1 use crate::env::{self, split_paths};
2 use crate::ffi::{CStr, OsStr};
5 use crate::io::{self, prelude::*, BufReader, Error, ErrorKind, SeekFrom};
6 use crate::os::unix::ffi::OsStrExt;
7 use crate::path::{Path, PathBuf};
9 use crate::sys::ext::fs::MetadataExt;
10 use crate::sys::ext::io::AsRawFd;
11 use crate::sys::fd::FileDesc;
12 use crate::sys::fs::{File as SysFile, OpenOptions};
13 use crate::sys::os::{ENV_LOCK, environ};
14 use crate::sys::pipe::{self, AnonPipe};
15 use crate::sys::{cvt, syscall};
16 use crate::sys_common::process::{CommandEnv, DefaultEnvKey};
18 use libc::{EXIT_SUCCESS, EXIT_FAILURE};
20 ////////////////////////////////////////////////////////////////////////////////
22 ////////////////////////////////////////////////////////////////////////////////
25 // Currently we try hard to ensure that the call to `.exec()` doesn't
26 // actually allocate any memory. While many platforms try to ensure that
27 // memory allocation works after a fork in a multithreaded process, it's
28 // been observed to be buggy and somewhat unreliable, so we do our best to
29 // just not do it at all!
31 // Along those lines, the `argv` and `envp` raw pointers here are exactly
32 // what's gonna get passed to `execvp`. The `argv` array starts with the
33 // `program` and ends with a NULL, and the `envp` pointer, if present, is
34 // also null-terminated.
36 // Right now we don't support removing arguments, so there's no much fancy
37 // support there, but we support adding and removing environment variables,
38 // so a side table is used to track where in the `envp` array each key is
39 // located. Whenever we add a key we update it in place if it's already
40 // present, and whenever we remove a key we update the locations of all
44 env: CommandEnv<DefaultEnvKey>,
50 closures: Vec<Box<dyn FnMut() -> io::Result<()> + Send + Sync>>,
52 stdout: Option<Stdio>,
53 stderr: Option<Stdio>,
56 // passed back to std::process with the pipes connected to the child, if any
58 pub struct StdioPipes {
59 pub stdin: Option<AnonPipe>,
60 pub stdout: Option<AnonPipe>,
61 pub stderr: Option<AnonPipe>,
64 // passed to do_exec() with configuration of what the child stdio should look
86 pub fn new(program: &OsStr) -> Command {
88 program: program.to_str().unwrap().to_owned(),
90 env: Default::default(),
102 pub fn arg(&mut self, arg: &OsStr) {
103 self.args.push(arg.to_str().unwrap().to_owned());
106 pub fn env_mut(&mut self) -> &mut CommandEnv<DefaultEnvKey> {
110 pub fn cwd(&mut self, dir: &OsStr) {
111 self.cwd = Some(dir.to_str().unwrap().to_owned());
113 pub fn uid(&mut self, id: u32) {
116 pub fn gid(&mut self, id: u32) {
120 pub unsafe fn pre_exec(
122 f: Box<dyn FnMut() -> io::Result<()> + Send + Sync>,
124 self.closures.push(f);
127 pub fn stdin(&mut self, stdin: Stdio) {
128 self.stdin = Some(stdin);
130 pub fn stdout(&mut self, stdout: Stdio) {
131 self.stdout = Some(stdout);
133 pub fn stderr(&mut self, stderr: Stdio) {
134 self.stderr = Some(stderr);
137 pub fn spawn(&mut self, default: Stdio, needs_stdin: bool)
138 -> io::Result<(Process, StdioPipes)> {
139 const CLOEXEC_MSG_FOOTER: &[u8] = b"NOEX";
142 return Err(io::Error::new(ErrorKind::InvalidInput,
143 "nul byte found in provided data"));
146 let (ours, theirs) = self.setup_io(default, needs_stdin)?;
147 let (input, output) = pipe::anon_pipe()?;
150 match cvt(syscall::clone(0))? {
153 let Err(err) = self.do_exec(theirs);
154 let errno = err.raw_os_error().unwrap_or(syscall::EINVAL) as u32;
160 CLOEXEC_MSG_FOOTER[0], CLOEXEC_MSG_FOOTER[1],
161 CLOEXEC_MSG_FOOTER[2], CLOEXEC_MSG_FOOTER[3]
163 // pipe I/O up to PIPE_BUF bytes should be atomic, and then
164 // we want to be sure we *don't* run at_exit destructors as
165 // we're being torn down regardless
166 assert!(output.write(&bytes).is_ok());
167 let _ = syscall::exit(1);
168 panic!("failed to exit");
174 let mut p = Process { pid: pid, status: None };
176 let mut bytes = [0; 8];
178 // loop to handle EINTR
180 match input.read(&mut bytes) {
181 Ok(0) => return Ok((p, ours)),
