8319589: Attach from root to a user java process not supported in Mac #25824
Conversation
|
👋 Welcome back schernyshev! A progress list of the required criteria for merging this PR into |
|
❗ This change is not yet ready to be integrated. |
|
@sercher The following labels will be automatically applied to this pull request:
When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command. |
openjdk
bot
added
serviceability
| @@ -127,6 +130,80 @@ static void save_memory_to_file(char* addr, size_t size) { | |||
| // simple file apis. | |||
| // | |||
|
|
|||
| #ifdef __APPLE__ | |||
There was a problem hiding this comment.
This is a bit too much non-posix code in the posix file IMO. I'd rather see a MACOS_ONLY call later on to something defined in os_bsd.cpp for macOS.
| if (user != null) { | ||
| for (String dir : platformSupport.getTemporaryDirectories(pid)) { | ||
| Path fullPath = Path.of(dir, HSPERFDATA_PREFIX + user, String.valueOf(pid)); | ||
| if(Files.exists(fullPath)) { |
There was a problem hiding this comment.
| if(Files.exists(fullPath)) { | |
| if (Files.exists(fullPath)) { |
Hi all,
I would like to propose a fix for JDK-8319589. This will allow jcmd and jps running as root to get the complete list of JVMs running by all users, and to attach from root to non-root JVMs. Previously, JDK-8197387 introduced the same approach on Linux.
This change affects macOS, that uses "secure" per-user temporary directories. It only affects JVMs running as root, the behavior in non-privileged JVMs remains unchanged.
Jcmd and jps rely on LocalVmManager to get the initial list of the local VMs. The LocalVmManager uses sun.jvmstat.PlatformSupport to get the list of temp directories, where it searches for user's PerfData directory such as "hsperfdata_<username>". In macosx the temp directories are per-user, the temp path is returned by confstr(_CS_DARWIN_USER_TEMP_DIR). The per-user directories are mode 700 and so they are read-protected from non-privileged users and can be accessed by the owner and the root.
Both jps and jcmd (HotSpotAttachProvider) create MonitoredVm objects, that have PerfDataBuffer that performs attachment to the target. Only the attachable VMs are listed in jcmd output.
The proposed patch changes the list of directories returned by the PlatformSupport#getTemporaryDirectories() in VMs running as root. The list is later used in VirtualMachineImpl (jdk.attach). It changes also the way mmap_attach_shared() searches for hsperfdata_<username>/<pid> files to map the shared memory. Mmap_attach_shared() and VirtualMachineImpl (via PlatformSupport) list the content of /var/folders, where the temp directories are located, more specificly the temp directories are /var/folders/<BUCKET>/<ENCODED_UUID_UID>/T as hinted in [1]. The full list is returned by newly added PlatformSupportImpl#getTemporaryDirectories().
The attaching client's VirtualMachineImpl needs the target process's temp directory to find .java<pid> and create .attach<pid> files. It uses the list returned by PlatformSupportImpl#getTemporaryDirectories() and the ProcessHandle of the target process to search for user's PerfData directory, e.g. hsperfdata_<username>, which is in the target process's temp directory, exactly where it expects to see the .java<pid> in return on sending SIGQUIT to the target VM.
Mmap_attach_shared() traverses the /var/folders in get_user_tmp_dir() and looks for a hsperfdata_<username> folder. If that folder is found in /var/folders/*/*/T, that means the temp folder corresponds to the <username> and to the JVM being attached to.
The patch is tested against the range of macOS versions, the earliest version tested is 10.13 High Sierra (as 11u backport), the latest version tested is 15.5 Sequoia.
Testing:
[1] https://github.com/apple-oss-distributions/Libc/blob/Libc-997.90.3/darwin/_dirhelper.c#L210
Progress
Issue
Reviewing
Using
gitCheckout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25824/head:pull/25824$ git checkout pull/25824Update a local copy of the PR:
$ git checkout pull/25824$ git pull https://git.openjdk.org/jdk.git pull/25824/headUsing Skara CLI tools
Checkout this PR locally:
$ git pr checkout 25824View PR using the GUI difftool:
$ git pr show -t 25824Using diff file
Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25824.diff
Using Webrev
Link to Webrev Comment