Changeset 92617 in vbox for trunk/src/VBox/Runtime/r3/posix

Timestamp:

Nov 29, 2021 1:04:10 AM (3 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

148509

Message:

IPRT,RTProcCreatEx/posix: Run the login shell with a command dumping the environment to properly implement RTPROC_FLAGS_PROFILE. Tested on linux with sh, bash, zsh, ksh, ksh93, csh, tcsh, and tmux. bugref:10153

File:

• trunk/src/VBox/Runtime/r3/posix/process-creation-posix.cpp (modified) (25 diffs)

trunk/src/VBox/Runtime/r3/posix/process-creation-posix.cpp

@@ -112 +112 @@
 # define _PATH_STDPATH "/sbin:/usr/sbin:/bin:/usr/bin"
 #endif
+#ifndef _PATH_BSHELL
+# define _PATH_BSHELL "/bin/sh"
+#endif
 
 
@@ -118 +121 @@
 
 #include <iprt/assert.h>
+#include <iprt/ctype.h>
 #include <iprt/env.h>
 #include <iprt/err.h>
@@ -146 +150 @@
 typedef RTPROCPAMARGS *PRTPROCPAMARGS;
 #endif
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+/** Environment dump marker used with CSH.   */
+static const char g_szEnvMarkerBegin[] = "IPRT_EnvEnvEnv_Begin_EnvEnvEnv";
+/** Environment dump marker used with CSH.   */
+static const char g_szEnvMarkerEnd[]   = "IPRT_EnvEnvEnv_End_EnvEnvEnv";
+
+
+/*********************************************************************************************************************************
+*   Internal Functions                                                                                                           *
+*********************************************************************************************************************************/
+static int rtProcPosixCreateInner(const char *pszExec, const char * const *papszArgs, RTENV hEnv, RTENV hEnvToUse,
+                                  uint32_t fFlags, const char *pszAsUser, uid_t uid, gid_t gid,
+                                  unsigned cRedirFds, int *paRedirFds, PRTPROCESS phProcess);
 
