2 * Copyright 2014 Facebook, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
21 #include <folly/Subprocess.h>
24 #include <sys/prctl.h>
33 #include <system_error>
35 #include <boost/container/flat_set.hpp>
36 #include <boost/range/adaptors.hpp>
38 #include <glog/logging.h>
40 #include <folly/Conv.h>
41 #include <folly/Exception.h>
42 #include <folly/ScopeGuard.h>
43 #include <folly/String.h>
44 #include <folly/io/Cursor.h>
46 extern char** environ;
48 constexpr int kExecFailure = 127;
49 constexpr int kChildFailure = 126;
53 ProcessReturnCode::State ProcessReturnCode::state() const {
54 if (rawStatus_ == RV_NOT_STARTED) return NOT_STARTED;
55 if (rawStatus_ == RV_RUNNING) return RUNNING;
56 if (WIFEXITED(rawStatus_)) return EXITED;
57 if (WIFSIGNALED(rawStatus_)) return KILLED;
58 throw std::runtime_error(to<std::string>(
59 "Invalid ProcessReturnCode: ", rawStatus_));
62 void ProcessReturnCode::enforce(State expected) const {
65 throw std::logic_error(to<std::string>(
66 "Bad use of ProcessReturnCode; state is ", s, " expected ", expected
71 int ProcessReturnCode::exitStatus() const {
73 return WEXITSTATUS(rawStatus_);
76 int ProcessReturnCode::killSignal() const {
78 return WTERMSIG(rawStatus_);
81 bool ProcessReturnCode::coreDumped() const {
83 return WCOREDUMP(rawStatus_);
86 std::string ProcessReturnCode::str() const {
93 return to<std::string>("exited with status ", exitStatus());
95 return to<std::string>("killed by signal ", killSignal(),
96 (coreDumped() ? " (core dumped)" : ""));
98 CHECK(false); // unreached
101 CalledProcessError::CalledProcessError(ProcessReturnCode rc)
103 what_(returnCode_.str()) {
106 SubprocessSpawnError::SubprocessSpawnError(const char* executable,
109 : errnoValue_(errnoValue),
110 what_(to<std::string>(errCode == kExecFailure ?
111 "failed to execute " :
112 "error preparing to execute ",
113 executable, ": ", errnoStr(errnoValue))) {
118 // Copy pointers to the given strings in a format suitable for posix_spawn
119 std::unique_ptr<const char*[]> cloneStrings(const std::vector<std::string>& s) {
120 std::unique_ptr<const char*[]> d(new const char*[s.size() + 1]);
121 for (size_t i = 0; i < s.size(); i++) {
124 d[s.size()] = nullptr;
128 // Check a wait() status, throw on non-successful
129 void checkStatus(ProcessReturnCode returnCode) {
130 if (returnCode.state() != ProcessReturnCode::EXITED ||
131 returnCode.exitStatus() != 0) {
132 throw CalledProcessError(returnCode);
138 Subprocess::Options& Subprocess::Options::fd(int fd, int action) {
139 if (action == Subprocess::PIPE) {
141 action = Subprocess::PIPE_IN;
142 } else if (fd == 1 || fd == 2) {
143 action = Subprocess::PIPE_OUT;
145 throw std::invalid_argument(
146 to<std::string>("Only fds 0, 1, 2 are valid for action=PIPE: ", fd));
149 fdActions_[fd] = action;
153 Subprocess::Subprocess(
154 const std::vector<std::string>& argv,
155 const Options& options,
156 const char* executable,
157 const std::vector<std::string>* env)
159 returnCode_(RV_NOT_STARTED) {
161 throw std::invalid_argument("argv must not be empty");
163 if (!executable) executable = argv[0].c_str();
164 spawn(cloneStrings(argv), executable, options, env);
167 Subprocess::Subprocess(
168 const std::string& cmd,
169 const Options& options,
170 const std::vector<std::string>* env)
172 returnCode_(RV_NOT_STARTED) {
173 if (options.usePath_) {
174 throw std::invalid_argument("usePath() not allowed when running in shell");
176 const char* shell = getenv("SHELL");
181 std::unique_ptr<const char*[]> argv(new const char*[4]);
184 argv[2] = cmd.c_str();
186 spawn(std::move(argv), shell, options, env);
189 Subprocess::~Subprocess() {
190 CHECK_NE(returnCode_.state(), ProcessReturnCode::RUNNING)
191 << "Subprocess destroyed without reaping child";
196 void closeChecked(int fd) {
197 checkUnixError(::close(fd), "close");
200 struct ChildErrorInfo {
205 FOLLY_NORETURN void childError(int errFd, int errCode, int errnoValue);
206 void childError(int errFd, int errCode, int errnoValue) {
207 ChildErrorInfo info = {errCode, errnoValue};
208 // Write the error information over the pipe to our parent process.
