204 lines
10 KiB
Python
204 lines
10 KiB
Python
#!/usr/bin/env python3
|
|
"""One-action private process supervisor; no credentials, network or runtime policy."""
|
|
import argparse
|
|
import base64
|
|
import ctypes
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import select
|
|
import signal
|
|
import stat
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
import uuid
|
|
|
|
MAX_OUTPUT=65536
|
|
ENV={'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'}
|
|
|
|
|
|
def facts(pid):
|
|
try:
|
|
path=Path('/proc')/str(pid);raw=(path/'stat').read_text();v=raw[raw.rfind(')')+2:].split()
|
|
return {'pid':pid,'ppid':int(v[1]),'pgrp':int(v[2]),'sid':int(v[3]),'start':int(v[19]),'uid':path.stat().st_uid,'state':v[0]}
|
|
except FileNotFoundError:return None
|
|
|
|
|
|
def write(path,value):
|
|
temp=path.with_name('.'+path.name+'.'+uuid.uuid4().hex)
|
|
fd=os.open(temp,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
|
with os.fdopen(fd,'w') as f:json.dump(value,f);f.flush();os.fsync(f.fileno())
|
|
temp.replace(path)
|
|
|
|
|
|
def dead(fd):
|
|
p=select.poll();p.register(fd,select.POLLIN);return bool(p.poll(0))
|
|
|
|
|
|
def descendants(parent):
|
|
rows={}
|
|
for p in Path('/proc').iterdir():
|
|
if p.name.isdigit():
|
|
row=facts(int(p.name))
|
|
if row:rows[row['pid']]=row
|
|
selected={parent};changed=True
|
|
while changed:
|
|
before=len(selected);selected.update(r['pid'] for r in rows.values() if r['ppid'] in selected)
|
|
changed=len(selected)!=before
|
|
return {p:rows[p] for p in selected-{parent} if p in rows}
|
|
|
|
|
|
def quiesce(parent,children):
|
|
"""Signal only pidfd-bound actual descendants; subreaper adopts escaped sessions."""
|
|
uncertain=False
|
|
for sig,limit in ((signal.SIGTERM,0.5),(signal.SIGKILL,3.0)):
|
|
end=time.monotonic()+limit
|
|
while time.monotonic()<end:
|
|
try:rows=descendants(parent)
|
|
except Exception:return False
|
|
for pid,row in rows.items():
|
|
try:
|
|
if row['uid']!=os.getuid():uncertain=True;continue
|
|
fd=os.pidfd_open(pid)
|
|
current=facts(pid)
|
|
if current is not None and (current['start'],current['uid'])==(row['start'],row['uid']):
|
|
signal.pidfd_send_signal(fd,sig)
|
|
elif current is not None:uncertain=True
|
|
os.close(fd)
|
|
except ProcessLookupError:pass
|
|
except Exception:uncertain=True
|
|
for child in children:child.poll()
|
|
while True:
|
|
try:
|
|
pid,_=os.waitpid(-1,os.WNOHANG)
|
|
if pid==0:break
|
|
except ChildProcessError:break
|
|
try:remaining=descendants(parent)
|
|
except Exception:return False
|
|
if not remaining:return not uncertain
|
|
time.sleep(0.02)
|
|
return False
|
|
|
|
|
|
def parent_death(expected):
|
|
# Called before exec in a single-threaded supervisor. No application code runs
|
|
# if the supervisor disappeared between fork and PR_SET_PDEATHSIG.
|
|
if ctypes.CDLL(None,use_errno=True).prctl(1,signal.SIGKILL,0,0,0)!=0:os._exit(125)
|
|
if os.getppid()!=expected:os._exit(125)
|
|
|
|
|
|
def watchdog(directory,parent_fd):
|
|
directory=Path(directory)
|
|
if ctypes.CDLL(None,use_errno=True).prctl(36,1,0,0,0)!=0:raise RuntimeError('subreaper_unavailable')
|
|
root=json.loads((directory/'root.json').read_text())
|
|
current=facts(root['pid'])
|
|
if current is None or current['start']!=root['start'] or current['uid']!=os.getuid() or dead(parent_fd):return 1
|
|
write(directory/'ready.json',facts(os.getpid()))
|
|
jobs={};abort=None;uncertain=False
|
|
try:
|
|
while True:
|
|
if dead(parent_fd):abort='controller_lost'
|
|
if (directory/'shutdown').exists():abort=abort or 'shutdown'
|
|
for path in sorted(directory.glob('request-*.json')):
|
|
key=path.stem.removeprefix('request-')
|
|
if key in jobs:continue
|
|
try:
|
|
r=json.loads(path.read_text());owner=facts(r['owner']['pid'])
|
|
if owner is None or owner['start']!=r['owner']['start'] or owner['uid']!=os.getuid():raise ValueError()
|
|
if owner['pid']!=root['pid'] and owner['pid'] not in descendants(os.getpid()):raise ValueError()
|
|
if type(r['timeout']) not in (int,float) or not 0<r['timeout']<=300:raise ValueError()
|
|
if not isinstance(r['argv'],list) or not r['argv'] or any(not isinstance(x,str) for x in r['argv']):raise ValueError()
|
|
if abort:raise ValueError()
|
|
owner_fd=os.pidfd_open(owner['pid'])
|
|
supervisor_pid=os.getpid()
|
|
child=subprocess.Popen(r['argv'],stdin=subprocess.DEVNULL,
|
|
stdout=subprocess.PIPE if r['capture'] else subprocess.DEVNULL,
|
|
stderr=subprocess.DEVNULL,env=ENV,start_new_session=True,
|
|
preexec_fn=lambda parent=supervisor_pid:parent_death(parent))
|
|
jobs[key]={'p':child,'request':r,'owner_fd':owner_fd,'deadline':time.monotonic()+r['timeout'],
|
|
'output':bytearray(),'eof':not r['capture'],'done':False}
|
|
if child.stdout:os.set_blocking(child.stdout.fileno(),False)
|
|
except Exception:
|
|
abort=abort or 'request_mapping_refused';uncertain=True
|
|
write(directory/('result-'+key+'.json'),{'returncode':125,'quiescent':False,'status':'mapping_refused'})
|
|
for key,job in list(jobs.items()):
|
|
if job['done']:continue
|
|
p=job['p']
|
|
if p.stdout and not job['eof']:
|
|
try:
|
|
raw=os.read(p.stdout.fileno(),MAX_OUTPUT+1)
|
|
if not raw:job['eof']=True
|
|
else:
|
|
job['output'].extend(raw)
|
|
if len(job['output'])>MAX_OUTPUT:abort=abort or 'output_bound'
|
|
except BlockingIOError:pass
|
|
if dead(job['owner_fd']):abort=abort or 'caller_lost'
|
|
if time.monotonic()>=job['deadline']:abort=abort or 'timeout'
|
|
if p.poll() is not None and job['eof'] and not abort:
