coreshift_core/

process.rs

// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/

//! Low-level process management primitives.
//!
//! Safe wrappers around `fork`, `setsid`, `setpgid`, `dup2`, `prctl`,
//! and fd-range close — building blocks for double-fork supervisor patterns.

use crate::CoreError;
use crate::error::syscall_ret;

/// Result of a [`fork`] call.
pub enum ForkResult {
    /// Returned in the parent with the child's PID.
    Parent(i32),
    /// Returned in the child (PID = 0).
    Child,
}

/// Fork the current process.
///
/// # Safety
/// After `fork`, only async-signal-safe operations are safe in the child
/// before `exec`. Rust's allocator is not async-signal-safe; use this only
/// in the narrow pattern of fork → exec or fork → immediate `_exit`.
pub unsafe fn fork() -> Result<ForkResult, CoreError> {
    let pid = unsafe { libc::fork() };
    if pid < 0 {
        return Err(CoreError::sys(
            std::io::Error::last_os_error().raw_os_error().unwrap_or(-1),
            "fork",
        ));
    }
    if pid == 0 {
        Ok(ForkResult::Child)
    } else {
        Ok(ForkResult::Parent(pid))
    }
}

/// Create a new session and set the calling process as leader.
pub fn setsid() -> Result<(), CoreError> {
    let ret = unsafe { libc::setsid() };
    if ret < 0 {
        return Err(CoreError::sys(
            std::io::Error::last_os_error().raw_os_error().unwrap_or(-1),
            "setsid",
        ));
    }
    Ok(())
}

/// Set the process group ID of `pid` to `pgid` (use 0 for self).
pub fn setpgid(pid: i32, pgid: i32) -> Result<(), CoreError> {
    syscall_ret(unsafe { libc::setpgid(pid, pgid) }, "setpgid")
}

/// Redirect stdin, stdout, and stderr to `/dev/null`.
///
/// # Safety
/// Uses `dup2` on file descriptors 0/1/2.
pub unsafe fn redirect_stdio_to_devnull() -> Result<(), CoreError> {
    let fd = unsafe { libc::open(c"/dev/null".as_ptr(), libc::O_RDWR) };
    if fd < 0 {
        return Err(CoreError::sys(
            std::io::Error::last_os_error().raw_os_error().unwrap_or(-1),
            "open:/dev/null",
        ));
    }
    unsafe {
        libc::dup2(fd, 0);
        libc::dup2(fd, 1);
        libc::dup2(fd, 2);
        if fd > 2 {
            libc::close(fd);
        }
    }
    Ok(())
}

/// Set the signal sent to this process when its **parent thread** dies
/// (`PR_SET_PDEATHSIG`).
///
/// Precision: the signal is delivered when the parent *thread that created
/// this task* exits (`forget_original_parent` runs on every thread's
/// `do_exit`), not when the parent process dies — in a thread-pool caller a
/// worker-thread exit kills its children while the process lives. The signal
/// is retained across exec except under `bprm->secureexec`. For spawn
/// wiring (which is opt-in and leader-only) see
/// [`SpawnOptionsBuilder::pdeath_signal`](crate::spawn::SpawnOptionsBuilder::pdeath_signal).
pub fn set_pdeathsig(sig: i32) -> Result<(), CoreError> {
    syscall_ret(
        unsafe { libc::prctl(libc::PR_SET_PDEATHSIG, sig as libc::c_ulong, 0, 0, 0) },
        "prctl:PR_SET_PDEATHSIG",
    )
}

/// Duplicate `src_fd` onto `dst_fd` and close `src_fd`.
///
/// Equivalent to `dup2(src_fd, dst_fd); close(src_fd)`.
///
/// # Safety
/// Manipulates raw file descriptors.
pub unsafe fn redirect_fd_to(src_fd: i32, dst_fd: i32) {
    unsafe {
        libc::dup2(src_fd, dst_fd);
        // CORE-M8: when src == dst, `dup2` is a no-op and `close(src_fd)`
        // would close the very fd meant to be kept.
        if src_fd != dst_fd {
            libc::close(src_fd);
        }
    }
}

pub fn getuid() -> u32 {
    unsafe { libc::getuid() }
}
pub fn getgid() -> u32 {
    unsafe { libc::getgid() }
}

/// Drop process privileges to the given UID (`setresuid`).
///
/// Sets real, effective, and saved UID to `uid`.
pub fn setuid(uid: u32) -> Result<(), CoreError> {
    syscall_ret(unsafe { libc::setresuid(uid, uid, uid) }, "setresuid")
}

/// Drop process privileges to the given GID (`setresgid`).
///
/// Sets real, effective, and saved GID to `gid`.
pub fn setgid(gid: u32) -> Result<(), CoreError> {
    syscall_ret(unsafe { libc::setresgid(gid, gid, gid) }, "setresgid")
}

/// Close all file descriptors >= `start`.
///
/// Enumerates `/proc/self/fd` to avoid EBADF on sparse fd tables.
/// Falls back to a blind 3..1024 scan if `/proc/self/fd` is unreadable.
pub fn close_fds_from(start: i32) {
    // Open the dir handle ourselves so we own its fd: `std::fs::read_dir` hides
    // it, and its dirfd is listed in `/proc/self/fd`, so a naive snapshot that
    // includes it would close it mid-iteration and again on drop
    // (double-close → in a multithreaded daemon the fd can be reused and an
    // unrelated socket/log fd gets closed, finding 12).
    let dir = unsafe { libc::opendir(c"/proc/self/fd".as_ptr()) };
    if dir.is_null() {
        for fd in start..1024 {
            unsafe { libc::close(fd) };
        }
        return;
    }
    let dir_fd = unsafe { libc::dirfd(dir) };
    let mut fds = Vec::new();
    loop {
        // readdir is not thread-safe against a concurrent close of the fd it is
        // reading, but this runs in a forked single-threaded child; the fd
        // snapshot is taken before any close happens below.
        let ent = unsafe { libc::readdir(dir) };
        if ent.is_null() {
            break;
        }
        let name = unsafe { (*ent).d_name.as_ptr() };
        let name = unsafe { std::ffi::CStr::from_ptr(name) };
        let Ok(name) = name.to_str() else { continue };
        if let Ok(fd) = name.parse::<i32>()
            && fd >= start
            && fd != dir_fd
        {
            fds.push(fd);
        }
    }
    // Close the dir handle first so its fd is never in the close set, then
    // close the snapshot.
    unsafe { libc::closedir(dir) };
    for fd in fds {
        unsafe { libc::close(fd) };
    }
}