags)
return -1;
}
- if (flags & ~(PAL_O_ACCESS_MODE_MASK | PAL_O_CLOEXEC | PAL_O_CREAT | PAL_O_EXCL | PAL_O_TRUNC | PAL_O_SYNC | PAL_O_NOFOLLOW))
+ if (flags & ~(PAL_O_ACCESS_MODE_MASK | PAL_O_CLOEXEC | PAL_O_CREAT | PAL_O_EXCL | PAL_O_TRUNC | PAL_O_SYNC | PAL_O_NOFOLLOW | PAL_O_DIRECTORY))
{
assert_msg(false, "Unknown Open flag", (int)flags);
return -1;
@@ -326,18 +326,15 @@ static int32_t ConvertOpenFlags(int32_t flags)
ret |= O_SYNC;
if (flags & PAL_O_NOFOLLOW)
ret |= O_NOFOLLOW;
+ if (flags & PAL_O_DIRECTORY)
+ ret |= O_DIRECTORY;
assert(ret != -1);
return ret;
}
-intptr_t SystemNative_Open(const char* path, int32_t flags, int32_t mode)
+static int32_t ConvertOpenFlagsAndAddDefaults(int32_t flags)
{
-// these two ifdefs are for platforms where we dont have the open version of CLOEXEC and thus
-// must simulate it by doing a fcntl with the SETFFD version after the open instead
-#if !HAVE_O_CLOEXEC
- int32_t old_flags = flags;
-#endif
flags = ConvertOpenFlags(flags);
if (flags == -1)
{
@@ -351,15 +348,47 @@ intptr_t SystemNative_Open(const char* path, int32_t flags, int32_t mode)
#ifndef TARGET_WASM
flags |= O_NOCTTY;
#endif
+ return flags;
+}
- int result;
- while ((result = open(path, flags, (mode_t)mode)) < 0 && errno == EINTR);
+static void SetCloseOnExecIfNeeded(int result, int32_t flags)
+{
#if !HAVE_O_CLOEXEC
- if (old_flags & PAL_O_CLOEXEC)
+ if (result >= 0 && (flags & PAL_O_CLOEXEC))
{
fcntl(result, F_SETFD, FD_CLOEXEC);
}
+#else
+ (void)result;
+ (void)flags;
#endif
+}
+
+intptr_t SystemNative_Open(const char* path, int32_t flags, int32_t mode)
+{
+ int32_t nativeFlags = ConvertOpenFlagsAndAddDefaults(flags);
+ if (nativeFlags == -1)
+ {
+ return -1;
+ }
+
+ int result;
+ while ((result = open(path, nativeFlags, (mode_t)mode)) < 0 && errno == EINTR);
+ SetCloseOnExecIfNeeded(result, flags);
+ return result;
+}
+
+intptr_t SystemNative_OpenAt(intptr_t dirfd, const char* path, int32_t flags, int32_t mode)
+{
+ int32_t nativeFlags = ConvertOpenFlagsAndAddDefaults(flags);
+ if (nativeFlags == -1)
+ {
+ return -1;
+ }
+
+ int result;
+ while ((result = openat(ToFileDescriptor(dirfd), path, nativeFlags, (mode_t)mode)) < 0 && errno == EINTR);
+ SetCloseOnExecIfNeeded(result, flags);
return result;
}
@@ -394,6 +423,27 @@ int32_t SystemNative_Unlink(const char* path)
return result;
}
+int32_t SystemNative_UnlinkAt(intptr_t dirfd, const char* path, int32_t flags)
+{
+ int nativeFlags;
+ switch (flags)
+ {
+ case 0:
+ nativeFlags = 0;
+ break;
+ case PAL_AT_REMOVEDIR:
+ nativeFlags = AT_REMOVEDIR;
+ break;
+ default:
+ errno = EINVAL;
+ return -1;
+ }
+
+ int32_t result;
+ while ((result = unlinkat(ToFileDescriptor(dirfd), path, nativeFlags)) < 0 && errno == EINTR);
+ return result;
+}
+
#ifdef __NR_memfd_create
#ifndef MFD_CLOEXEC
#define MFD_CLOEXEC 0x0001U
@@ -761,6 +811,13 @@ int32_t SystemNative_MkDir(const char* path, int32_t mode)
return result;
}
+int32_t SystemNative_MkDirAt(intptr_t dirfd, const char* path, int32_t mode)
+{
+ int32_t result;
+ while ((result = mkdirat(ToFileDescriptor(dirfd), path, (mode_t)mode)) < 0 && errno == EINTR);
+ return result;
+}
+
int32_t SystemNative_ChMod(const char* path, int32_t mode)
{
#if HAVE_CHMOD
diff --git a/src/native/libs/System.Native/pal_io.h b/src/native/libs/System.Native/pal_io.h
index 10332df8043230..6d62d40677166b 100644
--- a/src/native/libs/System.Native/pal_io.h
+++ b/src/native/libs/System.Native/pal_io.h
@@ -183,6 +183,12 @@ enum
PAL_O_NOFOLLOW = 0x0200, // Fails to open the target if it's a symlink, parent symlinks are allowed
PAL_O_NONBLOCK_READ = 0x0400, // Set O_NONBLOCK on the read end of a pipe
PAL_O_NONBLOCK_WRITE = 0x0800, // Set O_NONBLOCK on the write end of a pipe
+ PAL_O_DIRECTORY = 0x1000, // Fails to open the target if it's not a directory
+};
+
+enum
+{
+ PAL_AT_REMOVEDIR = 0x0001, // Remove the entry as a directory
};
/**
@@ -375,6 +381,13 @@ PALEXPORT int32_t SystemNative_LStat(const char* path, FileStatus* output);
*/
PALEXPORT intptr_t SystemNative_Open(const char* path, int32_t flags, int32_t mode);
+/**
+ * Open or create a file or device relative to a directory descriptor. Implemented as shim to openat(2).
+ *
+ * Returns file descriptor or -1 for failure. Sets errno on failure.
+ */
+PALEXPORT intptr_t SystemNative_OpenAt(intptr_t dirfd, const char* path, int32_t flags, int32_t mode);
+
/**
* Close a file descriptor. Implemented as shim to open(2).
*
@@ -396,6 +409,13 @@ PALEXPORT intptr_t SystemNative_Dup(intptr_t oldfd);
*/
PALEXPORT int32_t SystemNative_Unlink(const char* path);
+/**
+ * Delete an entry relative to a directory descriptor. Implemented as shim to unlinkat(2).
+ *
+ * Returns 0 for success, -1 for failure. Sets errno on failure.
+ */
+PALEXPORT int32_t SystemNative_UnlinkAt(intptr_t dirfd, const char* path, int32_t flags);
+
/**
* Check if the system supports memfd_create(2).
*
@@ -520,6 +540,13 @@ PALEXPORT int32_t SystemNative_FcntlGetIsNonBlocking(intptr_t fd, int32_t* isNon
*/
PALEXPORT int32_t SystemNative_MkDir(const char* path, int32_t mode);
+/**
+ * Create a directory relative to a directory descriptor. Implemented as a shim to mkdirat(2).
+ *
+ * Returns 0 for success, -1 for failure. Sets errno for failure.
+ */
+PALEXPORT int32_t SystemNative_MkDirAt(intptr_t dirfd, const char* path, int32_t mode);
+
/**
* Change permissions of a file. Implemented as a shim to chmod(2).
*
diff --git a/src/native/libs/System.Native/pal_process.c b/src/native/libs/System.Native/pal_process.c
index c5af90e397287e..3c138380877c93 100644
--- a/src/native/libs/System.Native/pal_process.c
+++ b/src/native/libs/System.Native/pal_process.c
@@ -24,7 +24,7 @@
#include
#if defined(__linux__)
-#if !defined(HAVE_CLOSE_RANGE)
+#if !HAVE_CLOSE_RANGE
#include
#if !defined(__NR_close_range)
// close_range was added in Linux 5.9. The syscall number is 436 for all
@@ -37,7 +37,7 @@
# define __NR_close_range 436
# endif
#endif // !defined(__NR_close_range)
-#endif // !defined(HAVE_CLOSE_RANGE)
+#endif // !HAVE_CLOSE_RANGE
#endif // defined(__linux__)
#if (HAVE_CLOSE_RANGE || defined(__NR_close_range)) && !defined(CLOSE_RANGE_CLOEXEC)
#define CLOSE_RANGE_CLOEXEC (1U << 2)
@@ -246,44 +246,16 @@ static int SetCloexecForFd(void* context, int fd)
}
#endif
-// Used when OS-specific bulk methods (close_range, fdwalk) are unavailable or fail.
-// Always sets FD_CLOEXEC rather than closing fds directly. Closing fds directly would close
-// waitForChildToExecPipe[WRITE_END_OF_PIPE] (which has O_CLOEXEC), making it impossible to
-// report exec() failures back to the parent when execve() fails after RestrictHandleInheritance.
-static void SetCloexecForAllFdsFallback(void)
-{
- struct rlimit rl;
- int maxFd;
- if (getrlimit(RLIMIT_NOFILE, &rl) == 0 && rl.rlim_cur != RLIM_INFINITY)
- {
- maxFd = (int)rl.rlim_cur;
- }
- else
- {
- maxFd = (int)sysconf(_SC_OPEN_MAX);
- if (maxFd <= 0)
- {
- maxFd = 65536; // reasonable upper bound
- }
- }
-
- // Fallback: iterate over all file descriptors and set FD_CLOEXEC on each open one >= 3.
- for (int fd = 3; fd < maxFd; fd++)
- {
- int flags = fcntl(fd, F_GETFD);
- if (flags == -1)
- {
- continue; // fd not open
- }
-
- if ((flags & FD_CLOEXEC) == 0)
- {
- fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
- }
- }
-}
-
-static void RestrictHandleInheritance(int32_t* inheritedFds, int32_t inheritedFdCount)
+// Returns 0 on success, or -1 (with errno set to ENOTSUP) if this platform/kernel doesn't provide
+// a performant native way (close_range()/fdwalk()) to restrict which fds a child process inherits.