209 // We can't really do anything else if this write call fails.
210 writeNoInt(errFd, &info, sizeof(info));
217 void Subprocess::closeAll() {
218 for (auto& p : pipes_) {
219 closeChecked(p.parentFd);
224 void Subprocess::setAllNonBlocking() {
225 for (auto& p : pipes_) {
227 int flags = ::fcntl(fd, F_GETFL);
228 checkUnixError(flags, "fcntl");
229 int r = ::fcntl(fd, F_SETFL, flags | O_NONBLOCK);
230 checkUnixError(r, "fcntl");
234 void Subprocess::spawn(
235 std::unique_ptr<const char*[]> argv,
236 const char* executable,
237 const Options& optionsIn,
238 const std::vector<std::string>* env) {
239 if (optionsIn.usePath_ && env) {
240 throw std::invalid_argument(
241 "usePath() not allowed when overriding environment");
244 // Make a copy, we'll mutate options
245 Options options(optionsIn);
247 // On error, close all of the pipes_
248 auto pipesGuard = makeGuard([&] {
249 for (auto& p : this->pipes_) {
250 CHECK_ERR(::close(p.parentFd));
254 // Create a pipe to use to receive error information from the child,
255 // in case it fails before calling exec()
258 checkUnixError(::pipe2(errFds, O_CLOEXEC), "pipe2");
260 checkUnixError(::pipe(errFds), "pipe");
263 CHECK_ERR(::close(errFds[0]));
264 if (errFds[1] >= 0) {
265 CHECK_ERR(::close(errFds[1]));
269 #if !FOLLY_HAVE_PIPE2
270 // Ask the child to close the read end of the error pipe.
271 checkUnixError(fcntl(errFds[0], F_SETFD, FD_CLOEXEC), "set FD_CLOEXEC");
272 // Set the close-on-exec flag on the write side of the pipe.
273 // This way the pipe will be closed automatically in the child if execve()
274 // succeeds. If the exec fails the child can write error information to the
276 checkUnixError(fcntl(errFds[1], F_SETFD, FD_CLOEXEC), "set FD_CLOEXEC");
279 // Perform the actual work of setting up pipes then forking and
280 // executing the child.
281 spawnInternal(std::move(argv), executable, options, env, errFds[1]);
283 // After spawnInternal() returns the child is alive. We have to be very
284 // careful about throwing after this point. We are inside the constructor,
285 // so if we throw the Subprocess object will have never existed, and the
286 // destructor will never be called.
288 // We should only throw if we got an error via the errFd, and we know the
289 // child has exited and can be immediately waited for. In all other cases,
290 // we have no way of cleaning up the child.
292 if (options.processGroupLeader_) {
293 // This is done both in the parent and the child to avoid the race where
294 // the parent assumes that the child is a leader, but the child has not
295 // yet run setprp(). Not checking error codes since we're deliberately
296 // racing the child, which may already have run execve(), and expect to
300 // Close writable side of the errFd pipe in the parent process
301 CHECK_ERR(::close(errFds[1]));
304 // Read from the errFd pipe, to tell if the child ran into any errors before
306 readChildErrorPipe(errFds[0], executable);
308 // We have fully succeeded now, so release the guard on pipes_
309 pipesGuard.dismiss();
312 void Subprocess::spawnInternal(
313 std::unique_ptr<const char*[]> argv,
314 const char* executable,
316 const std::vector<std::string>* env,
318 // Parent work, pre-fork: create pipes
319 std::vector<int> childFds;
320 // Close all of the childFds as we leave this scope
322 // These are only pipes, closing them shouldn't fail
323 for (int cfd : childFds) {
324 CHECK_ERR(::close(cfd));
329 for (auto& p : options.fdActions_) {
330 if (p.second == PIPE_IN || p.second == PIPE_OUT) {
332 // We're setting both ends of the pipe as close-on-exec. The child
333 // doesn't need to reset the flag on its end, as we always dup2() the fd,
334 // and dup2() fds don't share the close-on-exec flag.
