shim test reserved_ready_source_survives_process_pin_transfer depends on fds 3–4 being open #362

New issue

Open

opened 2026-11-05 03:22:28 +00:00 by kayg · 0 comments

kayg commented

2026-11-05 03:22:28 +00:00

Owner

Found by J208c (#344) while bringing up the D351 privileged integration row.

crates/infraternal-shim/src/pty.rs → pty::inherited_login_process_tests::reserved_ready_source_survives_process_pin_transfer passes under cargo test, but aborts when its test binary runs directly:

fatal runtime error: IO Safety violation: owned file descriptor already closed, aborting
thread '...reserved_ready_source_survives_process_pin_transfer' panicked at crates/infraternal-shim/src/pty.rs:1781:13:
assertion failed: Command::new(std::env::current_exe().unwrap())...status().unwrap().success()

Cause: the fixture dup2s the ready socket onto fd 5 and assumes nothing owns fd 5 ("this isolated fixture owns no descriptor 5 after its original socket pair closes"). That only holds when fds 3 and 4 are already open, as they are under cargo, which passes its jobserver pipes to test processes. With 3 and 4 free, the socket pair and its clones land on 3–6, and fd 5 is the owned parent_copy. dup2 overwrites it and the later drop aborts.

Evidence, on compute01 with the same workspace-built binary (infraternal_shim-1c8d6a3c1c72fbe9, as claude, no root, no namespaces):

fds 3,4 free:     test result: FAILED. 0 passed; 1 failed
fds 3,4 occupied: test result: ok. 1 passed; 0 failed

Not a root or product issue; the test depends on the descriptor table of whatever launches it. A fix could reserve fd 5 explicitly: check it is closed, or open placeholders up to fd 4 first, so the "small descriptor table" ordering is created on purpose. Not fixed in J208c; the privileged row lists this test as a known failure referencing this issue until it is fixed.

Found by J208c (#344) while bringing up the D351 privileged integration row. `crates/infraternal-shim/src/pty.rs` → `pty::inherited_login_process_tests::reserved_ready_source_survives_process_pin_transfer` passes under `cargo test`, but aborts when its test binary runs directly: ``` fatal runtime error: IO Safety violation: owned file descriptor already closed, aborting thread '...reserved_ready_source_survives_process_pin_transfer' panicked at crates/infraternal-shim/src/pty.rs:1781:13: assertion failed: Command::new(std::env::current_exe().unwrap())...status().unwrap().success() ``` Cause: the fixture `dup2`s the ready socket onto fd 5 and assumes nothing owns fd 5 ("this isolated fixture owns no descriptor 5 after its original socket pair closes"). That only holds when fds 3 and 4 are already open, as they are under cargo, which passes its jobserver pipes to test processes. With 3 and 4 free, the socket pair and its clones land on 3–6, and fd 5 is the owned `parent_copy`. `dup2` overwrites it and the later drop aborts. Evidence, on compute01 with the same workspace-built binary (`infraternal_shim-1c8d6a3c1c72fbe9`, as claude, no root, no namespaces): ``` fds 3,4 free: test result: FAILED. 0 passed; 1 failed fds 3,4 occupied: test result: ok. 1 passed; 0 failed ``` Not a root or product issue; the test depends on the descriptor table of whatever launches it. A fix could reserve fd 5 explicitly: check it is closed, or open placeholders up to fd 4 first, so the "small descriptor table" ordering is created on purpose. Not fixed in J208c; the privileged row lists this test as a known failure referencing this issue until it is fixed.

kayg referenced this issue

2026-11-05 03:23:14 +00:00

Engineering practices proposal #344

kayg referenced this issue

2026-11-05 06:03:02 +00:00

Engineering practices proposal #344