Skip to content

Unifying boilerplate code for handling child processes.#7991

Closed
alexey-tikhonov wants to merge 38 commits intoSSSD:masterfrom
alexey-tikhonov:child-helpers
Closed

Unifying boilerplate code for handling child processes.#7991
alexey-tikhonov wants to merge 38 commits intoSSSD:masterfrom
alexey-tikhonov:child-helpers

Conversation

@alexey-tikhonov
Copy link
Member

@alexey-tikhonov alexey-tikhonov commented Jun 6, 2025

A set of patches with the main goal of getting rid of tons of code duplication around fork() + exec(), setting up SIGCHLD and timeout handlers, etc.

There are two (clearly marked) patches generated by LLM under strict supervision (multiple iterations for both patches) and two patches written as a result of review by LLM (also clearly marked).

There is further potential for improvements, most notably replacing direct exec*() in ipa_subdomains_server.c and proxy_auth.c, but also unifying some typical callbacks (like timeout handler that usually simply ends tevent req). But this is already pretty large and I'd like to have it reviewed.

@alexey-tikhonov alexey-tikhonov added the no-backport This should go to target branch only. label Jun 6, 2025
@alexey-tikhonov alexey-tikhonov changed the title Child helpers A set of patches around 'child helpers' Jun 6, 2025
@alexey-tikhonov alexey-tikhonov force-pushed the child-helpers branch 10 times, most recently from d1c7586 to 9b0a4d0 Compare June 12, 2025 18:21
@alexey-tikhonov alexey-tikhonov added the coverity Trigger a coverity scan label Jun 12, 2025
@alexey-tikhonov alexey-tikhonov force-pushed the child-helpers branch 2 times, most recently from 4fbfac7 to 627139c Compare June 13, 2025 12:32
@alexey-tikhonov alexey-tikhonov added coverity Trigger a coverity scan and removed coverity Trigger a coverity scan labels Jun 13, 2025
@alexey-tikhonov alexey-tikhonov force-pushed the child-helpers branch 6 times, most recently from 4822823 to c2ef433 Compare June 20, 2025 10:45
@alexey-tikhonov alexey-tikhonov force-pushed the child-helpers branch 2 times, most recently from 818d604 to c29d417 Compare June 20, 2025 19:28
@alexey-tikhonov alexey-tikhonov added coverity Trigger a coverity scan and removed coverity Trigger a coverity scan labels Jun 21, 2025
…y()`

kind of "private".

'ipa_subdomains_server.c' still uses those, but ideally
should be reworked to use `sss_child_start()` instead.
Issue spotted by 'o3' LLM:
```
sss_child_start builds a pipe pair,
marks non-blocking using sss_fd_nonblocking
but no error check of that helper.
```
Issue spotted by 'o3' LLM:
```
buf is allocated exactly PASSKEY_CHILD_MSG_CHUNK bytes; if the child writes
a full 1024-byte, the string may miss a terminating NUL (read does not append one).
 Previously had the same flaw, but still worth fixing (allocate +1 or ensure NUL).
```
Copy link
Contributor

@aplopez aplopez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you.

accidentally if 'io' isn't required.
Copy link
Contributor

@sumit-bose sumit-bose left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,

thank you very much for this long overdue effort. Codewise I'm fine and I run a couple of test with different child processes without issues. Some of them I run many times and checked for memory leaks without success. ACK.

bye,
Sumit

@alexey-tikhonov
Copy link
Member Author

Pushed PR: #7991

  • master
    • b871b0c - CHILD HELPERS: make sure 'child_out_fd' isn't used
    • 8bddb6a - Renamed 'child_common.c' to 'child_handlers.c'
    • 18cba6e - Cosmetics: indentation fix
    • fd92f45 - KRB5 PASSKEY PLUGIN: ensure space for NULL termination
    • 301dc67 - CHILD HELPERS: check return code of sss_fd_nonblocking()
    • 9f2e11c - CHILD HELPERS: cosmetics around namings
    • e4adf7e - CHILD HELPERS: make exec_child_ex() private
    • 4cd3aac - CHILD HELPERS: make child_handler_setup() and child_handler_destroy() kind of "private".
    • a831c00 - CHILD HELPERS: make child_io_destructor() private
    • db8a601 - Cosmetics around close-fd helpers
    • 5e2586b - DYNDNS: make use of sss_child_start()
    • 0e8f887 - PAM:PASSKEY: make use of sss_child_start()
    • 9be8b15 - PAM:CERT: make use of sss_child_start()
    • 452f205 - IPA_SELINUX: make use of sss_child_start()
    • bd6dfc2 - CHILD HELPERS: handle '--chain-id' as a basic arg
    • 96a7fc7 - AD GPO: handle stuck 'gpo_child'
    • 839a730 - CHILD HELPERS: extend sss_child_start()
    • e5f4348 - SSH: refactor ssh_cert_to_ssh_key.c to use sss_child_start()
    • 9f2ac08 - sss_child_start(): allow NULL output _io arg
    • 5b72f11 - responder/ifp: use sss_child_start() for p11_child certificate validation
    • ce528fd - AD GPO: make use of sss_child_start()
    • 9324feb - AD pw renewal: make use of sss_child_start()
    • afffec3 - CHILD HELPERS: make activate_child_timeout_handler() internal
    • 92f977a - IDP: make use of sss_child_start()
    • 3b435ce - Delete 'exec_child()'
    • 511b44b - LDAP: make use of sss_child_start()
    • 47b544a - KRB5: make use of sss_child_start()
    • 81b2f20 - New sss_child_start() helper
    • 10ad5a0 - Rename 'sss_child_ctx_old' -> 'sss_child_ctx'
    • 91c528a - Helpers defined in 'child_utils.h' aren't really used in child processes.
    • 24e9f9b - UTILS: don't use shared 'IN_BUF_SIZE'
    • 03f5263 - UTILS: split child helpers code
    • c00c6e2 - CHILD_COMMON: unify structs 'response' and 'io_buffer'
    • 0fb034b - 'libsss_cert' doesn't use 'libsss_child'
    • 03da01d - libkrb5 passkey plugin doesn't use 'libsss_util.so'
    • f9b226b - Moved define used by ldap_child only out
    • 78c1400 - UTILS: moved code used only by 'monitor'
    • 6f448e1 - UTILS: removed stray declaration

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

coverity Trigger a coverity scan no-backport This should go to target branch only. Pushed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants