fail2ban / fail2ban

Daemon to ban hosts that cause multiple authentication errors
http://www.fail2ban.org
Other
11.08k stars 1.2k forks source link

[BR]: Python 3.12 shows DeprecationWarning about use of os.fork() #3766

Open hannob opened 3 weeks ago

hannob commented 3 weeks ago

Environment:

The issue:

When started with python 3.12 and warnings enabled, fail2ban-server shows this warning:

/tmp/fail2ban/fail2ban/server/server.py:896: DeprecationWarning: This process (pid=19969) is multi-threaded, use of fork() may lead to deadlocks in the child.
  pid = os.fork()

Steps to reproduce

Run this command in a git checkout of fail2ban on a system with Python 3.12:

PYTHONWARNINGS=d PYTHONPATH=. bin/fail2ban-server -c config/

Expected behavior

No warnings.

Observed behavior

Python shows DeprecationWarning.

sebres commented 3 weeks ago

By the way, we don't starting daemon by forking anymore... where it is possible it'd be started in foreground (with -f parameter), see for example: https://github.com/fail2ban/fail2ban/blob/6fce23e7baa484c7d1f9b0c9a11986f3916c41dd/files/fail2ban.service.in#L11

Only old init.d scripts & co may still use previous behavior.

Also we'are aware about the issue with fork on threaded apps (no matter python or other langs)... It is not an issue at all if one knows how to "cook" them. In fail2ban no threads excepting configurator thread are started before the fork and both threads don't have common locks (neither mutexes nor something else)... And basically fork is used only to daemonize the process (start child daemon) and if one takes a closer look at the code, immediately after forking the starter process exits: https://github.com/fail2ban/fail2ban/blob/6fce23e7baa484c7d1f9b0c9a11986f3916c41dd/fail2ban/server/server.py#L926

Thus it is cosmetic stuff for us. If python devs somedays decide to remove os.fork completely, it will be either replaced with a start as process (spawn whatever, and the start becomes a bit slower) or there will be no possibility to start in background anymore at all and the init-scripts (using background starts yet) need to be rewritten to start fail2ban in background from the script side, e. g. something like this:

- fail2ban-client ?-b? ...
+ nohup fail2ban-server -f ... &