 
@@ -565 +586 @@
 
 /**
- * Create a very very basic environment for a user.
+ * Undos quoting and escape sequences and looks for stop characters.
+ *
+ * @returns Where to continue scanning in @a pszString.  This points to the
+ *          next character after the stop character, but for the zero terminator
+ *          it points to the terminator character.
+ * @param   pszString           The string to undo quoting and escaping for.
+ *                              This is both input and output as the work is
+ *                              done in place.
+ * @param   pfStoppedOnEqual    Where to return whether we stopped work on a
+ *                              plain equal characater or not.  If this is NULL,
+ *                              then the equal character is not a stop
+ *                              character, then only newline and the zero
+ *                              terminator are.
+ */
+static char *rtProcPosixProfileEnvUnquoteAndUnescapeString(char *pszString, bool *pfStoppedOnEqual)
+{
+    if (pfStoppedOnEqual)
+        *pfStoppedOnEqual = false;
+
+    enum { kPlain, kSingleQ, kDoubleQ } enmState = kPlain;
+    char *pszDst = pszString;
+    for (;;)
+    {
+        char ch = *pszString++;
+        switch (ch)
+        {
+            default:
+                *pszDst++ = ch;
+                break;
+
+            case '\\':
+            {
+                char ch2;
+                if (   enmState == kSingleQ
+                    || (ch2 = *pszString) == '\0'
+                    || (enmState == kDoubleQ && strchr("\\$`\"\n", ch2) == NULL) )
+                    *pszDst++ = ch;
+                else
+                {
+                    *pszDst++ = ch2;
+                    pszString++;
+                }
+                break;
+            }
+
+            case '"':
+                if (enmState == kSingleQ)
+                    *pszDst++ = ch;
+                else
+                    enmState = enmState == kPlain ? kDoubleQ : kPlain;
+                break;
+
+            case '\'':
+                if (enmState == kDoubleQ)
+                    *pszDst++ = ch;
+                else
+                    enmState = enmState == kPlain ? kSingleQ : kPlain;
+                break;
+
+            case '\n':
+                if (enmState == kPlain)
+                {
+                    *pszDst = '\0';
+                    return pszString;
+                }
+                *pszDst++ = ch;
+                break;
+
+            case '=':
+                if (enmState == kPlain && pfStoppedOnEqual)
+                {
+                    *pszDst = '\0';
+                    *pfStoppedOnEqual = true;
+                    return pszString;
+                }
+                *pszDst++ = ch;
+                break;
+
+            case '\0':
+                Assert(enmState == kPlain);
+                *pszDst = '\0';
+                return pszString - 1;
+        }
+    }
+}
+
+
+/**
+ * Worker for rtProcPosixProfileEnvRunAndHarvest that parses the environment
+ * dump and loads it into hEnvToUse.
+ *
+ * @note    This isn't entirely correct should any of the profile setup scripts
+ *          unset any of the environment variables in the basic initial
+ *          enviornment, but since that's unlikely and it's very convenient to
+ *          have something half sensible as a basis if don't don't grok the dump
+ *          entirely and would skip central stuff like PATH or HOME.
+ *
+ * @returns IPRT status code.
+ * @retval  -VERR_PARSE_ERROR (positive, e.g. warning) if we run into trouble.
+ * @retval  -VERR_INVALID_UTF8_ENCODING (positive, e.g. warning) if there are
+ *          invalid UTF-8 in the environment.  This isn't unlikely if the
+ *          profile doesn't use UTF-8.  This is unfortunately not something we
+ *          can guess to accurately up front, so we don't do any guessing and
+ *          hope everyone is sensible and use UTF-8.
+ * @param   hEnvToUse       The basic environment to extend with what we manage
+ *                          to parse here.
+ * @param   pszEnvDump      The environment dump to parse.  Nominally in Bourne
+ *                          shell 'export -p' format.
+ * @param   fWithMarkers    Whether there are markers around the dump (C shell,
+ *                          tmux) or not.
+ */
+static int rtProcPosixProfileEnvHarvest(RTENV hEnvToUse, char *pszEnvDump, bool fWithMarkers)
+{
+    LogFunc(("**** pszEnvDump start ****\n%s**** pszEnvDump end ****\n", pszEnvDump));
+
+    /*
+     * Clip dump at markers if we're using them (C shell).
+     */
+    if (fWithMarkers)
+    {
+        char *pszStart = strstr(pszEnvDump, g_szEnvMarkerBegin);
+        AssertReturn(pszStart, -VERR_PARSE_ERROR);
+        pszStart += sizeof(g_szEnvMarkerBegin) - 1;
+        if (*pszStart == '\n')
+            pszStart++;
+        pszEnvDump = pszStart;
+
+        char *pszEnd = strstr(pszStart, g_szEnvMarkerEnd);
+        AssertReturn(pszEnd, -VERR_PARSE_ERROR);
+        *pszEnd = '\0';
+    }
+
+    /*
+     * Since we're using /bin/sh -c "export -p" for all the dumping, we should
+     * always get lines on the format:
+     *     export VAR1="Value 1"
+     *     export VAR2=Value2
+     *
+     * However, just in case something goes wrong, like bash doesn't think it
+     * needs to be posixly correct, try deal with the alternative where
+     * "declare -x " replaces the "export".
+     */
+    const char *pszPrefix;