|
|
# A returned leader is not evidence that its children exited.
|
|
own=descendants(os.getpid())
|
|
leaders={x['p'].pid for x in jobs.values() if not x['done']}
|
|
if any(row['sid']==p.pid or (row['ppid']==os.getpid() and row['pid'] not in leaders) for row in own.values()):abort='leader_left_descendants'
|
|
else:
|
|
write(directory/('result-'+key+'.json'),{'returncode':p.returncode,'quiescent':True,'status':'completed',
|
|
'output_b64':base64.b64encode(job['output']).decode() if job['request']['capture'] else ''})
|
|
job['done']=True;os.close(job['owner_fd'])
|
|
if abort:
|
|
ok=quiesce(os.getpid(),[x['p'] for x in jobs.values()]) and not uncertain
|
|
for key,job in jobs.items():
|
|
if not job['done']:
|
|
write(directory/('result-'+key+'.json'),{'returncode':124 if abort=='timeout' else 125,
|
|
'quiescent':ok,'status':abort,'output_b64':''});job['done']=True
|
|
write(directory/'quiescent.json',{'quiescent':ok,'reason':abort,'no_live_or_waitable_descendants':ok,
|
|
'stderr_suppressed':True,'process_values_emitted':False})
|
|
return 0 if ok else 1
|
|
time.sleep(0.01)
|
|
except BaseException:
|
|
ok=quiesce(os.getpid(),[x['p'] for x in jobs.values()])
|
|
write(directory/'quiescent.json',{'quiescent':False,'reason':'supervisor_exception','best_effort_stopped':ok})
|
|
return 1
|
|
|
|
|
|
class Supervisor:
|
|
def __init__(self,directory):
|
|
self.directory=Path(directory);self.directory.mkdir(mode=0o700)
|
|
write(self.directory/'root.json',facts(os.getpid()))
|
|
fd=os.pidfd_open(os.getpid())
|
|
try:self.process=subprocess.Popen([sys.executable,'-I','-B',str(Path(__file__).resolve()),'--watchdog',str(self.directory),'--parent-fd',str(fd)],
|
|
stdin=subprocess.DEVNULL,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,pass_fds=(fd,),start_new_session=True,env=ENV)
|
|
finally:os.close(fd)
|
|
end=time.monotonic()+5
|
|
while not (self.directory/'ready.json').exists():
|
|
if self.process.poll() is not None or time.monotonic()>end:raise RuntimeError('supervisor_start_failed')
|
|
time.sleep(0.01)
|
|
def run(self,argv,timeout,*,capture=False):return request(self.directory,argv,timeout,capture=capture)
|
|
def close(self):
|
|
write(self.directory/'shutdown',{})
|
|
try:self.process.wait(timeout=8)
|
|
except subprocess.TimeoutExpired:raise RuntimeError('supervisor_quiescence_unknown') from None
|
|
report=json.loads((self.directory/'quiescent.json').read_text())
|
|
if self.process.returncode or report.get('quiescent') is not True:raise RuntimeError('descendant_quiescence_unverified')
|
|
return report
|
|
|
|
|
|
def request(directory,argv,timeout,*,capture=False):
|
|
directory=Path(directory);key=uuid.uuid4().hex
|
|
write(directory/('request-'+key+'.json'),{'owner':facts(os.getpid()),'argv':list(argv),'timeout':timeout,'capture':capture})
|
|
end=time.monotonic()+timeout+10
|
|
result=directory/('result-'+key+'.json')
|
|
while not result.exists():
|
|
if time.monotonic()>end:raise RuntimeError('supervision_reply_unknown')
|
|
time.sleep(0.01)
|
|
report=json.loads(result.read_text())
|
|
if report.get('quiescent') is not True:raise RuntimeError('descendant_quiescence_unverified')
|
|
return report['returncode'],base64.b64decode(report.get('output_b64',''),validate=True)
|
|
|
|
|
|
def main():
|
|
p=argparse.ArgumentParser();p.add_argument('--watchdog');p.add_argument('--parent-fd',type=int);a=p.parse_args()
|
|
return watchdog(a.watchdog,a.parent_fd)
|
|
|
|
if __name__=='__main__':
|
|
try:raise SystemExit(main())
|
|
except Exception:raise SystemExit(1) from None
|