183 assert!(combine(CLOEXEC_MSG_FOOTER) == combine(&bytes[4.. 8]),
184 "Validation on the CLOEXEC pipe failed: {:?}", bytes);
185 let errno = combine(&bytes[0.. 4]);
186 assert!(p.wait().is_ok(),
187 "wait() should either return Ok or panic");
188 return Err(Error::from_raw_os_error(errno))
190 Err(ref e) if e.kind() == ErrorKind::Interrupted => {}
192 assert!(p.wait().is_ok(),
193 "wait() should either return Ok or panic");
194 panic!("the CLOEXEC pipe failed: {:?}", e)
196 Ok(..) => { // pipe I/O up to PIPE_BUF bytes should be atomic
197 assert!(p.wait().is_ok(),
198 "wait() should either return Ok or panic");
199 panic!("short read on the CLOEXEC pipe")
204 fn combine(arr: &[u8]) -> i32 {
205 let a = arr[0] as u32;
206 let b = arr[1] as u32;
207 let c = arr[2] as u32;
208 let d = arr[3] as u32;
210 ((a << 24) | (b << 16) | (c << 8) | (d << 0)) as i32
214 pub fn exec(&mut self, default: Stdio) -> io::Error {
216 return io::Error::new(ErrorKind::InvalidInput,
217 "nul byte found in provided data")
220 match self.setup_io(default, true) {
221 Ok((_, theirs)) => unsafe {
222 let Err(e) = self.do_exec(theirs);
229 // And at this point we've reached a special time in the life of the
230 // child. The child must now be considered hamstrung and unable to
231 // do anything other than syscalls really. Consider the following
234 // 1. Thread A of process 1 grabs the malloc() mutex
235 // 2. Thread B of process 1 forks(), creating thread C
236 // 3. Thread C of process 2 then attempts to malloc()
237 // 4. The memory of process 2 is the same as the memory of
238 // process 1, so the mutex is locked.
240 // This situation looks a lot like deadlock, right? It turns out
241 // that this is what pthread_atfork() takes care of, which is
242 // presumably implemented across platforms. The first thing that
243 // threads to *before* forking is to do things like grab the malloc
244 // mutex, and then after the fork they unlock it.
246 // Despite this information, libnative's spawn has been witnessed to
247 // deadlock on both macOS and FreeBSD. I'm not entirely sure why, but
248 // all collected backtraces point at malloc/free traffic in the
249 // child spawned process.
251 // For this reason, the block of code below should contain 0
252 // invocations of either malloc of free (or their related friends).
254 // As an example of not having malloc/free traffic, we don't close
255 // this file descriptor by dropping the FileDesc (which contains an
256 // allocation). Instead we just close it manually. This will never
257 // have the drop glue anyway because this code never returns (the
258 // child will either exec() or invoke syscall::exit)
259 unsafe fn do_exec(&mut self, stdio: ChildPipes) -> Result<!, io::Error> {
260 if let Some(fd) = stdio.stderr.fd() {
261 cvt(syscall::dup2(fd, 2, &[]))?;
262 let mut flags = cvt(syscall::fcntl(2, syscall::F_GETFD, 0))?;
263 flags &= ! syscall::O_CLOEXEC;
264 cvt(syscall::fcntl(2, syscall::F_SETFD, flags))?;
266 if let Some(fd) = stdio.stdout.fd() {
267 cvt(syscall::dup2(fd, 1, &[]))?;
268 let mut flags = cvt(syscall::fcntl(1, syscall::F_GETFD, 0))?;
269 flags &= ! syscall::O_CLOEXEC;
270 cvt(syscall::fcntl(1, syscall::F_SETFD, flags))?;
272 if let Some(fd) = stdio.stdin.fd() {
273 cvt(syscall::dup2(fd, 0, &[]))?;
274 let mut flags = cvt(syscall::fcntl(0, syscall::F_GETFD, 0))?;
275 flags &= ! syscall::O_CLOEXEC;
276 cvt(syscall::fcntl(0, syscall::F_SETFD, flags))?;
279 if let Some(g) = self.gid {
280 cvt(syscall::setregid(g as usize, g as usize))?;
282 if let Some(u) = self.uid {
283 cvt(syscall::setreuid(u as usize, u as usize))?;
285 if let Some(ref cwd) = self.cwd {
286 cvt(syscall::chdir(cwd))?;
289 for callback in self.closures.iter_mut() {
295 let program = if self.program.contains(':') || self.program.contains('/') {
296 Some(PathBuf::from(&self.program))
297 } else if let Ok(path_env) = env::var("PATH") {
298 let mut program = None;
299 for mut path in split_paths(&path_env) {
300 path.push(&self.program);
302 program = Some(path);
311 let mut file = if let Some(program) = program {
312 File::open(program.as_os_str())?
314 return Err(io::Error::from_raw_os_error(syscall::ENOENT));
317 // Push all the arguments
318 let mut args: Vec<[usize; 2]> = Vec::with_capacity(1 + self.args.len());
321 let mut reader = BufReader::new(&file);
323 let mut shebang = [0; 2];
326 match reader.read(&mut shebang[read..])? {
332 if &shebang == b"#!" {
333 // This is an interpreted script.
334 // First of all, since we'll be passing another file to
335 // fexec(), we need to manually check that we have permission
336 // to execute this file:
337 let uid = cvt(syscall::getuid())?;
338 let gid = cvt(syscall::getgid())?;
339 let meta = file.metadata()?;
341 let mode = if uid == meta.uid() as usize {
342 meta.mode() >> 3*2 & 0o7
343 } else if gid == meta.gid() as usize {
344 meta.mode() >> 3*1 & 0o7
349 return Err(io::Error::from_raw_os_error(syscall::EPERM));
352 // Second of all, we need to actually read which interpreter it wants
353 let mut interpreter = Vec::new();
354 reader.read_until(b'\n', &mut interpreter)?;
355 // Pop one trailing newline, if any
356 if interpreter.ends_with(&[b'\n']) {
357 interpreter.pop().unwrap();
360 // FIXME: Here we could just reassign `file` directly, if it
361 // wasn't for lexical lifetimes. Remove the whole `let
362 // interpreter = { ... };` hack once NLL lands.
363 // NOTE: Although DO REMEMBER to make sure the interpreter path
364 // still lives long enough to reach fexec.
370 if let Some(ref interpreter) = interpreter {
371 let path: &OsStr = OsStr::from_bytes(&interpreter);
372 file = File::open(path)?;
374 args.push([interpreter.as_ptr() as usize, interpreter.len()]);
376 file.seek(SeekFrom::Start(0))?;
379 args.push([self.program.as_ptr() as usize, self.program.len()]);
380 args.extend(self.args.iter().map(|arg| [arg.as_ptr() as usize, arg.len()]));
382 // Push all the variables
383 let mut vars: Vec<[usize; 2]> = Vec::new();
385 let _guard = ENV_LOCK.lock();
386 let mut environ = *environ();
387 while *environ != ptr::null() {
388 let var = CStr::from_ptr(*environ).to_bytes();
389 vars.push([var.as_ptr() as usize, var.len()]);
390 environ = environ.offset(1);
394 if let Err(err) = syscall::fexec(file.as_raw_fd(), &args, &vars) {
395 Err(io::Error::from_raw_os_error(err.errno as i32))
397 panic!("return from exec without err");
401 fn setup_io(&self, default: Stdio, needs_stdin: bool)
402 -> io::Result<(StdioPipes, ChildPipes)> {
403 let null = Stdio::Null;
404 let default_stdin = if needs_stdin {&default} else {&null};
405 let stdin = self.stdin.as_ref().unwrap_or(default_stdin);
406 let stdout = self.stdout.as_ref().unwrap_or(&default);
407 let stderr = self.stderr.as_ref().unwrap_or(&default);
408 let (their_stdin, our_stdin) = stdin.to_child_stdio(true)?;
409 let (their_stdout, our_stdout) = stdout.to_child_stdio(false)?;
410 let (their_stderr, our_stderr) = stderr.to_child_stdio(false)?;
411 let ours = StdioPipes {
416 let theirs = ChildPipes {
418 stdout: their_stdout,
419 stderr: their_stderr,
426 fn to_child_stdio(&self, readable: bool)
427 -> io::Result<(ChildStdio, Option<AnonPipe>)> {
429 Stdio::Inherit => Ok((ChildStdio::Inherit, None)),
431 // Make sure that the source descriptors are not an stdio
432 // descriptor, otherwise the order which we set the child's
433 // descriptors may blow away a descriptor which we are hoping to
434 // save. For example, suppose we want the child's stderr to be the
435 // parent's stdout, and the child's stdout to be the parent's
436 // stderr. No matter which we dup first, the second will get
437 // overwritten prematurely.