+    if (   strncmp(pszEnvDump, RT_STR_TUPLE("export")) == 0
+        && RT_C_IS_BLANK(pszEnvDump[6]))
+        pszPrefix = "export ";
+    else if (   strncmp(pszEnvDump, RT_STR_TUPLE("declare")) == 0
+             && RT_C_IS_BLANK(pszEnvDump[7])
+             && pszEnvDump[8] == '-')
+        pszPrefix = "declare -x "; /* We only need to care about the non-array, non-function lines. */
+    else
+        AssertFailedReturn(-VERR_PARSE_ERROR);
+    size_t const cchPrefix = strlen(pszPrefix);
+
+    /*
+     * Process the lines, ignoring stuff which we don't grok.
+     * The shell should quote problematic characters. Bash double quotes stuff
+     * by default, whereas almquist's shell does it as needed and only the value
+     * side.
+     */
+    int rc = VINF_SUCCESS;
+    while (pszEnvDump && *pszEnvDump != '\0')
+    {
+        /*
+         * Skip the prefixing command.
+         */
+        if (   cchPrefix == 0
+            || strncmp(pszEnvDump, pszPrefix, cchPrefix) == 0)
+        {
+            pszEnvDump += cchPrefix;
+            while (RT_C_IS_BLANK(*pszEnvDump))
+                pszEnvDump++;
+        }
+        else
+        {
+            /* Oops, must find our bearings for some reason... */
+            pszEnvDump = strchr(pszEnvDump, '\n');
+            rc = -VERR_PARSE_ERROR;
+            continue;
+        }
+
+        /*
+         * Parse out the variable name using typical bourne shell escaping
+         * and quoting rules.
+         */
+        /** @todo We should throw away lines that aren't propertly quoted, now we
+         *        just continue and use what we found. */
+        const char *pszVar               = pszEnvDump;
+        bool        fStoppedOnPlainEqual = false;
+        pszEnvDump = rtProcPosixProfileEnvUnquoteAndUnescapeString(pszEnvDump, &fStoppedOnPlainEqual);
+        const char *pszValue             = pszEnvDump;
+        if (fStoppedOnPlainEqual)
+            pszEnvDump = rtProcPosixProfileEnvUnquoteAndUnescapeString(pszEnvDump, NULL /*pfStoppedOnPlainEqual*/);
+        else
+            pszValue = "";
+
+        /*
+         * Add them if valid UTF-8, otherwise we simply drop them for now.
+         * The whole codeset stuff goes seriously wonky here as the environment
+         * we're harvesting probably contains it's own LC_CTYPE or LANG variables,
+         * so ignore the problem for now.
+         */
+        if (   RTStrIsValidEncoding(pszVar)
+            && RTStrIsValidEncoding(pszValue))
+        {
+            int rc2 = RTEnvSetEx(hEnvToUse, pszVar, pszValue);
+            AssertRCReturn(rc2, rc2);
+        }
+        else if (rc == VINF_SUCCESS)
+            rc = -VERR_INVALID_UTF8_ENCODING;
+    }
+
+    return rc;
+}
+
+
+/**
+ * Runs the user's shell in login mode with some environment dumping logic and
+ * harvests the dump, putting it into hEnvToUse.
+ *
+ * This is a bit hairy, esp. with regards to codesets.
+ *
+ * @returns IPRT status code.  Not all error statuses will be returned and the
+ *          caller should just continue with whatever is in hEnvToUse.
+ * @param   hEnvToUse   On input this is the basic user environment, on success
+ *                      in is fleshed out with stuff from the login shell dump.
+ * @param   pszAsUser   The user name for the profile.  NULL if the current
+ *                      user.
+ * @param   uid         The UID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   gid         The GID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   pszShell    The login shell.  This is a writable string to avoid
+ *                      needing to make a copy of it when examining the path
+ *                      part, instead we make a temporary change to it which is
+ *                      always reverted before returning.
+ */
+static int rtProcPosixProfileEnvRunAndHarvest(RTENV hEnvToUse, const char *pszAsUser, uid_t uid, gid_t gid, char *pszShell)
+{
+    LogFlowFunc(("pszAsUser=%s uid=%u gid=%u pszShell=%s; hEnvToUse contains %u variables on entry\n",
+                 pszAsUser, uid, gid, pszShell, RTEnvCountEx(hEnvToUse) ));
+
+    /*
+     * The three standard handles should be pointed to /dev/null, the 3rd handle
+     * is used to dump the environment.
+     */
+    RTPIPE hPipeR, hPipeW;
+    int rc = RTPipeCreate(&hPipeR, &hPipeW, 0);
+    if (RT_SUCCESS(rc))
+    {
+        RTFILE hFileNull;
+        rc = RTFileOpenBitBucket(&hFileNull, RTFILE_O_READWRITE);
+        if (RT_SUCCESS(rc))
+        {
+            int aRedirFds[4];
+            aRedirFds[0] = aRedirFds[1] = aRedirFds[2] = RTFileToNative(hFileNull);
+            aRedirFds[3] = RTPipeToNative(hPipeW);
+
+            /*
+             * Allocate a buffer for receiving the environment dump.
+             *
+             * This is fixed sized for simplicity and safety (creative user script
+             * shouldn't be allowed to exhaust our memory or such, after all we're
+             * most likely running with root privileges in this code path).
+             */
+            size_t const  cbEnvDump  = _64K;
+            char  * const pszEnvDump = (char *)RTMemTmpAllocZ(cbEnvDump);
+            if (pszEnvDump)
+            {
+                /*
+                 * Our default approach is using /bin/sh:
+                 */
+                const char *pszExec = _PATH_BSHELL;
+                const char *apszArgs[8];
+                apszArgs[0] = "-sh";        /* First arg must start with a dash for login shells. */
