8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close()

[tstuefe]

Hi, please consider the following patch.

This patch replaces the existing close-file-descriptors-logic we follow before exec'ing a target binary: instead of explicitly closing the file descriptors, we mark them as CLOEXEC. That simplifies the logic: it gets rid of the awkward tiptoeing around the fact that we need to keep alive a few file descriptors: the fail pipe fd needs to be kept open right up to the exec(), and we cause opening internal file descriptors during our iteration of open file handles from /proc.

This patch also makes future developments easier: I am working on improving logging during child process spawning (https://bugs.openjdk.org/browse/JDK-8357100), and there we have a similar problem where we need to keep a logfile fd open right up to the point exec() happens).

Note: Using fcntl() with FD_CLOEXEC should work on all our POSIX platforms, since we rely on it already, see unconditional use of that flag here:

jdk/src/java.base/unix/native/libjava/childproc.c

Lines 408 to 409 in 3acfa9e

	if (fcntl(FAIL_FILENO, F_SETFD, FD_CLOEXEC) == -1)
	goto WhyCantJohnnyExec;

This patch also fixes two subtle bugs:

• we didn't check the return value of the close() inside closeAllFileDescriptors
• the final fcntl for the fail pipe was subtly wrong (should have or'd the FD_CLOEXEC flag with the existing state before setting it)

---

Testing:

We already have the PipelineLeak test, but I also added a new test that checks that we don't accidentally leak file descriptors even if those had been opened outside the JVM and without FD_CLOEXEC.

• in the parent JVM, the test opens a file in native code without FD_CLOEXEC
• test then spawns a child program that checks that no file descriptors beyond the expected stdin/out/err are open

I verified that the test correctly detects a broken implementation that leaks file descriptors.

I verified that with this patch, we close all file descriptors. I also verified the fallback path (where we brute-force-iterate all descriptors up to _SC_OPEN_MAX).

I ran manually all tests from test/jdk/java/base/Process*, and verified that these tests run as part of the GHAs, which are green.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close() (Enhancement - P4)(⚠️ The fixVersion in this issue is [26] but the fixVersion in .jcheck/conf is 25, a new backport will be created when this pr is integrated.)

Reviewers

• Roger Riggs (@RogerRiggs - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25301/head:pull/25301
$ git checkout pull/25301

Update a local copy of the PR:
$ git checkout pull/25301
$ git pull https://git.openjdk.org/jdk.git pull/25301/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 25301

View PR using the GUI difftool:
$ git pr show -t 25301

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25301.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back stuefe! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@tstuefe This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8210549: Runtime.exec: in closeDescriptors(), use FD_CLOEXEC instead of close()

Reviewed-by: rriggs

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

@tstuefe The following label will be automatically applied to this pull request:

• core-libs

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 02: Full - Incremental (aef4e2bb)
• 01: Full - Incremental (8543a5ec)
• 00: Full (0e0d64a6)

[tstuefe]

Ping @RogerRiggs ? And @simonis, perhaps?

[RogerRiggs]

Looks good

[tstuefe]

@RogerRiggs Thank you. I hold this up a few days until JDK26 since its not super critical. Would one review be sufficient or do I need more?

[RogerRiggs]

Leaving it to 26 is good. One review is ok.
If we were pushing for JDK 25, a second review would be warranted.