336 r = ::pipe2(fds, O_CLOEXEC);
337 checkUnixError(r, "pipe2");
340 checkUnixError(r, "pipe");
341 r = fcntl(fds[0], F_SETFD, FD_CLOEXEC);
342 checkUnixError(r, "set FD_CLOEXEC");
343 r = fcntl(fds[1], F_SETFD, FD_CLOEXEC);
344 checkUnixError(r, "set FD_CLOEXEC");
347 pinfo.direction = p.second;
349 if (p.second == PIPE_IN) {
350 // Child gets reading end
351 pinfo.parentFd = fds[1];
354 pinfo.parentFd = fds[0];
357 p.second = cfd; // ensure it gets dup2()ed
358 pinfo.childFd = p.first;
359 childFds.push_back(cfd);
360 pipes_.push_back(pinfo);
364 // This should already be sorted, as options.fdActions_ is
365 DCHECK(std::is_sorted(pipes_.begin(), pipes_.end()));
367 // Note that the const casts below are legit, per
368 // http://pubs.opengroup.org/onlinepubs/009695399/functions/exec.html
370 char** argVec = const_cast<char**>(argv.get());
372 // Set up environment
373 std::unique_ptr<const char*[]> envHolder;
376 envHolder = cloneStrings(*env);
377 envVec = const_cast<char**>(envHolder.get());
382 // Block all signals around vfork; see http://ewontfix.com/7/.
384 // As the child may run in the same address space as the parent until
385 // the actual execve() system call, any (custom) signal handlers that
386 // the parent has might alter parent's memory if invoked in the child,
387 // with undefined results. So we block all signals in the parent before
388 // vfork(), which will cause them to be blocked in the child as well (we
389 // rely on the fact that Linux, just like all sane implementations, only
390 // clones the calling thread). Then, in the child, we reset all signals
391 // to their default dispositions (while still blocked), and unblock them
392 // (so the exec()ed process inherits the parent's signal mask)
394 // The parent also unblocks all signals as soon as vfork() returns.
396 r = sigfillset(&allBlocked);
397 checkUnixError(r, "sigfillset");
400 r = pthread_sigmask(SIG_SETMASK, &allBlocked, &oldSignals);
401 checkPosixError(r, "pthread_sigmask");
403 // Restore signal mask
404 r = pthread_sigmask(SIG_SETMASK, &oldSignals, nullptr);
405 CHECK_EQ(r, 0) << "pthread_sigmask: " << errnoStr(r); // shouldn't fail
408 // Call c_str() here, as it's not necessarily safe after fork.
409 const char* childDir =
410 options.childDir_.empty() ? nullptr : options.childDir_.c_str();
413 int errnoValue = prepareChild(options, &oldSignals, childDir);
414 if (errnoValue != 0) {
415 childError(errFd, kChildFailure, errnoValue);
418 errnoValue = runChild(executable, argVec, envVec, options);
419 // If we get here, exec() failed.
420 childError(errFd, kExecFailure, errnoValue);
422 // In parent. Make sure vfork() succeeded.
423 checkUnixError(pid, errno, "vfork");
425 // Child is alive. We have to be very careful about throwing after this
426 // point. We are inside the constructor, so if we throw the Subprocess
427 // object will have never existed, and the destructor will never be called.
429 // We should only throw if we got an error via the errFd, and we know the
430 // child has exited and can be immediately waited for. In all other cases,
431 // we have no way of cleaning up the child.
433 returnCode_ = ProcessReturnCode(RV_RUNNING);
436 int Subprocess::prepareChild(const Options& options,
437 const sigset_t* sigmask,
438 const char* childDir) const {
439 // While all signals are blocked, we must reset their
440 // dispositions to default.
441 for (int sig = 1; sig < NSIG; ++sig) {
442 ::signal(sig, SIG_DFL);
446 // Unblock signals; restore signal mask.
447 int r = pthread_sigmask(SIG_SETMASK, sigmask, nullptr);
449 return r; // pthread_sigmask() returns an errno value
453 // Change the working directory, if one is given
455 if (::chdir(childDir) == -1) {
460 // We don't have to explicitly close the parent's end of all pipes,
461 // as they all have the FD_CLOEXEC flag set and will be closed at
464 // Close all fds that we're supposed to close.
465 for (auto& p : options.fdActions_) {
466 if (p.second == CLOSE) {
467 if (::close(p.first) == -1) {
470 } else if (p.second != p.first) {
471 if (::dup2(p.second, p.first) == -1) {
477 // If requested, close all other file descriptors. Don't close
478 // any fds in options.fdActions_, and don't touch stdin, stdout, stderr.
