blob: e6e4ae2b06b22b92ede6ddadae35bcd264dd739c [file] [log] [blame]
// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// +build aix darwin dragonfly freebsd hurd linux netbsd openbsd solaris
// Fork, exec, wait, etc.
package syscall
import (
//sysnb raw_fork() (pid Pid_t, err Errno)
//fork() Pid_t
//sysnb raw_getpid() (pid Pid_t)
//getpid() Pid_t
//sysnb raw_getppid() (pid Pid_t)
//getppid() Pid_t
//sysnb raw_setsid() (err Errno)
//setsid() Pid_t
//sysnb raw_setpgid(pid int, pgid int) (err Errno)
//setpgid(pid Pid_t, pgid Pid_t) _C_int
//sysnb raw_chroot(path *byte) (err Errno)
//chroot(path *byte) _C_int
//sysnb raw_chdir(path *byte) (err Errno)
//chdir(path *byte) _C_int
//sysnb raw_fcntl(fd int, cmd int, arg int) (val int, err Errno)
//__go_fcntl(fd _C_int, cmd _C_int, arg _C_int) _C_int
//sysnb raw_close(fd int) (err Errno)
//close(fd _C_int) _C_int
//sysnb raw_ioctl(fd int, cmd uintptr, val int) (rval int, err Errno)
//__go_ioctl(fd _C_int, cmd _C_int, val _C_int) _C_int
//sysnb raw_ioctl_ptr(fd int, cmd uintptr, val unsafe.Pointer) (rval int, err Errno)
//__go_ioctl_ptr(fd _C_int, cmd _C_int, val unsafe.Pointer) _C_int
//sysnb raw_execve(argv0 *byte, argv **byte, envv **byte) (err Errno)
//execve(argv0 *byte, argv **byte, envv **byte) _C_int
//sysnb raw_read(fd int, buf *byte, count int) (c int, err Errno)
//read(fd _C_int, buf *byte, count Size_t) Ssize_t
//sysnb raw_write(fd int, buf *byte, count int) (c int, err Errno)
//write(fd _C_int, buf *byte, count Size_t) Ssize_t
//sysnb raw_exit(status int)
//_exit(status _C_int)
//sysnb raw_dup2(oldfd int, newfd int) (err Errno)
//dup2(oldfd _C_int, newfd _C_int) _C_int
//sysnb raw_kill(pid Pid_t, sig Signal) (err Errno)
//kill(pid Pid_t, sig _C_int) _C_int
//sysnb raw_setgroups(size int, list unsafe.Pointer) (err Errno)
//setgroups(size Size_t, list *Gid_t) _C_int
// Lock synchronizing creation of new file descriptors with fork.
// We want the child in a fork/exec sequence to inherit only the
// file descriptors we intend. To do that, we mark all file
// descriptors close-on-exec and then, in the child, explicitly
// unmark the ones we want the exec'ed program to keep.
// Unix doesn't make this easy: there is, in general, no way to
// allocate a new file descriptor close-on-exec. Instead you
// have to allocate the descriptor and then mark it close-on-exec.
// If a fork happens between those two events, the child's exec
// will inherit an unwanted file descriptor.
// This lock solves that race: the create new fd/mark close-on-exec
// operation is done holding ForkLock for reading, and the fork itself
// is done holding ForkLock for writing. At least, that's the idea.
// There are some complications.
// Some system calls that create new file descriptors can block
// for arbitrarily long times: open on a hung NFS server or named
// pipe, accept on a socket, and so on. We can't reasonably grab
// the lock across those operations.
// It is worse to inherit some file descriptors than others.
// If a non-malicious child accidentally inherits an open ordinary file,
// that's not a big deal. On the other hand, if a long-lived child
// accidentally inherits the write end of a pipe, then the reader
// of that pipe will not see EOF until that child exits, potentially
// causing the parent program to hang. This is a common problem
// in threaded C programs that use popen.
// Luckily, the file descriptors that are most important not to
// inherit are not the ones that can take an arbitrarily long time
// to create: pipe returns instantly, and the net package uses
// non-blocking I/O to accept on a listening socket.
// The rules for which file descriptor-creating operations use the
// ForkLock are as follows:
// 1) Pipe. Does not block. Use the ForkLock.
// 2) Socket. Does not block. Use the ForkLock.
// 3) Accept. If using non-blocking mode, use the ForkLock.
// Otherwise, live with the race.
// 4) Open. Can block. Use O_CLOEXEC if available (GNU/Linux).
// Otherwise, live with the race.
// 5) Dup. Does not block. Use the ForkLock.
// On GNU/Linux, could use fcntl F_DUPFD_CLOEXEC
// instead of the ForkLock, but only for dup(fd, -1).
var ForkLock sync.RWMutex
// StringSlicePtr converts a slice of strings to a slice of pointers
// to NUL-terminated byte arrays. If any string contains a NUL byte
// this function panics instead of returning an error.