+                apszArgs[1] = "-c";
+                apszArgs[2] = "POSIXLY_CORRECT=1;export -p >&3";
+                apszArgs[3] = NULL;
+
+                /*
+                 * But see if we can trust the shell to be a real usable shell.
+                 * This would be great as different shell typically has different profile setup
+                 * files and we'll endup with the wrong enviornment if we use a different shell.
+                 */
+                char        szDashShell[32];
+                char        szExportArg[128];
+                bool        fWithMarkers = false;
+                const char *pszShellNm   = RTPathFilename(pszShell);
+                if (   pszShellNm
+                    && access(pszShellNm, X_OK))
+                {
+                    /*
+                     * First the check that it's a known bin directory:
+                     */
+                    size_t const cchShellPath = pszShellNm - pszShell;
+                    char const   chSaved = pszShell[cchShellPath - 1];
+                    pszShell[cchShellPath - 1] = '\0';
+                    if (   RTPathCompare(pszShell, "/bin") == 0
+                        || RTPathCompare(pszShell, "/usr/bin") == 0
+                        || RTPathCompare(pszShell, "/usr/local/bin") == 0)
+                    {
+                        /*
+                         * Then see if we recognize the shell name.
+                         */
+                        RTStrCopy(&szDashShell[1], sizeof(szDashShell) - 1, pszShellNm);
+                        szDashShell[0] = '-';
+                        if (   strcmp(pszShellNm, "bash") == 0
+                            || strcmp(pszShellNm, "ksh") == 0
+                            || strcmp(pszShellNm, "ksh93") == 0
+                            || strcmp(pszShellNm, "zsh") == 0)
+                        {
+                            pszExec      = pszShell;
+                            apszArgs[0]  = szDashShell;
+
+                            /* Use /bin/sh for doing the environment dumping so we get the same kind
+                               of output from everyone and can limit our parsing + testing efforts. */
+                            RTStrPrintf(szExportArg, sizeof(szExportArg),
+                                        "%s -c 'POSIXLY_CORRECT=1;export -p >&3'", _PATH_BSHELL);
+                            apszArgs[2]  = szExportArg;
+                        }
+                        /* C shell is very annoying in that it closes fd 3 without regard to what
+                           we might have put there, so we must use stdout here but with markers so
+                           we can find the dump.
+                           Seems tmux have similar issues as it doesn't work above, but works fine here. */
+                        else if (   strcmp(pszShellNm, "csh") == 0
+                                 || strcmp(pszShellNm, "tcsh") == 0
+                                 || strcmp(pszShellNm, "tmux") == 0)
+                        {
+                            pszExec      = pszShell;
+                            apszArgs[0]  = szDashShell;
+
+                            fWithMarkers = true;
+                            size_t cch = RTStrPrintf(szExportArg, sizeof(szExportArg),
+                                                     "%s -c 'set -e;POSIXLY_CORRECT=1;echo %s;export -p;echo %s'",
+                                                     _PATH_BSHELL, g_szEnvMarkerBegin, g_szEnvMarkerEnd);
+                            Assert(cch < sizeof(szExportArg) - 1); RT_NOREF(cch);
+                            apszArgs[2]  = szExportArg;
+
+                            aRedirFds[1] = aRedirFds[3];
+                            aRedirFds[3] = -1;
+                        }
+                    }
+                    pszShell[cchShellPath - 1] = chSaved;
+                }
+
+                /*
+                 * Create the process and wait for the output.
+                 */
+                LogFunc(("Executing '%s': '%s', '%s', '%s'\n", pszExec, apszArgs[0], apszArgs[1], apszArgs[2]));
+                RTPROCESS hProcess = NIL_RTPROCESS;
+                rc = rtProcPosixCreateInner(pszExec, apszArgs, hEnvToUse, hEnvToUse, 0 /*fFlags*/,
+                                            pszAsUser, uid, gid, RT_ELEMENTS(aRedirFds), aRedirFds, &hProcess);
+                if (RT_SUCCESS(rc))
+                {
+                    RTPipeClose(hPipeW);
+                    hPipeW = NIL_RTPIPE;
+
+                    size_t         offEnvDump = 0;
+                    uint64_t const msStart    = RTTimeMilliTS();
+                    for (;;)
+                    {
+                        size_t cbRead = 0;
+                        if (offEnvDump < cbEnvDump - 1)
+                        {
+                            rc = RTPipeRead(hPipeR, &pszEnvDump[offEnvDump], cbEnvDump - 1 - offEnvDump, &cbRead);
+                            if (RT_SUCCESS(rc))
+                                offEnvDump += cbRead;
+                            else
+                            {
+                                LogFlowFunc(("Breaking out of read loop: %Rrc\n", rc));
+                                if (rc == VERR_BROKEN_PIPE)
+                                    rc = VINF_SUCCESS;
+                                break;
+                            }
+                            pszEnvDump[offEnvDump] = '\0';
+                        }
+                        else
