Rich Felker
d5304147b9
usage of vfork creates a situation where a process of lower privilege may momentarily have write access to the memory of a process of higher privilege. consider the case of a multi-threaded suid program which is calling posix_spawn in one thread while another thread drops the elevated privileges then runs untrusted (relative to the elevated privilege) code as the original invoking user. this untrusted code can then potentially modify the data the child process will use before calling exec, for example changing the pathname or arguments that will be passed to exec. note that if vfork is implemented as fork, the lock will not be held until the child execs, but since memory is not shared it does not matter.
musl libc - a new standard library to power a new generation of
Linux-based devices. musl is lightweight, fast, simple, free, and
strives to be correct in the sense of standards-conformance and
safety.
musl is an alternative to glibc, eglibc, uClibc, dietlibc, and klibc.
For reasons why one might prefer musl, please see the FAQ and libc
comparison chart on the project website,
http://www.etalabs.net/musl/
For installation instructions, see the INSTALL file.
Please refer to the COPYRIGHT file for details on the copyright and
license status of code included in musl (standard MIT license).
Greetings!
With the 0.9.0 release, musl has reached a milestone in completeness
and compatibility. All interfaces in ISO C99 and POSIX 2008 base exist
in musl, along with a number of non-standardized interfaces based on
GNU and BSD libraries and syscall interfaces for Linux-kernel-specific
functions. Some interfaces lack obscure or rarely-used functionality
needed for strict conformance, but the vast majority of interfaces go
above and beyond the requirements for conformance, often promising
success where other implementations can fail under resource exhaustion
or other corner-case conditions.
At this point, hundreds of packages have been successfully built
against musl - either out-of-the-box or with minor patches to address
portability errors - ranging from low-level system utilities and
network daemons to major gui applications. Testing has been conducted
using three separate test frameworks and numerous additional
standalone test cases to verify the correctness of the implementation.
Included with this package is a gcc wrapper script (musl-gcc) which
allows you to build musl-linked programs using an existing gcc 3.x or
4.x toolchain on the host. There are also now at several mini
distributions (in the form of build scripts) which provide a
self-hosting musl-based toolchain and system root. These are much
better options than the wrapper script if you wish to use dynamic
linking or build packages with many library dependencies. See the musl
website for details.
The musl project is actively seeking contributors, mostly in the areas
of porting, testing, and application compatibility improvement. For
bug reports, support requests, or to get involved in development,
please visit #musl on Freenode IRC or subscribe to the musl mailing
list by sending a blank email to musl-subscribe AT lists DOT openwall
DOT com.
Thank you for using musl.
Cheers,
Rich Felker / dalias