// Deprecated: Use SlicePtrFromStrings instead.
func StringSlicePtr(ss []string) []*byte {
bb := make([]*byte, len(ss)+1)
for i := 0; i < len(ss); i++ {
bb[i] = StringBytePtr(ss[i])
bb[len(ss)] = nil
return bb
// SlicePtrFromStrings converts a slice of strings to a slice of
// pointers to NUL-terminated byte arrays. If any string contains
// a NUL byte, it returns (nil, EINVAL).
func SlicePtrFromStrings(ss []string) ([]*byte, error) {
n := 0
for _, s := range ss {
if bytealg.IndexByteString(s, 0) != -1 {
return nil, EINVAL
n += len(s) + 1 // +1 for NUL
bb := make([]*byte, len(ss)+1)
b := make([]byte, n)
n = 0
for i, s := range ss {
bb[i] = &b[n]
copy(b[n:], s)
n += len(s) + 1
return bb, nil
func CloseOnExec(fd int) { fcntl(fd, F_SETFD, FD_CLOEXEC) }
func SetNonblock(fd int, nonblocking bool) (err error) {
flag, err := fcntl(fd, F_GETFL, 0)
if err != nil {
return err
if nonblocking {
flag |= O_NONBLOCK
} else {
flag &^= O_NONBLOCK
_, err = fcntl(fd, F_SETFL, flag)
return err
// Credential holds user and group identities to be assumed
// by a child process started by StartProcess.
type Credential struct {
Uid uint32 // User ID.
Gid uint32 // Group ID.
Groups []uint32 // Supplementary group IDs.
NoSetGroups bool // If true, don't set supplementary groups
// ProcAttr holds attributes that will be applied to a new process started
// by StartProcess.
type ProcAttr struct {
Dir string // Current working directory.
Env []string // Environment.
Files []uintptr // File descriptors.
Sys *SysProcAttr
var zeroProcAttr ProcAttr
var zeroSysProcAttr SysProcAttr
func forkExec(argv0 string, argv []string, attr *ProcAttr) (pid int, err error) {
var p [2]int
var n int
var err1 Errno
var wstatus WaitStatus
if attr == nil {
attr = &zeroProcAttr
sys := attr.Sys
if sys == nil {
sys = &zeroSysProcAttr
p[0] = -1
p[1] = -1
// Convert args to C form.
argv0p, err := BytePtrFromString(argv0)
if err != nil {
return 0, err
argvp, err := SlicePtrFromStrings(argv)
if err != nil {
return 0, err
envvp, err := SlicePtrFromStrings(attr.Env)
if err != nil {
return 0, err
if (runtime.GOOS == "freebsd" || runtime.GOOS == "dragonfly") && len(argv[0]) > len(argv0) {
argvp[0] = argv0p
var chroot *byte
if sys.Chroot != "" {
chroot, err = BytePtrFromString(sys.Chroot)
if err != nil {
return 0, err
var dir *byte
if attr.Dir != "" {
dir, err = BytePtrFromString(attr.Dir)
if err != nil {
return 0, err
// Acquire the fork lock so that no other threads
// create new fds that are not yet close-on-exec
// before we fork.
// Allocate child status pipe close on exec.
if err = forkExecPipe(p[:]); err != nil {
goto error
// Kick off child.
pid, err1 = forkAndExecInChild(argv0p, argvp, envvp, chroot, dir, attr, sys, p[1])
if err1 != 0 {
err = Errno(err1)
goto error
// Read child error status from pipe.
n, err = readlen(p[0], (*byte)(unsafe.Pointer(&err1)), int(unsafe.Sizeof(err1)))
if err != nil || n != 0 {
if n == int(unsafe.Sizeof(err1)) {
err = Errno(err1)
if err == nil {
err = EPIPE
// Child failed; wait for it to exit, to make sure
// the zombies don't accumulate.
_, err1 := Wait4(pid, &wstatus, 0, nil)
for err1 == EINTR {
_, err1 = Wait4(pid, &wstatus, 0, nil)
return 0, err
// Read got EOF, so pipe closed on exec, so exec succeeded.
return pid, nil
if p[0] >= 0 {
return 0, err
// Combination of fork and exec, careful to be thread safe.
func ForkExec(argv0 string, argv []string, attr *ProcAttr) (pid int, err error) {
return forkExec(argv0, argv, attr)
// StartProcess wraps ForkExec for package os.
func StartProcess(argv0 string, argv []string, attr *ProcAttr) (pid int, handle uintptr, err error) {
pid, err = forkExec(argv0, argv, attr)
return pid, 0, err
// Implemented in runtime package.
func runtime_BeforeExec()
func runtime_AfterExec()
// execveLibc is non-nil on OS using libc syscall, set to execve in exec_libc.go; this
// avoids a build dependency for other platforms.
var execveDarwin func(path *byte, argv **byte, envp **byte) error
// Exec invokes the execve(2) system call.
func Exec(argv0 string, argv []string, envv []string) (err error) {
argv0p, err := BytePtrFromString(argv0)
if err != nil {
return err
argvp, err := SlicePtrFromStrings(argv)
if err != nil {
return err
envvp, err := SlicePtrFromStrings(envv)
if err != nil {
return err
var err1 error
if runtime.GOOS == "solaris" || runtime.GOOS == "illumos" || runtime.GOOS == "aix" || runtime.GOOS == "hurd" {
// RawSyscall should never be used on Solaris or AIX.
err1 = raw_execve(argv0p, &argvp[0], &envvp[0])
} else if runtime.GOOS == "darwin" {
// Similarly on Darwin.
err1 = execveDarwin(argv0p, &argvp[0], &envvp[0])
} else {
_, _, err1 = RawSyscall(SYS_EXECVE,
return err1