+                        {
+                            LogFunc(("Too much data in environment dump, dropping it\n"));
+                            rc = VERR_TOO_MUCH_DATA;
+                            break;
+                        }
+
+                        /* Do the timout check. */
+                        uint64_t const cMsElapsed = RTTimeMilliTS() - msStart;
+                        if (cMsElapsed >= RT_MS_15SEC)
+                        {
+                            LogFunc(("Timed out after %RU64 ms\n", cMsElapsed));
+                            rc = VERR_TIMEOUT;
+                            break;
+                        }
+
+                        /* If we got no data in above wait for more to become ready. */
+                        if (!cbRead)
+                            RTPipeSelectOne(hPipeR, RT_MS_15SEC - cMsElapsed);
+                    }
+
+                    /*
+                     * Kill the process and wait for it to avoid leaving zombies behind.
+                     */
+                    /** @todo do we check the exit code? */
+                    int rc2 = RTProcWait(hProcess, RTPROCWAIT_FLAGS_NOBLOCK, NULL);
+                    if (RT_SUCCESS(rc2))
+                        LogFlowFunc(("First RTProcWait succeeded\n"));
+                    else
+                    {
+                        LogFunc(("First RTProcWait failed (%Rrc), terminating and doing a blocking wait\n", rc2));
+                        RTProcTerminate(hProcess);
+                        RTProcWait(hProcess, RTPROCWAIT_FLAGS_BLOCK, NULL);
+                    }
+
+                    /*
+                     * Parse the result.
+                     */
+                    if (RT_SUCCESS(rc))
+                        rc = rtProcPosixProfileEnvHarvest(hEnvToUse, pszEnvDump, fWithMarkers);
+                    else
+                    {
+                        LogFunc(("Ignoring rc=%Rrc from the pipe read loop and continues with basic environment\n", rc));
+                        rc = -rc;
+                    }
+                }
+                else
+                    LogFunc(("Failed to create process '%s': %Rrc\n", pszExec, rc));
+                RTMemTmpFree(pszEnvDump);
+            }
+            else
+            {
+                LogFunc(("Failed to allocate %#zx bytes for the dump\n", cbEnvDump));
+                rc = VERR_NO_TMP_MEMORY;
+            }
+            RTFileClose(hFileNull);
+        }
+        else
+            LogFunc(("Failed to open /dev/null: %Rrc\n", rc));
+        RTPipeClose(hPipeR);
+        RTPipeClose(hPipeW);
+    }
+    else
+        LogFunc(("Failed to create pipe: %Rrc\n", rc));
+    LogFlowFunc(("returns %Rrc (hEnvToUse contains %u variables now)\n", rc, RTEnvCountEx(hEnvToUse)));
+    return rc;
+}
+
+
+/**
+ * Create an environment for the given user.
+ *
+ * This starts by creating a very basic environment and then tries to do it
+ * properly by running the user's shell in login mode with some environment
+ * dumping attached.  The latter may fail and we'll ignore that for now and move
+ * ahead with the very basic environment.
  *
  * @returns IPRT status code.
  * @param   phEnvToUse  Where to return the created environment.
- * @param   pszUser     The user name for the profile.
+ * @param   pszAsUser   The user name for the profile.  NULL if the current
+ *                      user.
+ * @param   uid         The UID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   gid         The GID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   fFlags      RTPROC_FLAGS_XXX
  */
-static int rtProcPosixCreateProfileEnv(PRTENV phEnvToUse, const char *pszUser)
+static int rtProcPosixCreateProfileEnv(PRTENV phEnvToUse, const char *pszAsUser, uid_t uid, gid_t gid, uint32_t fFlags)
 {
     struct passwd   Pwd;
@@ -578 +1052 @@
     int             rc;
     errno = 0;
-    if (pszUser)
-        rc = getpwnam_r(pszUser, &Pwd, achBuf, sizeof(achBuf), &pPwd);
+    if (pszAsUser)
+        rc = getpwnam_r(pszAsUser, &Pwd, achBuf, sizeof(achBuf), &pPwd);
     else
         rc = getpwuid_r(getuid(), &Pwd, achBuf, sizeof(achBuf), &pPwd);
@@ -588 +1062 @@
         if (RT_SUCCESS(rc))
         {
+#if 0 /* Enable and modify this to test shells other that your login shell. */
+            pPwd->pw_shell = (char *)"/bin/tmux";
+#endif
             char *pszShell;
             rc = RTStrCurrentCPToUtf8(&pszShell, pPwd->pw_shell);
             if (RT_SUCCESS(rc))
             {
-                char *pszUserFree = NULL;
-                if (!pszUser)
+                char *pszAsUserFree = NULL;
+                if (!pszAsUser)
                 {
-                    rc = RTStrCurrentCPToUtf8(&pszUserFree, pPwd->pw_name);
+                    rc = RTStrCurrentCPToUtf8(&pszAsUserFree, pPwd->pw_name);
                     if (RT_SUCCESS(rc))
-                        pszUser = pszUserFree;
+                        pszAsUser = pszAsUserFree;
                 }
                 if (RT_SUCCESS(rc))
@@ -610 +1087 @@
                             rc = RTEnvSetEx(hEnvToUse, "SHELL", pszShell);
                         if (RT_SUCCESS(rc))
-                            rc = RTEnvSetEx(hEnvToUse, "USER", pszUser);
+                            rc = RTEnvSetEx(hEnvToUse, "USER", pszAsUser);
                         if (RT_SUCCESS(rc))
-                            rc = RTEnvSetEx(hEnvToUse, "LOGNAME", pszUser);
+                            rc = RTEnvSetEx(hEnvToUse, "LOGNAME", pszAsUser);
 
                         if (RT_SUCCESS(rc))
@@ -619 +1096 @@
                         if (RT_SUCCESS(rc))
                         {
-                            RTStrPrintf(achBuf, sizeof(achBuf), "%s/%s", _PATH_MAILDIR, pszUser);
+                            RTStrPrintf(achBuf, sizeof(achBuf), "%s/%s", _PATH_MAILDIR, pszAsUser);
                             rc = RTEnvSetEx(hEnvToUse, "MAIL", achBuf);
                         }
 
 #ifdef RT_OS_DARWIN
-                        if (RT_SUCCESS(rc) && !pszUserFree)
+                        if (RT_SUCCESS(rc) && !pszAsUserFree)
                         {
                             size_t cbNeeded = confstr(_CS_DARWIN_USER_TEMP_DIR, achBuf, sizeof(achBuf));
@@ -641 +1118 @@
                         }
 #endif
-
-                        /** @todo load /etc/environment, /etc/profile.env and ~/.pam_environment? */
+                        if (RT_SUCCESS(rc))
+                        {
+                            /*
+                             * Now comes the fun part where we need to try run a shell in login mode
+                             * and harvest its final environment to get the proper environment for
+                             * the user.  We ignore some failures here so buggy login scrips and
+                             * other weird stuff won't trip us up too badly.
+                             */
+                            if (!(fFlags & RTPROC_FLAGS_ONLY_BASIC_PROFILE))
+                                rc = rtProcPosixProfileEnvRunAndHarvest(hEnvToUse, pszAsUser, uid, gid, pszShell);
+                        }
 
                         if (RT_FAILURE(rc))
                             RTEnvDestroy(hEnvToUse);
                     }
-                    RTStrFree(pszUserFree);
+                    RTStrFree(pszAsUserFree);
                 }
                 RTStrFree(pszShell);
@@ -678 +1164 @@
 }
 
-/**
- * Cleans up the environment on the way out.
- */
-static int rtProcPosixCreateReturn(int rc, RTENV hEnvToUse, RTENV hEnv)
-{
-    if (hEnvToUse != hEnv)
-        RTEnvDestroy(hEnvToUse);
-    return rc;
-}
-
 
 RTR3DECL(int)   RTProcCreateEx(const char *pszExec, const char * const *papszArgs, RTENV hEnv, uint32_t fFlags,
@@ -783 +1259 @@
     {
         if (fFlags & RTPROC_FLAGS_PROFILE)
-            rc = rtProcPosixCreateProfileEnv(&hEnvToUse, pszAsUser);
+            rc = rtProcPosixCreateProfileEnv(&hEnvToUse, pszAsUser, uid, gid, fFlags);
         else
             rc = RTEnvClone(&hEnvToUse, RTENV_DEFAULT);
-        if (RT_SUCCESS(rc))
-        {
-            if ((fFlags & RTPROC_FLAGS_ENV_CHANGE_RECORD) && hEnv != RTENV_DEFAULT)
-                rc = RTEnvApplyChanges(hEnvToUse, hEnv);
-            if (RT_FAILURE(rc))
-                RTEnvDestroy(hEnvToUse);
-        }
         if (RT_FAILURE(rc))
             return rc;
+
+        if ((fFlags & RTPROC_FLAGS_ENV_CHANGE_RECORD) && hEnv != RTENV_DEFAULT)
+        {
+            rc = RTEnvApplyChanges(hEnvToUse, hEnv);
+            if (RT_FAILURE(rc))
+            {
+                RTEnvDestroy(hEnvToUse);
+                return rc;
+            }
+        }
     }
 
@@ -801 +1280 @@
      */
     char szRealExec[RTPATH_MAX];
-    if (access(pszExec, X_OK))
+    if (access(pszExec, X_OK) == 0)
+        rc = VINF_SUCCESS;
+    else
     {
         rc = errno;
@@ -819 +1300 @@
                 rc = rc == VERR_END_OF_STRING ? VERR_FILE_NOT_FOUND : rc;
         }
-
-        if (RT_FAILURE(rc))
-            return rtProcPosixCreateReturn(rc, hEnvToUse, hEnv);
-    }
-
+    }
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * The rest of the process creation is reused internally by
+         * rtProcPosixCreateProfileEnv.
+         */
+        rc = rtProcPosixCreateInner(pszExec, papszArgs, hEnv, hEnvToUse, fFlags, pszAsUser, uid, gid,
+                                    RT_ELEMENTS(aStdFds), aStdFds, phProcess);
+    }
+    if (hEnvToUse != hEnv)
+        RTEnvDestroy(hEnvToUse);
+    return rc;
+}
+
+
+/**
+ * The inner 2nd half of RTProcCreateEx.
+ *
+ * This is also used by rtProcPosixCreateProfileEnv().
+ *
+ * @returns IPRT status code.
+ * @param   pszExec     The executable to run (absolute path, X_OK).
+ * @param   papszArgs   The arguments.
+ * @param   hEnv        The original enviornment request, needed for adjustments
+ *                      if starting as different user.
+ * @param   hEnvToUse   The environment we should use.
+ * @param   fFlags      The process creation flags, RTPROC_FLAGS_XXX.
+ * @param   pszAsUser   The user to start the process as, if requested.
+ * @param   uid         The UID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   gid         The GID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   cRedirFds   Number of redirection file descriptors.
+ * @param   paRedirFds  Pointer to redirection file descriptors.  Entries
+ *                      containing -1 are not modified (inherit from parent),
+ *                      -2 indicates that the descriptor should be closed in the
+ *                      child.
+ * @param   phProcess   Where to return the process ID on success.
+ */
+static int rtProcPosixCreateInner(const char *pszExec, const char * const *papszArgs, RTENV hEnv, RTENV hEnvToUse,
+                                  uint32_t fFlags, const char *pszAsUser, uid_t uid, gid_t gid,
+                                  unsigned cRedirFds, int *paRedirFds, PRTPROCESS phProcess)
+{
+    /*
+     * Get the environment block.
+     */
+    const char * const *papszEnv = RTEnvGetExecEnvP(hEnvToUse);
+    AssertPtrReturn(papszEnv, VERR_INVALID_HANDLE);
+
+    /*
+     * Optimize the redirections.
+     */
+    while (cRedirFds > 0 && paRedirFds[cRedirFds - 1] == -1)
+        cRedirFds--;
+
+    /*
+     * Child PID.
+     */
     pid_t pid = -1;
-    const char * const *papszEnv = RTEnvGetExecEnvP(hEnvToUse);
-    AssertPtrReturn(papszEnv, rtProcPosixCreateReturn(VERR_INVALID_HANDLE, hEnvToUse, hEnv));
-
 
