span<value_type const> rep) noexcept

: begin_{rep.data()}, end_{rep.data() + rep.size()} {

[[maybe_unused]] auto lt = [](auto a, auto b) { return a.first < b.first; };

assert(std::is_sorted(begin_, end_, lt));

[[maybe_unused]] auto eq = [](auto a, auto b) { return a.first == b.first; };

assert(std::adjacent_find(begin_, end_, eq) == end_);

auto lo = begin_;

auto hi = end_;

while (lo < hi) {

auto mid = lo + (hi - lo) / 2;

if (mid->first == fd) {

return &mid->second;

}

if (mid->first < fd) {

lo = mid + 1;

} else {

hi = mid;

}

}

return nullptr;

FOLLY_DETAIL_SUBPROCESS_LIBC_X(FOLLY_DETAIL_SUBPROCESS_LIBC_FIELD_DECL)

};

FOLLY_DETAIL_SUBPROCESS_LIBC_X(FOLLY_DETAIL_SUBPROCESS_LIBC_FIELD_DEFN)

__attribute__((constructor(101))) static void subprocess_libc_init() {

auto handle = !kIsSanitize

? nullptr

: ::dlopen(subprocess_libc_soname, RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);

assert(!kIsSanitize || !!handle);

FOLLY_DETAIL_SUBPROCESS_LIBC_X(FOLLY_DETAIL_SUBPROCESS_LIBC_INIT)

}

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_FIELD_DECL

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_FIELD_DEFN

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_INIT

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_X

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_X_PRCTL

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_X_OPEN

#undef FOLLY_DETAIL_SUBPROCESS_LIBC_X_BASE

std::vector<std::pair<int, int>> fdActions;

std::vector<char*> setPrintPidToBuffer;

std::vector<std::pair<int, Options::AttrWithMeta<rlimit>>> rlimits;

explicit Scratch(Options const& options)

: fdActions{options.fdActions_.begin(), options.fdActions_.end()},

setPrintPidToBuffer{

options.setPrintPidToBuffer_.begin(),

options.setPrintPidToBuffer_.end()},

rlimits{options.rlimits_.begin(), options.rlimits_.end()} {

std::sort(fdActions.begin(), fdActions.end());

}

: childDir{getCStrForNonEmpty(options.childDir_)},

linuxCGroupFd{

options.linuxCGroupFd_.value, options.linuxCGroupFd_.errout},

linuxCGroupPath{

getCStrForNonEmpty(options.linuxCGroupPath_.value),

options.linuxCGroupPath_.errout},

closeOtherFds{options.closeOtherFds_},

#if defined(__linux__)

cpuSet{get_pointer(options.cpuSet_)},

#endif

detach{options.detach_},

fdActions{scratch.fdActions},

#if defined(__linux__)

parentDeathSignal{options.parentDeathSignal_},

#endif

processGroupLeader{options.processGroupLeader_},

usePath{options.usePath_},

uid{options.uid_.get_pointer()},

gid{options.gid_.get_pointer()},

euid{options.euid_.get_pointer()},

egid{options.egid_.get_pointer()},

setPrintPidToBufferData{scratch.setPrintPidToBuffer.data()},

setPrintPidToBufferSize{scratch.setPrintPidToBuffer.size()},

rlimitsData{scratch.rlimits.data()},

rlimitsSize{scratch.rlimits.size()} {

static_assert(std::is_standard_layout_v<Subprocess::SpawnRawArgs>);

static_assert(std::is_trivially_destructible_v<Subprocess::SpawnRawArgs>);

if (!WIFEXITED(status) && !WIFSIGNALED(status)) {

throw std::runtime_error(

to<std::string>("Invalid ProcessReturnCode: ", status));

}

return ProcessReturnCode(status);

if (rawStatus_ == RV_NOT_STARTED) {

return NOT_STARTED;

}

if (rawStatus_ == RV_RUNNING) {

return RUNNING;

}

if (WIFEXITED(rawStatus_)) {

return EXITED;

}

if (WIFSIGNALED(rawStatus_)) {

return KILLED;

}

assume_unreachable();

State s = state();

if (s != expected) {

throw std::logic_error(

to<std::string>(

"Bad use of ProcessReturnCode; state is ",

s,

" expected ",

expected));

}

switch (state()) {

case NOT_STARTED:

return "not started";

case RUNNING:

return "running";

case EXITED:

return to<std::string>("exited with status ", exitStatus());

case KILLED:

return to<std::string>(

"killed by signal ",

killSignal(),

(coreDumped() ? " (core dumped)" : ""));

}

assume_unreachable();

char const* executable, int errCode, int errnoValue) {

auto prefix = errCode == kExecFailure

? "failed to execute "

: "error preparing to execute ";

return to<std::string>(prefix, executable, ": ", errnoStr(errnoValue));

const char* executable, int errCode, int errnoValue)

: SubprocessError(

toSubprocessSpawnErrorMessage(executable, errCode, errnoValue)),

std::unique_ptr<const char*[]> d(new const char*[s.size() + 1]);

for (size_t i = 0; i < s.size(); i++) {

d[i] = s[i].c_str();

}

d[s.size()] = nullptr;

return d;

if (returnCode.state() != ProcessReturnCode::EXITED ||

returnCode.exitStatus() != 0) {

throw CalledProcessError(returnCode);

}

const std::vector<std::string>& argv,

const Options& options,

const char* executable,

const std::vector<std::string>* env)

: destroyBehavior_(options.destroyBehavior_) {

if (argv.empty()) {

throw std::invalid_argument("argv must not be empty");

}

if (!executable) {

executable = argv[0].c_str();

}

spawn(cloneStrings(argv), executable, options, env);

const std::string& cmd,

const Options& options,

const std::vector<std::string>* env)

: destroyBehavior_(options.destroyBehavior_) {

if (options.usePath_) {

throw std::invalid_argument("usePath() not allowed when running in shell");

}

std::vector<std::string> argv = {"/bin/sh", "-c", cmd};

spawn(cloneStrings(argv), argv[0].c_str(), options, env);

Subprocess sp;

sp.pid_ = pid;

sp.destroyBehavior_ = DestroyBehaviorLeak;

sp.returnCode_ = ProcessReturnCode::makeRunning();

return sp;

SpawnRawArgs const& args, int errCode, int errnoValue) {

*args.err = {errCode, errnoValue};

detail::subprocess_libc::_exit(errCode);

__builtin_unreachable();

for (auto& p : pipes_) {

int fd = p.pipe.fd();

int flags = ::fcntl(fd, F_GETFL);

checkUnixError(flags, "fcntl");

int r = ::fcntl(fd, F_SETFL, flags | O_NONBLOCK);

checkUnixError(r, "fcntl");

}

std::unique_ptr<const char*[]> argv,

const char* executable,

const Options& optionsIn,

const std::vector<std::string>* env) {

if (optionsIn.usePath_ && env) {

throw std::invalid_argument(

"usePath() not allowed when overriding environment");

}

// Make a copy, we'll mutate options

Options options(optionsIn);

// On error, close all pipes_ (ignoring errors, but that seems fine here).

auto pipesGuard = makeGuard([this] { pipes_.clear(); });

ChildErrorInfo err{};

// Perform the actual work of setting up pipes then forking and

// executing the child.

spawnInternal(std::move(argv), executable, options, env, &err);

// After spawnInternal() returns the child is alive. We have to be very

// careful about throwing after this point. We are inside the constructor,

// so if we throw the Subprocess object will have never existed, and the

// destructor will never be called.

//

// We should only throw if we got an error via the ChildErrorInfo, and we know

// the child has exited and can be immediately waited for. In all other

// cases, we have no way of cleaning up the child.

readChildErrorNum(err, executable);

// If we spawned a detached child, wait on the intermediate child process.

// It always exits immediately.

if (options.detach_) {

wait();

}

// We have fully succeeded now, so release the guard on pipes_

pipesGuard.dismiss();

std::unique_ptr<const char*[]> argv,

const char* executable,

Options& options,

const std::vector<std::string>* env,

ChildErrorInfo* err) {

// Parent work, pre-fork: create pipes

std::vector<int> childFds;

// Close all of the childFds as we leave this scope

SCOPE_EXIT {

// These are only pipes, closing them shouldn't fail

for (int cfd : childFds) {

CHECK_ERR(fileops::close(cfd));

}

};

int r;

for (auto& p : options.fdActions_) {

if (p.second == PIPE_IN || p.second == PIPE_OUT) {

int fds[2];

// We're setting both ends of the pipe as close-on-exec. The child

// doesn't need to reset the flag on its end, as we always dup2() the fd,

// and dup2() fds don't share the close-on-exec flag.

#if FOLLY_HAVE_PIPE2

// If possible, set close-on-exec atomically. Otherwise, a concurrent

// Subprocess invocation can fork() between "pipe" and "fnctl",

// causing FDs to leak.

r = ::pipe2(fds, O_CLOEXEC);

checkUnixError(r, "pipe2");

#else

r = fileops::pipe(fds);

checkUnixError(r, "pipe");

r = fcntl(fds[0], F_SETFD, FD_CLOEXEC);

checkUnixError(r, "set FD_CLOEXEC");

r = fcntl(fds[1], F_SETFD, FD_CLOEXEC);

checkUnixError(r, "set FD_CLOEXEC");

#endif

pipes_.emplace_back();

Pipe& pipe = pipes_.back();

pipe.direction = p.second;

int cfd;

if (p.second == PIPE_IN) {

// Child gets reading end

pipe.pipe = folly::File(fds[1], /*ownsFd=*/true);

cfd = fds[0];

} else {

pipe.pipe = folly::File(fds[0], /*ownsFd=*/true);

cfd = fds[1];

}

p.second = cfd; // ensure it gets dup2()ed

pipe.childFd = p.first;

childFds.push_back(cfd);

}

}

// This should already be sorted, as options.fdActions_ is

DCHECK(std::is_sorted(pipes_.begin(), pipes_.end()));

// Note that the const casts below are legit, per

// http://pubs.opengroup.org/onlinepubs/009695399/functions/exec.html

// Set up environment

std::unique_ptr<const char*[]> envHolder;

if (env) {

envHolder = cloneStrings(*env);

}

// Block all signals around vfork; see http://ewontfix.com/7/.

//

// As the child may run in the same address space as the parent until

// the actual execve() system call, any (custom) signal handlers that

// the parent has might alter parent's memory if invoked in the child,

// with undefined results. So we block all signals in the parent before

// vfork(), which will cause them to be blocked in the child as well (we

// rely on the fact that Linux, just like all sane implementations, only

// clones the calling thread). Then, in the child, we reset all signals

// to their default dispositions (while still blocked), and unblock them

// (so the exec()ed process inherits the parent's signal mask)

//

// The parent also unblocks all signals as soon as vfork() returns.

sigset_t allBlocked;

r = sigfillset(&allBlocked);

checkUnixError(r, "sigfillset");

sigset_t oldSignals;

r = pthread_sigmask(SIG_SETMASK, &allBlocked, &oldSignals);

checkPosixError(r, "pthread_sigmask");

SCOPE_EXIT {

// Restore signal mask

r = pthread_sigmask(SIG_SETMASK, &oldSignals, nullptr);

CHECK_EQ(r, 0) << "pthread_sigmask: " << errnoStr(r); // shouldn't fail

pid_t pid = detail::subprocess_libc::vfork();

checkUnixError(pid, errno, "failed to fork");

if (pid != 0) {

return pid;

}

// From this point onward, we are in the child.

// Fork a second time if detach_ was requested.

// This must be done before signals are restored in prepareChild()

if (args.detach) {

pid = detail::subprocess_libc::vfork();

if (pid == -1) {

// Inform our parent process of the error so it can throw in the parent.

childError(args, kChildFailure, errno);

} else if (pid != 0) {

// We are the intermediate process. Exit immediately.

// Our child will still inform the original parent of success/failure

// through errFd. The pid of the grandchild process never gets

// propagated back up to the original parent. In the future we could

// potentially send it back using errFd if we needed to.

detail::subprocess_libc::_exit(0);

}

}

int errnoValue = prepareChild(args);

if (errnoValue != 0) {

childError(args, kChildFailure, errnoValue);

}

errnoValue = runChild(args);

// If we get here, exec() failed.

childError(args, kExecFailure, errnoValue);

return 0; // unreachable

if (errout) {

*errout = errno;

return 0;

} else {

return errno;

}

auto cgroupPath = args.linuxCGroupPath;

auto cgroupFd = args.linuxCGroupFd;

if (nullptr != cgroupPath.value) {

int fd = detail::subprocess_libc::open(

cgroupPath.value, O_RDONLY | O_DIRECTORY | O_CLOEXEC);

if (-1 == fd) {

return prepareChildDoOptionalError(cgroupPath.errout);

}

cgroupFd = {fd, cgroupPath.errout};

}

if (-1 != cgroupFd.value) {

int fd = detail::subprocess_libc::openat(

cgroupFd.value, "cgroup.procs", O_WRONLY | O_CLOEXEC);

if (fd == -1) {

return prepareChildDoOptionalError(cgroupFd.errout);

}

int rc = 0;

do {

constexpr char const buf = '0';

rc = detail::subprocess_libc::write(fd, &buf, 1);

} while (rc == -1 && errno == EINTR);

if (rc == -1) {

return prepareChildDoOptionalError(cgroupFd.errout);

}

}

return 0;

#if defined(__linux__)

int dirfd = detail::subprocess_libc::open("/proc/self/fd", O_RDONLY);

if (dirfd != -1) {

char buffer[32768];

int res;

while ((res = syscall(SYS_getdents64, dirfd, buffer, sizeof(buffer))) > 0) {

// linux_dirent64 is part of the kernel ABI for the getdents64 system

// call. It is currently the same as struct dirent64 in both glibc and

// musl, but those are library specific and could change. linux_dirent64

// is not defined in the standard set of Linux userspace headers

// (/usr/include/linux)

//

// We do not use the POSIX interfaces (opendir, readdir, etc..) for

// reading a directory since they may allocate memory / grab a lock, which

// is unsafe in this context.

FOLLY_PUSH_WARNING

FOLLY_CLANG_DISABLE_WARNING("-Wzero-length-array")

struct linux_dirent64 {

uint64_t d_ino;

int64_t d_off;

uint16_t d_reclen;

unsigned char d_type;

char d_name[0];

} const* entry;

FOLLY_POP_WARNING

for (int offset = 0; offset < res; offset += entry->d_reclen) {

entry = reinterpret_cast<struct linux_dirent64*>(buffer + offset);

if (entry->d_type != DT_LNK) {

continue;

}

char* end_p = nullptr;

errno = 0;

int fd = static_cast<int>(

detail::subprocess_libc::strtol(entry->d_name, &end_p, 10));

if (errno == ERANGE || fd < 3 || end_p == entry->d_name) {

continue;

}

if ((fd != dirfd) && (args.fdActions.find(fd) == nullptr)) {

detail::subprocess_libc::close(fd);

}

}

}

detail::subprocess_libc::close(dirfd);

return;

}

#endif

// If not running on Linux or if we failed to open /proc/self/fd, try to close

// all possible open file descriptors.

for (auto fd = sysconf(_SC_OPEN_MAX) - 1; fd >= 3; --fd) {

if (args.fdActions.find(fd) == nullptr) {

detail::subprocess_libc::close(fd);

}

}