On Mon, 16 Jun 2025 09:46:11 GMT, Sergey Chernyshev <schernys...@openjdk.org> wrote:
> Hi all, > > I would like to propose a fix for JDK-8319589. This will allow jcmd and jps > running as root to get the complete list of JVMs running by all users, and to > attach from root to non-root JVMs. Previously, JDK-8197387 introduced the > same approach on Linux. > > This change affects macOS, that uses "secure" per-user temporary directories. > It only affects JVMs running as root, the behavior in non-privileged JVMs > remains unchanged. > > Jcmd and jps rely on LocalVmManager to get the initial list of the local VMs. > The LocalVmManager uses sun.jvmstat.PlatformSupport to get the list of temp > directories, where it searches for user's PerfData directory such as > "hsperfdata_<username\>". In macosx the temp directories are per-user, the > temp path is returned by confstr(_CS_DARWIN_USER_TEMP_DIR). The per-user > directories are mode 700 and so they are read-protected from non-privileged > users and can be accessed by the owner and the root. > > Both jps and jcmd (HotSpotAttachProvider) create MonitoredVm objects, that > have PerfDataBuffer that performs attachment to the target. Only the > attachable VMs are listed in jcmd output. > > The proposed patch changes the list of directories returned by the > PlatformSupport#getTemporaryDirectories() in VMs running as root. The list is > later used in VirtualMachineImpl (jdk.attach). It changes also the way > mmap_attach_shared() searches for hsperfdata_<username\>/<pid\> files to map > the shared memory. Mmap_attach_shared() and VirtualMachineImpl (via > PlatformSupport) list the content of /var/folders, where the temp directories > are located, more specificly the temp directories are > /var/folders/<BUCKET\>/<ENCODED_UUID_UID\>/T as hinted in [1]. The full list > is returned by newly added PlatformSupportImpl#getTemporaryDirectories(). > > The attaching client's VirtualMachineImpl needs the target process's temp > directory to find .java<pid\> and create .attach<pid\> files. It uses the > list returned by PlatformSupportImpl#getTemporaryDirectories() and the > ProcessHandle of the target process to search for user's PerfData directory, > e.g. hsperfdata_<username\>, which is in the target process's temp directory, > exactly where it expects to see the .java<pid\> in return on sending SIGQUIT > to the target VM. > > Mmap_attach_shared() traverses the /var/folders in get_user_tmp_dir() and > looks for a hsperfdata_<username\> folder. If that folder is found in > /var/folders/*/*/T, that means the temp folder corresponds to the <username\> > and to the JVM being attached to. > > The pa... src/hotspot/os/posix/perfMemory_posix.cpp line 133: > 131: // > 132: > 133: #ifdef __APPLE__ This is a bit too much non-posix code in the posix file IMO. I'd rather see a `MACOS_ONLY` call later on to something defined in `os_bsd.cpp` for macOS. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/25824#discussion_r2151315769