480 if (options.closeOtherFds_) {
481 for (int fd = getdtablesize() - 1; fd >= 3; --fd) {
482 if (options.fdActions_.count(fd) == 0) {
489 // Opt to receive signal on parent death, if requested
490 if (options.parentDeathSignal_ != 0) {
491 if (prctl(PR_SET_PDEATHSIG, options.parentDeathSignal_, 0, 0, 0) == -1) {
497 if (options.processGroupLeader_) {
498 if (setpgrp() == -1) {
506 int Subprocess::runChild(const char* executable,
507 char** argv, char** env,
508 const Options& options) const {
509 // Now, finally, exec.
510 if (options.usePath_) {
511 ::execvp(executable, argv);
513 ::execve(executable, argv, env);
518 void Subprocess::readChildErrorPipe(int pfd, const char* executable) {
520 auto rc = readNoInt(pfd, &info, sizeof(info));
522 // No data means the child executed successfully, and the pipe
523 // was closed due to the close-on-exec flag being set.
525 } else if (rc != sizeof(ChildErrorInfo)) {
526 // An error occurred trying to read from the pipe, or we got a partial read.
527 // Neither of these cases should really occur in practice.
529 // We can't get any error data from the child in this case, and we don't
530 // know if it is successfully running or not. All we can do is to return
531 // normally, as if the child executed successfully. If something bad
532 // happened the caller should at least get a non-normal exit status from
534 LOG(ERROR) << "unexpected error trying to read from child error pipe " <<
535 "rc=" << rc << ", errno=" << errno;
539 // We got error data from the child. The child should exit immediately in
540 // this case, so wait on it to clean up.
543 // Throw to signal the error
544 throw SubprocessSpawnError(executable, info.errCode, info.errnoValue);
547 ProcessReturnCode Subprocess::poll() {
548 returnCode_.enforce(ProcessReturnCode::RUNNING);
551 pid_t found = ::waitpid(pid_, &status, WNOHANG);
552 checkUnixError(found, "waitpid");
554 returnCode_ = ProcessReturnCode(status);
560 bool Subprocess::pollChecked() {
561 if (poll().state() == ProcessReturnCode::RUNNING) {
564 checkStatus(returnCode_);
568 ProcessReturnCode Subprocess::wait() {
569 returnCode_.enforce(ProcessReturnCode::RUNNING);
574 found = ::waitpid(pid_, &status, 0);
575 } while (found == -1 && errno == EINTR);
576 checkUnixError(found, "waitpid");
577 DCHECK_EQ(found, pid_);
578 returnCode_ = ProcessReturnCode(status);
583 void Subprocess::waitChecked() {
585 checkStatus(returnCode_);
588 void Subprocess::sendSignal(int signal) {
589 returnCode_.enforce(ProcessReturnCode::RUNNING);
590 int r = ::kill(pid_, signal);
591 checkUnixError(r, "kill");
594 pid_t Subprocess::pid() const {
600 std::pair<const uint8_t*, size_t> queueFront(const IOBufQueue& queue) {
601 auto* p = queue.front();
602 if (!p) return std::make_pair(nullptr, 0);
603 return io::Cursor(p).peek();
607 bool handleWrite(int fd, IOBufQueue& queue) {
609 auto p = queueFront(queue);
614 ssize_t n = writeNoInt(fd, p.first, p.second);
615 if (n == -1 && errno == EAGAIN) {
618 checkUnixError(n, "write");
624 bool handleRead(int fd, IOBufQueue& queue) {
626 auto p = queue.preallocate(100, 65000);
627 ssize_t n = readNoInt(fd, p.first, p.second);
628 if (n == -1 && errno == EAGAIN) {
631 checkUnixError(n, "read");
635 queue.postallocate(n);
639 bool discardRead(int fd) {
640 static const size_t bufSize = 65000;
641 // Thread unsafe, but it doesn't matter.
