spawn paths: same descriptor-allowlist and no-alloc-after-fork treatment as #414 for the remaining spawns #424

New issue

Open

opened 2026-11-07 17:41:51 +00:00 by kayg · 0 comments

kayg commented

2026-11-07 17:41:51 +00:00

Owner

sessions::isolated manager / systemctl
startup_guard::execute
restart Image::probe
shim loginctl discovery / termination
embedded POSIX spawn
general signal-only prepare_child consumers (lifecycle, install, remote, ssh)

Each needs the same treatment as #414: an allowlist of the descriptors it means to pass, and no allocation in pre_exec, with a red-first test like proxy_exec_excludes_unmapped_inheritable_descriptors. Separately, the ETXTBSY fixture flake in a_holder_that_is_not_an_installed_traefik_is_named_in_the_error (1 in 34 runs) predates #414.

Follow-up from #414 (J341 84893, J352 84933). The proxy spawn path now passes only stdio plus mapped descriptors to its child, and allocates nothing after fork. These other spawn paths still have the older gaps (inheritable parent descriptors may cross exec, and/or allocation after fork), as listed by J341 and ranked by J352 in 84933: - sessions::isolated manager / systemctl - startup_guard::execute - restart Image::probe - shim loginctl discovery / termination - embedded POSIX spawn - general signal-only prepare_child consumers (lifecycle, install, remote, ssh) Each needs the same treatment as #414: an allowlist of the descriptors it means to pass, and no allocation in pre_exec, with a red-first test like `proxy_exec_excludes_unmapped_inheritable_descriptors`. Separately, the ETXTBSY fixture flake in `a_holder_that_is_not_an_installed_traefik_is_named_in_the_error` (1 in 34 runs) predates #414.

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#424

No description provided.

Rows
Columns