978b6eb7

test: e2e — a shell born after the exec inherits no daemon sockets

a73x 2026-08-27 13:22

Commit message

test: e2e — a shell born after the exec inherits no daemon sockets

test/e2e_14_upgrade.sh

@@ @@ -474,6 +474,35 @@ UPFP2=$(grep -aoF -- "$UPFP" "$OUT.uag" | wc -l) @@
+    echo "          before the exec and $UPFP2 after — no NEW answer crossed"; exit 1; }
+pipe_detach "agent-upgrade client"
+# A shell born of the UPGRADED daemon: a fresh named session, so its shell
+# was forked by the exec'd image. Its fd table is the witness — asked of
+# /proc, because a daemon cannot see its own leak. Before the fix every
+# post-exec shell held the daemon's listener and agent sockets.
+pipe_mux "$OUT.uagn" "$OUT.uagn.err" timeout 60 "$MUX" --sock "$SOCK71" --session post
+pipe_send 'echo newsh=$$\n'
+wait_grid "$SOCK71" "newsh=[0-9]" "agent-upgrade: the post-exec session never printed its pid" post
+UPNEWSH=$(dump_session "$SOCK71" post | sed -n 's/.*newsh=\([0-9][0-9]*\).*/\1/p' | head -1)
+[ -n "$UPNEWSH" ] || {
+    echo "e2e FAIL: agent-upgrade: no post-exec shell pid read off the grid"; dump_session "$SOCK71" post; exit 1; }
+# `/dev/ptmx` is a class of its own: a shell's OWN terminal is the SLAVE
+# (`/dev/pts/N`, dup2'd onto 0/1/2), so a master in a shell's fd table can
+# only be an adopted session's, inherited. `|| true` because grep -c prints
+# 0 AND exits 1 when nothing matches, and this suite runs under set -e.
+UPLEAK=$(ls -l "/proc/$UPNEWSH/fd" 2>/dev/null | grep -c -E 'socket:|memfd:|/dev/ptmx' || true)
+[ "$UPLEAK" -eq 0 ] || {
+    echo "e2e FAIL: agent-upgrade: the post-exec shell holds $UPLEAK daemon fd(s) — listeners, pty"
+    echo "          masters or the manifest memfd crossed the exec without FD_CLOEXEC and were inherited:"
+    ls -l "/proc/$UPNEWSH/fd"; exit 1; }
+pipe_detach "post-exec session client"
+# The other half of the same claim, asked of the daemon's own fd table: the
+# manifest memfd is adoption scaffolding, so once adoption is final nothing
+# should still hold it open — a survivor accumulates one per upgrade.
+UPDMEM=$(ls -l "/proc/$(real_pid "$D71PID")/fd" 2>/dev/null | grep -c 'memfd:mux-upgrade' || true)
+[ "$UPDMEM" -eq 0 ] || {
+    echo "e2e FAIL: agent-upgrade: the daemon still holds $UPDMEM manifest memfd(s) after the exec"
+    ls -l "/proc/$(real_pid "$D71PID")/fd"; exit 1; }
+assert_stopped "$SOCK71" "$D71PID" "agent-upgrade" "$OUT.uagstop"
+D71PID=""
+softkill "$UPAGPID" || true