Problem - Kevin Tafuro

It’s important to remember that the new process is a copy of the original. The contents
of the original process’s memory (including stack), file descriptor table, and any
other process attributes are the same in both processes, but they’re not shared. Any
changes to memory contents, file descriptors, and so on are private to the process
that is making them. In other words, if the new process changes its file position
pointer in an open file, the file position pointer for the same file in the original process
remains unchanged.
The fact that the new process is a copy of the original has important security considerations
that are often overlooked. For example, if a PRNG is seeded in the original
process, it will be seeded identically in the child process. This means that if both the
original and new processes were to obtain random data from the PRNG, they would
both get the same random data (see Figure 1-2)! The solution to this problem is to
reseed the PRNG in one of the processes, or, preferably, both processes. By reseeding
the PRNG in both processes, neither process will have any knowledge of the
other’s PRNG state. Be sure to do this in a thread-safe manner if your program can
fork multiple processes.
Process #1
PRNG output for parent process
Process #2
PRNG output for child process
0x65 0xB7 0x6D 0xDE 0xDF 0xA1 0x88
fork() happens here
0x6D 0xDE 0xDF 0xA1 0x88
Figure 1-2. Consequences of not reseeding PRNGs after calling fork( )
At the time of the call to fork( ), any open file descriptors in the original process will
also be open in the new process. If any of these descriptors are unnecessary, they
should be closed; they will remain open in the other process. Closing unnecessary
file descriptors is especially important if one of the processes is going to execute
another program (see Recipe 1.5).
Finally, the new process also inherits its access rights from the original process. Normally
this is not an issue, but if the parent process had extra privileges because it was
executed setuid or setgid, the new process will also have the extra privileges. If the
new process does not need these privileges, they should be dropped immediately (see
Recipe 1.3). Any extra privileges should be dropped especially if one of the two processes
is going to execute a new program.
The following function, spc_fork( ), is a wrapper around fork( ). As presented here,
the code is incomplete when using an application-level random number generator; it
will require the appropriate code to reseed whatever PRNG you’re using. It assumes
that the new child process is the process that will be used to perform any work that
does not require any extra privileges that the process may have. It is rare that when a
Creating a Child Process Securely | 27
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.