8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close()

[tstuefe]

Hi, please consider the following patch.

This patch replaces the existing close-file-descriptors-logic we follow before exec'ing a target binary: instead of explicitly closing the file descriptors, we mark them as CLOEXEC. That simplifies the logic: it gets rid of the awkward tiptoeing around the fact that we need to keep alive a few file descriptors: the fail pipe fd needs to be kept open right up to the exec(), and we cause opening internal file descriptors during our iteration of open file handles from /proc.

This patch also makes future developments easier: I am working on improving logging during child process spawning (https://bugs.openjdk.org/browse/JDK-8357100), and there we have a similar problem where we need to keep a logfile fd open right up to the point exec() happens).

Note: Using fcntl() with FD_CLOEXEC should work on all our POSIX platforms, since we rely on it already, see unconditional use of that flag here:

jdk/src/java.base/unix/native/libjava/childproc.c

Lines 408 to 409 in 3acfa9e

	if (fcntl(FAIL_FILENO, F_SETFD, FD_CLOEXEC) == -1)
	goto WhyCantJohnnyExec;

This patch also fixes two subtle bugs:

• we didn't check the return value of the close() inside closeAllFileDescriptors
• the final fcntl for the fail pipe was subtly wrong (should have or'd the FD_CLOEXEC flag with the existing state before setting it)

---

Testing:

We already have the PipelineLeak test, but I also added a new test that checks that we don't accidentally leak file descriptors even if those had been opened outside the JVM and without FD_CLOEXEC.

• in the parent JVM, the test opens a file in native code without FD_CLOEXEC
• test then spawns a child program that checks that no file descriptors beyond the expected stdin/out/err are open

I verified that the test correctly detects a broken implementation that leaks file descriptors.

I verified that with this patch, we close all file descriptors. I also verified the fallback path (where we brute-force-iterate all descriptors up to _SC_OPEN_MAX).

I ran manually all tests from test/jdk/java/base/Process*, and verified that these tests run as part of the GHAs, which are green.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close() (Enhancement - P4)

Reviewers

• Roger Riggs (@RogerRiggs - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25301/head:pull/25301
$ git checkout pull/25301

Update a local copy of the PR:
$ git checkout pull/25301
$ git pull https://git.openjdk.org/jdk.git pull/25301/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 25301

View PR using the GUI difftool:
$ git pr show -t 25301

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25301.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back stuefe! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@tstuefe This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close()

Reviewed-by: rriggs

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 48 new commits pushed to the master branch:

• 53a83d1: 8357799: Improve instructions for JFileChooser/HTMLFileName.java
• 21b72de: 8357862: Java argument file is parsed unexpectedly with trailing comment
• 51877f5: 8359207: Remove runtime/signal/TestSigusr2.java since it is always skipped
• ... and 45 more: https://git.openjdk.org/jdk/compare/991097b7bf08cc1a4ceedb0c555b12948ae71885...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

@tstuefe The following label will be automatically applied to this pull request:

• core-libs

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 04: Full - Incremental (0c59d6f8)
• 03: Full (dee75d88)
• 02: Full - Incremental (aef4e2bb)
• 01: Full - Incremental (8543a5ec)
• 00: Full (0e0d64a6)

[tstuefe]

Ping @RogerRiggs ? And @simonis, perhaps?

[RogerRiggs]

Looks good

[tstuefe]

@RogerRiggs Thank you. I hold this up a few days until JDK26 since its not super critical. Would one review be sufficient or do I need more?

[RogerRiggs]

Leaving it to 26 is good. One review is ok.
If we were pushing for JDK 25, a second review would be warranted.

[openjdk]

@tstuefe this pull request can not be integrated into master due to one or more merge conflicts. To resolve these merge conflicts and update this pull request you can run the following commands in the local repository for your personal fork:

git checkout JDK-8210549-Runtime-exec-in-closeDescriptors-use-FD_CLOEXEC-instead-of-close-
git fetch https://git.openjdk.org/jdk.git master
git merge FETCH_HEAD
# resolve conflicts and follow the instructions given by git merge
git commit -m "Merge master"
git push

[RogerRiggs]

Can you shorten the long lines to < 100 chars. It makes side-by-side reviews easier.

[tstuefe]

Done

[tstuefe]

@RogerRiggs need a re-review

[RogerRiggs]

Thanks for the updates.

[tstuefe]

Thank you, Roger!

/integrate

[openjdk]

Going to push as commit afa52e4.
Since your change was applied there have been 51 commits pushed to the master branch:

• 164cae4: 8359733: UnProblemList serviceability/jvmti/vthread/SuspendWithInterruptLock
• 49a82d8: 8359449: [TEST] open/test/jdk/java/io/File/SymLinks.java Refactor extract method for Windows specific test
• 9607021: 8359646: C1 crash in AOTCodeAddressTable::add_C_string
• ... and 48 more: https://git.openjdk.org/jdk/compare/991097b7bf08cc1a4ceedb0c555b12948ae71885...master

Your commit was automatically rebased without conflicts.

[openjdk]

@tstuefe Pushed as commit afa52e4.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.