438 Stdio::Fd(ref fd) => {
440 Ok((ChildStdio::Owned(fd.duplicate()?), None))
442 Ok((ChildStdio::Explicit(fd.raw()), None))
447 let (reader, writer) = pipe::anon_pipe()?;
448 let (ours, theirs) = if readable {
453 Ok((ChildStdio::Owned(theirs.into_fd()), Some(ours)))
457 let mut opts = OpenOptions::new();
459 opts.write(!readable);
460 let fd = SysFile::open(Path::new("null:"), &opts)?;
461 Ok((ChildStdio::Owned(fd.into_fd()), None))
467 impl From<AnonPipe> for Stdio {
468 fn from(pipe: AnonPipe) -> Stdio {
469 Stdio::Fd(pipe.into_fd())
473 impl From<SysFile> for Stdio {
474 fn from(file: SysFile) -> Stdio {
475 Stdio::Fd(file.into_fd())
480 fn fd(&self) -> Option<usize> {
482 ChildStdio::Inherit => None,
483 ChildStdio::Explicit(fd) => Some(fd),
484 ChildStdio::Owned(ref fd) => Some(fd.raw()),
489 impl fmt::Debug for Command {
490 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
491 write!(f, "{:?}", self.program)?;
492 for arg in &self.args {
493 write!(f, " {:?}", arg)?;
499 ////////////////////////////////////////////////////////////////////////////////
501 ////////////////////////////////////////////////////////////////////////////////
503 /// Unix exit statuses
504 #[derive(PartialEq, Eq, Clone, Copy, Debug)]
505 pub struct ExitStatus(i32);
508 fn exited(&self) -> bool {
512 pub fn success(&self) -> bool {
513 self.code() == Some(0)
516 pub fn code(&self) -> Option<i32> {
518 Some((self.0 >> 8) & 0xFF)
524 pub fn signal(&self) -> Option<i32> {
533 impl From<i32> for ExitStatus {
534 fn from(a: i32) -> ExitStatus {
539 impl fmt::Display for ExitStatus {
540 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
541 if let Some(code) = self.code() {
542 write!(f, "exit code: {}", code)
544 let signal = self.signal().unwrap();
545 write!(f, "signal: {}", signal)
550 #[derive(PartialEq, Eq, Clone, Copy, Debug)]
551 pub struct ExitCode(u8);
554 pub const SUCCESS: ExitCode = ExitCode(EXIT_SUCCESS as _);
555 pub const FAILURE: ExitCode = ExitCode(EXIT_FAILURE as _);
557 pub fn as_i32(&self) -> i32 {
562 /// The unique ID of the process (this should never be negative).
565 status: Option<ExitStatus>,
569 pub fn id(&self) -> u32 {
573 pub fn kill(&mut self) -> io::Result<()> {
574 // If we've already waited on this process then the pid can be recycled
575 // and used for another process, and we probably shouldn't be killing
576 // random processes, so just return an error.
577 if self.status.is_some() {
578 Err(Error::new(ErrorKind::InvalidInput,
579 "invalid argument: can't kill an exited process"))
581 cvt(syscall::kill(self.pid, syscall::SIGKILL))?;
586 pub fn wait(&mut self) -> io::Result<ExitStatus> {
587 if let Some(status) = self.status {
591 cvt(syscall::waitpid(self.pid, &mut status, 0))?;
592 self.status = Some(ExitStatus(status as i32));
593 Ok(ExitStatus(status as i32))
596 pub fn try_wait(&mut self) -> io::Result<Option<ExitStatus>> {
597 if let Some(status) = self.status {
598 return Ok(Some(status))
601 let pid = cvt(syscall::waitpid(self.pid, &mut status, syscall::WNOHANG))?;
605 self.status = Some(ExitStatus(status as i32));
606 Ok(Some(ExitStatus(status as i32)))