+//
+// We intentionally do NOT fall back to manually scanning every possible fd via fcntl() in that
+// case: without close_range()/fdwalk(), there is no reliable way to learn only the fds that are
+// actually open, so such a scan would need to cover the entire valid fd range (up to INT_MAX) to
+// be correct -- something that has been measured to take multiple minutes of CPU time per
+// Process.Start call. That's not an acceptable cost, so we report failure instead and let the
+// managed layer surface a clear, actionable error.
+static int32_t RestrictHandleInheritance(int32_t* inheritedFds, int32_t inheritedFdCount)
{
// FDs 0-2 are stdin/stdout/stderr; this method must be called AFTER the dup2 calls.
// We always set FD_CLOEXEC rather than closing fds directly. This is critical because
@@ -291,29 +263,27 @@ static void RestrictHandleInheritance(int32_t* inheritedFds, int32_t inheritedFd
// until execve() is called so that exec failures can be reported back to the parent.
// Using closefrom() or close_range() with flag 0 (direct close) would destroy this pipe.
+ int result;
#if HAVE_CLOSE_RANGE
// On systems where close_range() is available as a function (FreeBSD 12.2+, Linux glibc >= 2.34).
- if (close_range(3, UINT_MAX, CLOSE_RANGE_CLOEXEC) != 0)
- {
- SetCloexecForAllFdsFallback();
- }
+ result = close_range(3, UINT_MAX, CLOSE_RANGE_CLOEXEC);
#elif defined(__NR_close_range)
// On Linux with older glibc that doesn't expose close_range() as a function,
// use the raw syscall number if the kernel supports it (kernel >= 5.9).
- if (syscall(__NR_close_range, 3, UINT_MAX, CLOSE_RANGE_CLOEXEC) != 0)
- {
- SetCloexecForAllFdsFallback();
- }
+ result = (int)syscall(__NR_close_range, 3, UINT_MAX, CLOSE_RANGE_CLOEXEC);
#elif HAVE_FDWALK
// On Illumos/Solaris, use fdwalk() to set FD_CLOEXEC on all open fds >= 3.
- if (fdwalk(SetCloexecForFd, NULL) != 0)
- {
- SetCloexecForAllFdsFallback();
- }
+ result = fdwalk(SetCloexecForFd, NULL);
#else
- SetCloexecForAllFdsFallback();
+ result = -1;
#endif
+ if (result != 0)
+ {
+ errno = ENOTSUP;
+ return -1;
+ }
+
// Remove CLOEXEC from user-provided inherited file descriptors so they survive execve.
for (int i = 0; i < inheritedFdCount; i++)
{
@@ -327,6 +297,8 @@ static void RestrictHandleInheritance(int32_t* inheritedFds, int32_t inheritedFd
}
}
}
+
+ return 0;
}
// Forward declaration of the internal fork+exec function
@@ -907,9 +879,9 @@ static int32_t ForkAndExecProcessInternal(
}
}
- if (inheritedFdCount >= 0)
+ if (inheritedFdCount >= 0 && RestrictHandleInheritance(inheritedFds, inheritedFdCount) != 0)
{
- RestrictHandleInheritance(inheritedFds, inheritedFdCount);
+ ExitChild(waitForChildToExecPipe[WRITE_END_OF_PIPE], errno);
}
#if HAVE_PR_SET_PDEATHSIG
diff --git a/src/tasks/Microsoft.NET.WebAssembly.Webcil/Microsoft.NET.WebAssembly.Webcil.csproj b/src/tasks/Microsoft.NET.WebAssembly.Webcil/Microsoft.NET.WebAssembly.Webcil.csproj
index e582aeabfe42a0..5fe4db7356ba80 100644
--- a/src/tasks/Microsoft.NET.WebAssembly.Webcil/Microsoft.NET.WebAssembly.Webcil.csproj
+++ b/src/tasks/Microsoft.NET.WebAssembly.Webcil/Microsoft.NET.WebAssembly.Webcil.csproj
@@ -2,6 +2,7 @@
$(NetCoreAppToolCurrent);$(NetFrameworkToolCurrent)
+ AnyCPU
Abstractions for modifying .NET webcil binary images
true
true
diff --git a/src/tools/ilasm/src/ilasm/ilasm.csproj b/src/tools/ilasm/src/ilasm/ilasm.csproj
index 8a1e3d9fe0a6b4..16c04c3963be8a 100644
--- a/src/tools/ilasm/src/ilasm/ilasm.csproj
+++ b/src/tools/ilasm/src/ilasm/ilasm.csproj
@@ -11,6 +11,8 @@
true
true
true
+ com.microsoft.dotnet.ilasm
+ ilasm
true
enable