Open michaelvanstraten opened 1 year ago
This was discussed in the libs-api meeting. It was suggested that perhaps a better API would be to give an array of handles to inherit, with an empty array automatically setting inheritance to false. It was also mentioned that however this bool is set, it does effectively override Stdio
. E.g. Stdio::inherit
will be ignored.
Note: A motivating use case for this option is in the pseudo console example code: Creating the Hosted Process. The pseudo gets passed differently so inheritance is unnecessary. This works because if any of stdout, stdin or stderror are set to null then a child process will be given new handles derived from the console it's attached to (assuming it's not a gui process).
Sorry for the late response, I recently had a lot on my hands with the new Semester at University and a new Job.
With this plan, it still eludes me how you could both pass some handles to a process while stopping it from inheriting other.
With this plan, it still eludes me how you could both pass some handles to a process while stopping it from inheriting other.
Windows versions >= Vista support specifying a list of handles to inherit when creating a process by setting the process attribute PROC_THREAD_ATTRIBUTE_HANDLE_LIST
in the extended startup info passed to CreateProcessW()
.
The setup code is ... not straightforward. Raymond Chen has a brief writeup on it at https://devblogs.microsoft.com/oldnewthing/20111216-00/?p=8873, with sample code.
API Change Proposal
Problem Statement
Currently, there is no mechanism in the Rust standard library to create a child process on Windows that does not inherit handles from the calling process.
Motivating Examples or Use Cases
Handle inheritance can be problematic in multi-threaded programs, as different command-spawning actions may require passing different files to the child process. In addition, improving security by preventing the child process from acquiring certain handles is essential.
Disabling handle inheritance when unnecessary is important for several reasons:
Solution Sketch
To address this issue, we propose adding a new flag to the
CommandExt
trait in Rust's standard library. This flag will determine whether the child process should inherit handles from the calling process.Additionally, the proposed change will affect the underlying
CreateProcessW
function, as shown below:Alternatives
Links and Related Work
For further reference, please consult the following resources: