linux下system函数的简单分析

蕤琍發表於 2023-10-1 00:00:00

<p>
简单分析了linux下system函数的相关内容，具体内容如下</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_583588">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">int</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">__libc_system (const char *line)</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">{</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">(line == NULL)</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash spaces">  </code><code class="bash plain">/* Check that we have a </code><code class="bash functions">command</code> <code class="bash plain">processor available. It might</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash spaces">    </code><code class="bash plain">not be available after a chroot(), </code><code class="bash keyword">for</code> <code class="bash plain">example. */</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash spaces">  </code><code class="bash keyword">return</code> <code class="bash plain">do_system (</code><code class="bash string">"exit 0"</code><code class="bash plain">) == 0;</code>
</div>
<div class="line number8 index7 alt1">
</div>
<div class="line number9 index8 alt2">
<code class="bash spaces"> </code><code class="bash keyword">return</code> <code class="bash plain">do_system (line);</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash plain">}</code>
</div>
<div class="line number11 index10 alt2">
<code class="bash plain">weak_alias (__libc_system, system)</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
代码位于glibc/sysdeps/posix/system.c，这里system是__libc_system的弱别名，而__libc_system是do_system的前端函数，进行了参数的检查，接下来看do_system函数。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_908595">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
<div class="line number32 index31 alt1">
32</div>
<div class="line number33 index32 alt2">
33</div>
<div class="line number34 index33 alt1">
34</div>
<div class="line number35 index34 alt2">
35</div>
<div class="line number36 index35 alt1">
36</div>
<div class="line number37 index36 alt2">
37</div>
<div class="line number38 index37 alt1">
38</div>
<div class="line number39 index38 alt2">
39</div>
<div class="line number40 index39 alt1">
40</div>
<div class="line number41 index40 alt2">
41</div>
<div class="line number42 index41 alt1">
42</div>
<div class="line number43 index42 alt2">
43</div>
<div class="line number44 index43 alt1">
44</div>
<div class="line number45 index44 alt2">
45</div>
<div class="line number46 index45 alt1">
46</div>
<div class="line number47 index46 alt2">
47</div>
<div class="line number48 index47 alt1">
48</div>
<div class="line number49 index48 alt2">
49</div>
<div class="line number50 index49 alt1">
50</div>
<div class="line number51 index50 alt2">
51</div>
<div class="line number52 index51 alt1">
52</div>
<div class="line number53 index52 alt2">
53</div>
<div class="line number54 index53 alt1">
54</div>
<div class="line number55 index54 alt2">
55</div>
<div class="line number56 index55 alt1">
56</div>
<div class="line number57 index56 alt2">
57</div>
<div class="line number58 index57 alt1">
58</div>
<div class="line number59 index58 alt2">
59</div>
<div class="line number60 index59 alt1">
60</div>
<div class="line number61 index60 alt2">
61</div>
<div class="line number62 index61 alt1">
62</div>
<div class="line number63 index62 alt2">
63</div>
<div class="line number64 index63 alt1">
64</div>
<div class="line number65 index64 alt2">
65</div>
<div class="line number66 index65 alt1">
66</div>
<div class="line number67 index66 alt2">
67</div>
<div class="line number68 index67 alt1">
68</div>
<div class="line number69 index68 alt2">
69</div>
<div class="line number70 index69 alt1">
70</div>
<div class="line number71 index70 alt2">
71</div>
<div class="line number72 index71 alt1">
72</div>
<div class="line number73 index72 alt2">
73</div>
<div class="line number74 index73 alt1">
74</div>
<div class="line number75 index74 alt2">
75</div>
<div class="line number76 index75 alt1">
76</div>
<div class="line number77 index76 alt2">
77</div>
<div class="line number78 index77 alt1">
78</div>
<div class="line number79 index78 alt2">
79</div>
<div class="line number80 index79 alt1">
80</div>
<div class="line number81 index80 alt2">
81</div>
<div class="line number82 index81 alt1">
82</div>
<div class="line number83 index82 alt2">
83</div>
<div class="line number84 index83 alt1">
84</div>
<div class="line number85 index84 alt2">
85</div>
<div class="line number86 index85 alt1">
86</div>
<div class="line number87 index86 alt2">
87</div>
<div class="line number88 index87 alt1">
88</div>
<div class="line number89 index88 alt2">
89</div>
<div class="line number90 index89 alt1">
90</div>
<div class="line number91 index90 alt2">
91</div>
<div class="line number92 index91 alt1">
92</div>
<div class="line number93 index92 alt2">
93</div>
<div class="line number94 index93 alt1">
94</div>
<div class="line number95 index94 alt2">
95</div>
<div class="line number96 index95 alt1">
96</div>
<div class="line number97 index96 alt2">
97</div>
<div class="line number98 index97 alt1">
98</div>
<div class="line number99 index98 alt2">
99</div>
<div class="line number100 index99 alt1">
100</div>
<div class="line number101 index100 alt2">
101</div>
<div class="line number102 index101 alt1">
102</div>
<div class="line number103 index102 alt2">
103</div>
<div class="line number104 index103 alt1">
104</div>
<div class="line number105 index104 alt2">
105</div>
<div class="line number106 index105 alt1">
106</div>
<div class="line number107 index106 alt2">
107</div>
<div class="line number108 index107 alt1">
108</div>
<div class="line number109 index108 alt2">
109</div>
<div class="line number110 index109 alt1">
110</div>
<div class="line number111 index110 alt2">
111</div>
<div class="line number112 index111 alt1">
112</div>
<div class="line number113 index112 alt2">
113</div>
<div class="line number114 index113 alt1">
114</div>
<div class="line number115 index114 alt2">
115</div>
<div class="line number116 index115 alt1">
116</div>
<div class="line number117 index116 alt2">
117</div>
<div class="line number118 index117 alt1">
118</div>
<div class="line number119 index118 alt2">
119</div>
<div class="line number120 index119 alt1">
120</div>
<div class="line number121 index120 alt2">
121</div>
<div class="line number122 index121 alt1">
122</div>
<div class="line number123 index122 alt2">
123</div>
<div class="line number124 index123 alt1">
124</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">static int</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">do_system (const char *line)</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">{</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash spaces"> </code><code class="bash plain">int status, save;</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash spaces"> </code><code class="bash plain">pid_t pid;</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash spaces"> </code><code class="bash plain">struct sigaction sa;</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash comments">#ifndef _LIBC_REENTRANT</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash spaces"> </code><code class="bash plain">struct sigaction intr, quit;</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash comments">#endif</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash spaces"> </code><code class="bash plain">sigset_t omask;</code>
</div>
<div class="line number11 index10 alt2">
</div>
<div class="line number12 index11 alt1">
<code class="bash spaces"> </code><code class="bash plain">sa.sa_handler = SIG_IGN;</code>
</div>
<div class="line number13 index12 alt2">
<code class="bash spaces"> </code><code class="bash plain">sa.sa_flags = 0;</code>
</div>
<div class="line number14 index13 alt1">
<code class="bash spaces"> </code><code class="bash plain">__sigemptyset (&sa.sa_mask);</code>
</div>
<div class="line number15 index14 alt2">
</div>
<div class="line number16 index15 alt1">
<code class="bash spaces"> </code><code class="bash plain">DO_LOCK ();</code>
</div>
<div class="line number17 index16 alt2">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">(ADD_REF () == 0)</code>
</div>
<div class="line number18 index17 alt1">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number19 index18 alt2">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(__sigaction (SIGINT, &sa, &intr) < 0)</code>
</div>
<div class="line number20 index19 alt1">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number21 index20 alt2">
<code class="bash spaces">   </code><code class="bash plain">(void) SUB_REF ();</code>
</div>
<div class="line number22 index21 alt1">
<code class="bash spaces">   </code><code class="bash plain">goto out;</code>
</div>
<div class="line number23 index22 alt2">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number24 index23 alt1">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(__sigaction (SIGQUIT, &sa, &quit) < 0)</code>
</div>
<div class="line number25 index24 alt2">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number26 index25 alt1">
<code class="bash spaces">   </code><code class="bash plain">save = errno;</code>
</div>
<div class="line number27 index26 alt2">
<code class="bash spaces">   </code><code class="bash plain">(void) SUB_REF ();</code>
</div>
<div class="line number28 index27 alt1">
<code class="bash spaces">   </code><code class="bash plain">goto out_restore_sigint;</code>
</div>
<div class="line number29 index28 alt2">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number30 index29 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number31 index30 alt2">
<code class="bash spaces"> </code><code class="bash plain">DO_UNLOCK ();</code>
</div>
<div class="line number32 index31 alt1">
</div>
<div class="line number33 index32 alt2">
<code class="bash spaces"> </code><code class="bash plain">/* We reuse the bitmap </code><code class="bash keyword">in</code> <code class="bash plain">the </code><code class="bash string">'sa'</code> <code class="bash plain">structure. */</code>
</div>
<div class="line number34 index33 alt1">
<code class="bash spaces"> </code><code class="bash plain">__sigaddset (&sa.sa_mask, SIGCHLD);</code>
</div>
<div class="line number35 index34 alt2">
<code class="bash spaces"> </code><code class="bash plain">save = errno;</code>
</div>
<div class="line number36 index35 alt1">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">(__sigprocmask (SIG_BLOCK, &sa.sa_mask, &omask) < 0)</code>
</div>
<div class="line number37 index36 alt2">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number38 index37 alt1">
<code class="bash comments">#ifndef _LIBC</code>
</div>
<div class="line number39 index38 alt2">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(errno == ENOSYS)</code>
</div>
<div class="line number40 index39 alt1">
<code class="bash spaces">  </code><code class="bash plain">__set_errno (save);</code>
</div>
<div class="line number41 index40 alt2">
<code class="bash spaces">   </code><code class="bash keyword">else</code>
</div>
<div class="line number42 index41 alt1">
<code class="bash comments">#endif</code>
</div>
<div class="line number43 index42 alt2">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number44 index43 alt1">
<code class="bash spaces">   </code><code class="bash plain">DO_LOCK ();</code>
</div>
<div class="line number45 index44 alt2">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(SUB_REF () == 0)</code>
</div>
<div class="line number46 index45 alt1">
<code class="bash spaces">    </code><code class="bash plain">{</code>
</div>
<div class="line number47 index46 alt2">
<code class="bash spaces">     </code><code class="bash plain">save = errno;</code>
</div>
<div class="line number48 index47 alt1">
<code class="bash spaces">     </code><code class="bash plain">(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);</code>
</div>
<div class="line number49 index48 alt2">
<code class="bash spaces">    </code><code class="bash plain">out_restore_sigint:</code>
</div>
<div class="line number50 index49 alt1">
<code class="bash spaces">     </code><code class="bash plain">(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);</code>
</div>
<div class="line number51 index50 alt2">
<code class="bash spaces">     </code><code class="bash plain">__set_errno (save);</code>
</div>
<div class="line number52 index51 alt1">
<code class="bash spaces">    </code><code class="bash plain">}</code>
</div>
<div class="line number53 index52 alt2">
<code class="bash spaces">  </code><code class="bash plain">out:</code>
</div>
<div class="line number54 index53 alt1">
<code class="bash spaces">   </code><code class="bash plain">DO_UNLOCK ();</code>
</div>
<div class="line number55 index54 alt2">
<code class="bash spaces">   </code><code class="bash keyword">return</code> <code class="bash plain">-1;</code>
</div>
<div class="line number56 index55 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number57 index56 alt2">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number58 index57 alt1">
</div>
<div class="line number59 index58 alt2">
<code class="bash comments">#ifdef CLEANUP_HANDLER</code>
</div>
<div class="line number60 index59 alt1">
<code class="bash spaces"> </code><code class="bash plain">CLEANUP_HANDLER;</code>
</div>
<div class="line number61 index60 alt2">
<code class="bash comments">#endif</code>
</div>
<div class="line number62 index61 alt1">
</div>
<div class="line number63 index62 alt2">
<code class="bash comments">#ifdef FORK</code>
</div>
<div class="line number64 index63 alt1">
<code class="bash spaces"> </code><code class="bash plain">pid = FORK ();</code>
</div>
<div class="line number65 index64 alt2">
<code class="bash comments">#else</code>
</div>
<div class="line number66 index65 alt1">
<code class="bash spaces"> </code><code class="bash plain">pid = __fork ();</code>
</div>
<div class="line number67 index66 alt2">
<code class="bash comments">#endif</code>
</div>
<div class="line number68 index67 alt1">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">(pid == (pid_t) 0)</code>
</div>
<div class="line number69 index68 alt2">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number70 index69 alt1">
<code class="bash spaces">   </code><code class="bash plain">/* Child side. */</code>
</div>
<div class="line number71 index70 alt2">
<code class="bash spaces">   </code><code class="bash plain">const char *new_argv;</code>
</div>
<div class="line number72 index71 alt1">
<code class="bash spaces">   </code><code class="bash plain">new_argv = SHELL_NAME;</code>
</div>
<div class="line number73 index72 alt2">
<code class="bash spaces">   </code><code class="bash plain">new_argv = </code><code class="bash string">"-c"</code><code class="bash plain">;</code>
</div>
<div class="line number74 index73 alt1">
<code class="bash spaces">   </code><code class="bash plain">new_argv = line;</code>
</div>
<div class="line number75 index74 alt2">
<code class="bash spaces">   </code><code class="bash plain">new_argv = NULL;</code>
</div>
<div class="line number76 index75 alt1">
</div>
<div class="line number77 index76 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Restore the signals. */</code>
</div>
<div class="line number78 index77 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);</code>
</div>
<div class="line number79 index78 alt2">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);</code>
</div>
<div class="line number80 index79 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL);</code>
</div>
<div class="line number81 index80 alt2">
<code class="bash spaces">   </code><code class="bash plain">INIT_LOCK ();</code>
</div>
<div class="line number82 index81 alt1">
</div>
<div class="line number83 index82 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Exec the shell. */</code>
</div>
<div class="line number84 index83 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);</code>
</div>
<div class="line number85 index84 alt2">
<code class="bash spaces">   </code><code class="bash plain">_exit (127);</code>
</div>
<div class="line number86 index85 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number87 index86 alt2">
<code class="bash spaces"> </code><code class="bash keyword">else</code> <code class="bash keyword">if</code> <code class="bash plain">(pid < (pid_t) 0)</code>
</div>
<div class="line number88 index87 alt1">
<code class="bash spaces">  </code><code class="bash plain">/* The fork failed. */</code>
</div>
<div class="line number89 index88 alt2">
<code class="bash spaces">  </code><code class="bash plain">status = -1;</code>
</div>
<div class="line number90 index89 alt1">
<code class="bash spaces"> </code><code class="bash keyword">else</code>
</div>
<div class="line number91 index90 alt2">
<code class="bash spaces">  </code><code class="bash plain">/* Parent side. */</code>
</div>
<div class="line number92 index91 alt1">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number93 index92 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Note the system() is a cancellation point. But since we call</code>
</div>
<div class="line number94 index93 alt1">
<code class="bash spaces">   </code><code class="bash plain">waitpid() </code><code class="bash functions">which</code> <code class="bash plain">itself is a cancellation point we </code><code class="bash keyword">do</code> <code class="bash plain">not</code>
</div>
<div class="line number95 index94 alt2">
<code class="bash spaces">   </code><code class="bash plain">have to </code><code class="bash keyword">do</code> <code class="bash plain">anything here. */</code>
</div>
<div class="line number96 index95 alt1">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid)</code>
</div>
<div class="line number97 index96 alt2">
<code class="bash spaces">  </code><code class="bash plain">status = -1;</code>
</div>
<div class="line number98 index97 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number99 index98 alt2">
</div>
<div class="line number100 index99 alt1">
<code class="bash comments">#ifdef CLEANUP_HANDLER</code>
</div>
<div class="line number101 index100 alt2">
<code class="bash spaces"> </code><code class="bash plain">CLEANUP_RESET;</code>
</div>
<div class="line number102 index101 alt1">
<code class="bash comments">#endif</code>
</div>
<div class="line number103 index102 alt2">
</div>
<div class="line number104 index103 alt1">
<code class="bash spaces"> </code><code class="bash plain">save = errno;</code>
</div>
<div class="line number105 index104 alt2">
<code class="bash spaces"> </code><code class="bash plain">DO_LOCK ();</code>
</div>
<div class="line number106 index105 alt1">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">((SUB_REF () == 0</code>
</div>
<div class="line number107 index106 alt2">
<code class="bash spaces">    </code><code class="bash plain">&& (__sigaction (SIGINT, &intr, (struct sigaction *) NULL)</code>
</div>
<div class="line number108 index107 alt1">
<code class="bash spaces">    </code><code class="bash plain">| __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL)) != 0)</code>
</div>
<div class="line number109 index108 alt2">
<code class="bash spaces">   </code><code class="bash plain">|| __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL) != 0)</code>
</div>
<div class="line number110 index109 alt1">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number111 index110 alt2">
<code class="bash comments">#ifndef _LIBC</code>
</div>
<div class="line number112 index111 alt1">
<code class="bash spaces">   </code><code class="bash plain">/* glibc cannot be used on systems without waitpid. */</code>
</div>
<div class="line number113 index112 alt2">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(errno == ENOSYS)</code>
</div>
<div class="line number114 index113 alt1">
<code class="bash spaces">  </code><code class="bash plain">__set_errno (save);</code>
</div>
<div class="line number115 index114 alt2">
<code class="bash spaces">   </code><code class="bash keyword">else</code>
</div>
<div class="line number116 index115 alt1">
<code class="bash comments">#endif</code>
</div>
<div class="line number117 index116 alt2">
<code class="bash spaces">  </code><code class="bash plain">status = -1;</code>
</div>
<div class="line number118 index117 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number119 index118 alt2">
<code class="bash spaces"> </code><code class="bash plain">DO_UNLOCK ();</code>
</div>
<div class="line number120 index119 alt1">
</div>
<div class="line number121 index120 alt2">
<code class="bash spaces"> </code><code class="bash keyword">return</code> <code class="bash plain">status;</code>
</div>
<div class="line number122 index121 alt1">
<code class="bash plain">}</code>
</div>
<div class="line number123 index122 alt2">
</div>
<div class="line number124 index123 alt1">
<code class="bash plain">do_system</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
首先函数设置了一些信号处理程序，来处理SIGINT和SIGQUIT信号，此处我们不过多关心，关键代码段在这里</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_144855">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
<div class="line number32 index31 alt1">
32</div>
<div class="line number33 index32 alt2">
33</div>
<div class="line number34 index33 alt1">
34</div>
<div class="line number35 index34 alt2">
35</div>
<div class="line number36 index35 alt1">
36</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments">#ifdef FORK</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash spaces"> </code><code class="bash plain">pid = FORK ();</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash comments">#else</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash spaces"> </code><code class="bash plain">pid = __fork ();</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash comments">#endif</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash spaces"> </code><code class="bash keyword">if</code> <code class="bash plain">(pid == (pid_t) 0)</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash spaces">   </code><code class="bash plain">/* Child side. */</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash spaces">   </code><code class="bash plain">const char *new_argv;</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash spaces">   </code><code class="bash plain">new_argv = SHELL_NAME;</code>
</div>
<div class="line number11 index10 alt2">
<code class="bash spaces">   </code><code class="bash plain">new_argv = </code><code class="bash string">"-c"</code><code class="bash plain">;</code>
</div>
<div class="line number12 index11 alt1">
<code class="bash spaces">   </code><code class="bash plain">new_argv = line;</code>
</div>
<div class="line number13 index12 alt2">
<code class="bash spaces">   </code><code class="bash plain">new_argv = NULL;</code>
</div>
<div class="line number14 index13 alt1">
</div>
<div class="line number15 index14 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Restore the signals. */</code>
</div>
<div class="line number16 index15 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);</code>
</div>
<div class="line number17 index16 alt2">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);</code>
</div>
<div class="line number18 index17 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL);</code>
</div>
<div class="line number19 index18 alt2">
<code class="bash spaces">   </code><code class="bash plain">INIT_LOCK ();</code>
</div>
<div class="line number20 index19 alt1">
</div>
<div class="line number21 index20 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Exec the shell. */</code>
</div>
<div class="line number22 index21 alt1">
<code class="bash spaces">   </code><code class="bash plain">(void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);</code>
</div>
<div class="line number23 index22 alt2">
<code class="bash spaces">   </code><code class="bash plain">_exit (127);</code>
</div>
<div class="line number24 index23 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
<div class="line number25 index24 alt2">
<code class="bash spaces"> </code><code class="bash keyword">else</code> <code class="bash keyword">if</code> <code class="bash plain">(pid < (pid_t) 0)</code>
</div>
<div class="line number26 index25 alt1">
<code class="bash spaces">  </code><code class="bash plain">/* The fork failed. */</code>
</div>
<div class="line number27 index26 alt2">
<code class="bash spaces">  </code><code class="bash plain">status = -1;</code>
</div>
<div class="line number28 index27 alt1">
<code class="bash spaces"> </code><code class="bash keyword">else</code>
</div>
<div class="line number29 index28 alt2">
<code class="bash spaces">  </code><code class="bash plain">/* Parent side. */</code>
</div>
<div class="line number30 index29 alt1">
<code class="bash spaces">  </code><code class="bash plain">{</code>
</div>
<div class="line number31 index30 alt2">
<code class="bash spaces">   </code><code class="bash plain">/* Note the system() is a cancellation point. But since we call</code>
</div>
<div class="line number32 index31 alt1">
<code class="bash spaces">   </code><code class="bash plain">waitpid() </code><code class="bash functions">which</code> <code class="bash plain">itself is a cancellation point we </code><code class="bash keyword">do</code> <code class="bash plain">not</code>
</div>
<div class="line number33 index32 alt2">
<code class="bash spaces">   </code><code class="bash plain">have to </code><code class="bash keyword">do</code> <code class="bash plain">anything here. */</code>
</div>
<div class="line number34 index33 alt1">
<code class="bash spaces">   </code><code class="bash keyword">if</code> <code class="bash plain">(TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid)</code>
</div>
<div class="line number35 index34 alt2">
<code class="bash spaces">  </code><code class="bash plain">status = -1;</code>
</div>
<div class="line number36 index35 alt1">
<code class="bash spaces">  </code><code class="bash plain">}</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
首先通过前端函数调用系统调用fork产生一个子进程，其中fork有两个返回值，对父进程返回子进程的pid，对子进程返回0。所以子进程执行6-24行代码，父进程执行30-35行代码。</p>
<p>
子进程的逻辑非常清晰，调用execve执行SHELL_PATH指定的程序，参数通过new_argv传递，环境变量为全局变量__environ。</p>
<p>
其中SHELL_PATH和SHELL_NAME定义如下</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_722158">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments">#define SHELL_PATH "/bin/sh" /* Path of the shell. */</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash comments">#define SHELL_NAME "sh"    /* Name to give it. */</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
其实就是生成一个子进程调用<strong><span>/bin/sh -c "命令"</span></strong>来执行向system传入的命令。 </p>
<p>
下面其实是我研究system函数的原因与重点：</p>
<p>
在CTF的pwn题中，通过栈溢出调用system函数有时会失败，听师傅们说是环境变量被覆盖，但是一直都是懵懂，今天深入学习了一下，总算搞明白了。</p>
<p>
在这里system函数需要的环境变量储存在全局变量__environ中，那么这个变量的内容是什么呢。</p>
<p>
__environ是在glibc/csu/libc-start.c中定义的，我们来看几个关键语句。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_598236">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments"># define LIBC_START_MAIN __libc_start_main</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
__libc_start_main是_start调用的函数，这涉及到程序开始时的一些初始化工作，对这些名词不了解的话可以看一下这篇文章。接下来看LIBC_START_MAIN函数。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_577708">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">STATIC int</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash spaces">     </code><code class="bash plain">int argc, char **argv,</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash comments">#ifdef LIBC_START_MAIN_AUXVEC_ARG</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash spaces">     </code><code class="bash plain">ElfW(auxv_t) *auxvec,</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash comments">#endif</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash spaces">     </code><code class="bash plain">__typeof (main) init,</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash spaces">     </code><code class="bash plain">void (*fini) (void),</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash spaces">     </code><code class="bash plain">void (*rtld_fini) (void), void *stack_end)</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash plain">{</code>
</div>
<div class="line number11 index10 alt2">
<code class="bash spaces"> </code><code class="bash plain">/* Result of the </code><code class="bash string">'main'</code> <code class="bash keyword">function</code><code class="bash plain">. */</code>
</div>
<div class="line number12 index11 alt1">
<code class="bash spaces"> </code><code class="bash plain">int result;</code>
</div>
<div class="line number13 index12 alt2">
</div>
<div class="line number14 index13 alt1">
<code class="bash spaces"> </code><code class="bash plain">__libc_multiple_libcs = &_dl_starting_up && !_dl_starting_up;</code>
</div>
<div class="line number15 index14 alt2">
</div>
<div class="line number16 index15 alt1">
<code class="bash comments">#ifndef SHARED</code>
</div>
<div class="line number17 index16 alt2">
<code class="bash spaces"> </code><code class="bash plain">char **ev = &argv;</code>
</div>
<div class="line number18 index17 alt1">
</div>
<div class="line number19 index18 alt2">
<code class="bash spaces"> </code><code class="bash plain">__environ = ev;</code>
</div>
<div class="line number20 index19 alt1">
</div>
<div class="line number21 index20 alt2">
<code class="bash spaces"> </code><code class="bash plain">/* Store the lowest stack address. This is </code><code class="bash keyword">done</code> <code class="bash keyword">in</code> <code class="bash plain">ld.so </code><code class="bash keyword">if</code> <code class="bash plain">this is</code>
</div>
<div class="line number22 index21 alt1">
<code class="bash spaces">   </code><code class="bash plain">the code </code><code class="bash keyword">for</code> <code class="bash plain">the DSO. */</code>
</div>
<div class="line number23 index22 alt2">
<code class="bash spaces"> </code><code class="bash plain">__libc_stack_end = stack_end;</code>
</div>
<div class="line number24 index23 alt1">
</div>
<div class="line number25 index24 alt2">
<code class="bash plain">　　　　......</code>
</div>
<div class="line number26 index25 alt1">
<code class="bash spaces"> </code><code class="bash plain">/* Nothing fancy, just call the </code><code class="bash keyword">function</code><code class="bash plain">. */</code>
</div>
<div class="line number27 index26 alt2">
<code class="bash spaces"> </code><code class="bash plain">result = main (argc, argv, __environ MAIN_AUXVEC_PARAM);</code>
</div>
<div class="line number28 index27 alt1">
<code class="bash comments">#endif</code>
</div>
<div class="line number29 index28 alt2">
</div>
<div class="line number30 index29 alt1">
<code class="bash spaces"> </code><code class="bash functions">exit</code> <code class="bash plain">(result);</code>
</div>
<div class="line number31 index30 alt2">
<code class="bash plain">}</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
我们可以看到，在没有define SHARED的情况下，在第19行定义了__environ的值。启动程序调用LIBC_START_MAIN之前，会先将环境变量和argv中的字符串保存起来（其实是保存到栈上），然后依次将环境变量中各项字符串的地址，argv中各项字符串的地址和argc入栈，所以环境变量数组一定位于argv数组的正后方，以一个空地址间隔。所以第17行的&argv语句就是取环境变量数组在栈上的首地址，保存到ev中，最终保存到__environ中。第203行调用main函数，会将__environ的值入栈，这个被栈溢出覆盖掉没什么问题，只要保证__environ中的地址处不被覆盖即可。</p>
<p>
所以，当栈溢出的长度过大，溢出的内容覆盖了__environ中地址中的重要内容时，调用system函数就会失败。具体环境变量距离溢出地址有多远，可以通过在_start中下断查看。</p>
<p>
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。</p>

頁: [1]

琼殿技术论坛's Archiver

linux下system函数的简单分析