3ad4a517

fix: seal the adopted fds after the last rollback, not during adoption

a73x 2026-08-27 13:22

Commit message

fix: seal the adopted fds after the last rollback, not during adoption

Flagging them inside initFromManifest broke the rollback exec: it hands
the old binary the very descriptors adoption took, and a CLOEXEC fd does
not survive that exec — the rolled-back daemon panicked on a manifest
naming fds it no longer had (e2e 14_upgrade). sealAdoptedFds runs from
resumeRun instead, past the last point a rollback can happen, and the
manifest memfd is closed there for the same reason: left open and
CLOEXEC-cleared it was inherited by every shell, one more per upgrade.

src/cli/main.zig

Old		New
@@ -526,6 +526,14 @@ fn resumeRun(alloc: std.mem.Allocator, o: Opts, resume_fd: std.posix.fd_t) !u8 {
526	// the demolition list.	526	// the demolition list.
527	if (std.mem.eql(u8, fail_at, "session"))	527	if (std.mem.eql(u8, fail_at, "session"))
528	return rollback(alloc, parsed.daemon.writer_path, resume_fd, "session (--resume-fail-at)");	528	return rollback(alloc, parsed.daemon.writer_path, resume_fd, "session (--resume-fail-at)");
		529
		530	// The last rollback point is behind us, so the descriptors it would have
		531	// handed back are this image's to keep — and to stop handing on. Rollback
		532	// was the manifest's last reader; left open, it is CLOEXEC-cleared like
		533	// the rest and every shell spawned from here inherits it.
		534	std.posix.close(resume_fd);
		535	srv.sealAdoptedFds();
		536
529	defer srv.deinit();	537	defer srv.deinit();
530		538
531	// The marker's job ended the moment this image started serving.	539	// The marker's job ended the moment this image started serving.

src/server.zig

@@ @@ -3292,9 +3292,33 @@ pub const Server = struct { @@
+        _ = try std.posix.fcntl(fd, std.posix.F.SETFD, flags & ~@as(usize, std.posix.FD_CLOEXEC));
+    /// The adopting side of clearCloexec: a flag cleared for the exec that
+    /// stays cleared is inherited by every shell this daemon spawns next.
+    pub fn setCloexec(fd: std.posix.fd_t) !void {
+        const flags = try std.posix.fcntl(fd, std.posix.F.GETFD, 0);
+        _ = try std.posix.fcntl(fd, std.posix.F.SETFD, flags | @as(usize, std.posix.FD_CLOEXEC));
+    }
+    fn restoreCloexec(fds: []const std.posix.fd_t) void {
+        for (fds) |fd| setCloexec(fd) catch {};
+    }
+    fn sealFd(fd: std.posix.fd_t) void {
+        setCloexec(fd) catch |e|
+            std.debug.print("muxd: seal fd {d}: {t}\n", .{ fd, e });
+    }
+    /// Put the flag back on every fd `execUpgrade` cleared and this image
+    /// keeps — the manifest memfd is cleared there too, and closed by the
+    /// caller rather than walked here. Only once adoption is FINAL:
+    /// `initFromManifest` leaves them clear, a rollback exec carries them.
+    pub fn sealAdoptedFds(self: *Server) void {
+        sealFd(self.listener.stream.handle);
+        if (self.quicListener()) |q| sealFd(q.fd);
+        for (&self.sessions.table) |*slot| {
+            const s = slot.* orelse continue;
+            sealFd(s.pty.master);
+            if (s.agent_listener != -1) sealFd(s.agent_listener);

src/server_test_upgrade.zig

@@ @@ -320,3 +320,70 @@ test "clearCloexec: a CLOEXEC memfd's flag flips" { @@
+    const after = try std.posix.fcntl(fd, std.posix.F.GETFD, 0);
+    try std.testing.expect(after & std.posix.FD_CLOEXEC == 0);
+/// FD_CLOEXEC, read back from the kernel — a daemon reporting on its own
+/// fd table cannot catch itself being wrong.
+fn hasCloexec(fd: std.posix.fd_t) !bool {
+    const flags = try std.posix.fcntl(fd, std.posix.F.GETFD, 0);
+    return flags & std.posix.FD_CLOEXEC != 0;
+}
+test "sealAdoptedFds: the adopted fds are CLOEXEC again, and not one step before the last rollback" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const dir_path = tmp.path();
+    const sock_path = try std.fmt.allocPrint(alloc, "{s}/cloexec.sock", .{dir_path});
+    defer alloc.free(sock_path);
+    var srv = try Server.init(alloc, .{ .sock_path = sock_path, .shell = "/bin/sh" });
+    const memfd = try std.posix.memfd_create("mux-cloexec-test", 0);
+    defer std.posix.close(memfd);
+    try srv.writeManifestTo(memfd, "0.0.1-99");
+    // What execUpgrade does on the way out: the flag is cleared so the fds
+    // cross the exec. The adopting side must put it back.
+    try Server.clearCloexec(srv.listener.stream.handle);
+    try Server.clearCloexec(srv.sessions.table[0].?.pty.master);
+    if (srv.sessions.table[0].?.agent_listener != -1)
+        try Server.clearCloexec(srv.sessions.table[0].?.agent_listener);
+    // Memory only, as in the adopted-session test above: deinit would
+    // demolish exactly what srv2 is about to inherit.
+    {
+        const s = &srv.sessions.table[0].?;
+        s.tracker.deinit(alloc);
+        s.freePending(alloc);
+        if (s.title_sent) |t| alloc.free(t);
+        s.eng.deinit();
+        if (s.agent_path) |p| alloc.free(p);
+    }
+    if (srv.agents.dir) |d| alloc.free(d);
+    srv.shellint_arena.deinit();
+    var file = std.fs.File{ .handle = memfd };
+    try file.seekTo(0);
+    const buf = try file.readToEndAlloc(alloc, 4 * 1024 * 1024);
+    defer alloc.free(buf);
+    var parsed = try upgrade.parseManifest(alloc, buf);
+    defer parsed.deinit();
+    var srv2 = try Server.initFromManifest(alloc, &parsed, "0.0.1-100");
+    defer srv2.deinit();
+    const s2 = &srv2.sessions.table[0].?;
+    // Adoption alone must NOT set it: `rollback` execs the old binary with
+    // these very descriptors, and a flag set here closes them at that exec.
+    // Flagged in initFromManifest, this test was green and the rolled-back
+    // daemon panicked adopting a manifest naming fds it no longer had.
+    try std.testing.expect(!try hasCloexec(srv2.listener.stream.handle));
+    try std.testing.expect(!try hasCloexec(s2.pty.master));
+    if (s2.agent_listener != -1) try std.testing.expect(!try hasCloexec(s2.agent_listener));
+    srv2.sealAdoptedFds();
+    try std.testing.expect(try hasCloexec(srv2.listener.stream.handle));
+    try std.testing.expect(try hasCloexec(s2.pty.master));
+    if (s2.agent_listener != -1) try std.testing.expect(try hasCloexec(s2.agent_listener));
+}