     /*
@@ -847 +1377 @@
             templateFd = rtSolarisContractPreFork();
             if (templateFd == -1)
-                return rtProcPosixCreateReturn(VERR_OPEN_FAILED, hEnvToUse, hEnv);
+                return VERR_OPEN_FAILED;
         }
 # endif /* RT_OS_SOLARIS */
@@ -883 +1413 @@
                 /* Assume that something wasn't found. No detailed info. */
                 if (status)
-                    return rtProcPosixCreateReturn(VERR_PROCESS_NOT_FOUND, hEnvToUse, hEnv);
+                    return VERR_PROCESS_NOT_FOUND;
                 if (phProcess)
                     *phProcess = 0;
-                return rtProcPosixCreateReturn(VINF_SUCCESS, hEnvToUse, hEnv);
-            }
-            return rtProcPosixCreateReturn(RTErrConvertFromErrno(errno), hEnvToUse, hEnv);
+                return VINF_SUCCESS;
+            }
+            return RTErrConvertFromErrno(errno);
         }
     }
@@ -903 +1433 @@
      * silly with the (duplicated) file descriptors.
      */
+    int rc;
 #ifdef HAVE_POSIX_SPAWN
     /** @todo OS/2: implement DETACHED (BACKGROUND stuff), see VbglR3Daemonize.  */
@@ -936 +1467 @@
             posix_spawn_file_actions_t  FileActions;
             posix_spawn_file_actions_t *pFileActions = NULL;
-            if ((aStdFds[0] != -1 || aStdFds[1] != -1 || aStdFds[2] != -1) && !rc)
+            if (!rc && cRedirFds > 0)
             {
                 rc = posix_spawn_file_actions_init(&FileActions);
@@ -942 +1473 @@
                 {
                     pFileActions = &FileActions;
-                    for (int i = 0; i < 3; i++)
+                    for (unsigned i = 0; i < cRedirFds; i++)
                     {
-                        int fd = aStdFds[i];
+                        int fd = paRedirFds[i];
                         if (fd == -2)
                             rc = posix_spawn_file_actions_addclose(&FileActions, i);
-                        else if (fd >= 0 && fd != i)
+                        else if (fd >= 0 && fd != (int)i)
                         {
                             rc = posix_spawn_file_actions_adddup2(&FileActions, fd, i);
                             if (!rc)
                             {
-                                for (int j = i + 1; j < 3; j++)
-                                    if (aStdFds[j] == fd)
+                                for (unsigned j = i + 1; j < cRedirFds; j++)
+                                    if (paRedirFds[j] == fd)
                                     {
                                         fd = -1;
@@ -989 +1520 @@
                 if (phProcess)
                     *phProcess = pid;
-                return rtProcPosixCreateReturn(VINF_SUCCESS, hEnvToUse, hEnv);
+                return VINF_SUCCESS;
             }
         }
@@ -1006 +1537 @@
             templateFd = rtSolarisContractPreFork();
             if (templateFd == -1)
-                return rtProcPosixCreateReturn(VERR_OPEN_FAILED, hEnvToUse, hEnv);
+                return VERR_OPEN_FAILED;
         }
 #endif /* RT_OS_SOLARIS */
@@ -1087 +1618 @@
              * Apply changes to the standard file descriptor and stuff.
              */
-            for (int i = 0; i < 3; i++)
-            {
-                int fd = aStdFds[i];
+            for (unsigned i = 0; i < cRedirFds; i++)
+            {
+                int fd = paRedirFds[i];
                 if (fd == -2)
                     close(i);
@@ -1095 +1626 @@
                 {
                     int rc2 = dup2(fd, i);
-                    if (rc2 != i)
+                    if (rc2 != (int)i)
                     {
                         if (fFlags & RTPROC_FLAGS_DETACHED)
@@ -1102 +1633 @@
                             exit(125);
                     }
-                    for (int j = i + 1; j < 3; j++)
-                        if (aStdFds[j] == fd)
+                    for (unsigned j = i + 1; j < cRedirFds; j++)
+                        if (paRedirFds[j] == fd)
                         {
                             fd = -1;
@@ -1142 +1673 @@
             if (phProcess)
                 *phProcess = pid;
-            return rtProcPosixCreateReturn(VINF_SUCCESS, hEnvToUse, hEnv);
+            return VINF_SUCCESS;
         }
         /* For a detached process this happens in the temp process, so
@@ -1148 +1679 @@
         if (fFlags & RTPROC_FLAGS_DETACHED)
             _Exit(124);
-        return rtProcPosixCreateReturn(RTErrConvertFromErrno(errno), hEnvToUse, hEnv);
-    }
-
-    return rtProcPosixCreateReturn(VERR_NOT_IMPLEMENTED, hEnvToUse, hEnv);
+        return RTErrConvertFromErrno(errno);
+    }
+
+    return VERR_NOT_IMPLEMENTED;
 }