642 static std::unique_ptr<char[]> buf(new char[bufSize]);
645 ssize_t n = readNoInt(fd, buf.get(), bufSize);
646 if (n == -1 && errno == EAGAIN) {
649 checkUnixError(n, "read");
658 std::pair<std::string, std::string> Subprocess::communicate(
660 IOBufQueue inputQueue;
661 inputQueue.wrapBuffer(input.data(), input.size());
663 auto outQueues = communicateIOBuf(std::move(inputQueue));
664 auto outBufs = std::make_pair(outQueues.first.move(),
665 outQueues.second.move());
666 std::pair<std::string, std::string> out;
668 outBufs.first->coalesce();
669 out.first.assign(reinterpret_cast<const char*>(outBufs.first->data()),
670 outBufs.first->length());
672 if (outBufs.second) {
673 outBufs.second->coalesce();
674 out.second.assign(reinterpret_cast<const char*>(outBufs.second->data()),
675 outBufs.second->length());
680 std::pair<IOBufQueue, IOBufQueue> Subprocess::communicateIOBuf(
682 // If the user supplied a non-empty input buffer, make sure
683 // that stdin is a pipe so we can write the data.
684 if (!input.empty()) {
685 // findByChildFd() will throw std::invalid_argument if no pipe for
686 // STDIN_FILENO exists
687 findByChildFd(STDIN_FILENO);
690 std::pair<IOBufQueue, IOBufQueue> out;
692 auto readCallback = [&] (int pfd, int cfd) -> bool {
693 if (cfd == STDOUT_FILENO) {
694 return handleRead(pfd, out.first);
695 } else if (cfd == STDERR_FILENO) {
696 return handleRead(pfd, out.second);
698 // Don't close the file descriptor, the child might not like SIGPIPE,
699 // just read and throw the data away.
700 return discardRead(pfd);
704 auto writeCallback = [&] (int pfd, int cfd) -> bool {
705 if (cfd == STDIN_FILENO) {
706 return handleWrite(pfd, input);
708 // If we don't want to write to this fd, just close it.
713 communicate(std::move(readCallback), std::move(writeCallback));
718 void Subprocess::communicate(FdCallback readCallback,
719 FdCallback writeCallback) {
720 returnCode_.enforce(ProcessReturnCode::RUNNING);
723 std::vector<pollfd> fds;
724 fds.reserve(pipes_.size());
725 std::vector<int> toClose;
726 toClose.reserve(pipes_.size());
728 while (!pipes_.empty()) {
732 for (auto& p : pipes_) {
735 // Yes, backwards, PIPE_IN / PIPE_OUT are defined from the
736 // child's point of view.
738 // Still keeping fd in watched set so we get notified of POLLHUP /
741 } else if (p.direction == PIPE_IN) {
742 pfd.events = POLLOUT;
751 r = ::poll(fds.data(), fds.size(), -1);
752 } while (r == -1 && errno == EINTR);
753 checkUnixError(r, "poll");
755 for (size_t i = 0; i < pipes_.size(); ++i) {
757 DCHECK_EQ(fds[i].fd, p.parentFd);
758 short events = fds[i].revents;
761 if (events & POLLOUT) {
762 DCHECK(!(events & POLLIN));
763 if (writeCallback(p.parentFd, p.childFd)) {
764 toClose.push_back(i);
769 // Call read callback on POLLHUP, to give it a chance to read (and act
771 if (events & (POLLIN | POLLHUP)) {
772 DCHECK(!(events & POLLOUT));
773 if (readCallback(p.parentFd, p.childFd)) {
774 toClose.push_back(i);
779 if ((events & (POLLHUP | POLLERR)) && !closed) {
780 toClose.push_back(i);
785 // Close the fds in reverse order so the indexes hold after erase()
786 for (int idx : boost::adaptors::reverse(toClose)) {
787 auto pos = pipes_.begin() + idx;
788 closeChecked(pos->parentFd);
794 void Subprocess::enableNotifications(int childFd, bool enabled) {
795 pipes_[findByChildFd(childFd)].enabled = enabled;
798 bool Subprocess::notificationsEnabled(int childFd) const {
799 return pipes_[findByChildFd(childFd)].enabled;
802 int Subprocess::findByChildFd(int childFd) const {
803 auto pos = std::lower_bound(
804 pipes_.begin(), pipes_.end(), childFd,
805 [] (const PipeInfo& info, int fd) { return info.childFd < fd; });
806 if (pos == pipes_.end() || pos->childFd != childFd) {
807 throw std::invalid_argument(folly::to<std::string>(
808 "child fd not found ", childFd));
810 return pos - pipes_.begin();
813 void Subprocess::closeParentFd(int childFd) {
814 int idx = findByChildFd(childFd);
815 closeChecked(pipes_[idx].parentFd);
816 pipes_.erase(pipes_.begin() + idx);
824 // We like EPIPE, thanks.
825 ::signal(SIGPIPE, SIG_IGN);
829 Initializer initializer;