0.37 release planning

[sunfishcode]

With #487 and #486 landed, we have an upcoming need for a semver bump to 0.37. Please post any questions or concerns here.

If they're fixed soon, it'd be nice to pull on the changes for #495 and/or #493 here too.

[notgull]

I was hoping that I could get #488 into shape as well, as well as implement a passable API for Solarish's event ports API so that this crate can be used in polling for all of the *nix backends.

Also, if we're doing breaking changes, is there a way that we can adjust dup2 and dup3's APIs? Having to take an OwnedFd as a parameter hurts them, especially in the case of dup3, where having an option for CLOEXEC is beneficial.

[SUPERCILEX]

Regarding dup, Alan noticed this too: nix-rust/nix#1863 (comment). I couldn't figure out a good way to both require ownership and not force you to pass in the OwnedFd, so I ended up adding

fn dup2_raw<Fd1: AsFd, Fd2: AsRawFd + IntoRawFd>(oldfd: Fd1, newfd: Fd2) -> Result<OwnedFd> {
    let res = unsafe { libc::dup2(oldfd.as_fd().as_raw_fd(), newfd.as_raw_fd()) };
    Errno::result(res).map(|_| unsafe { OwnedFd::from_raw_fd(newfd.into_raw_fd()) })
}

on top of the existing dup2 (and same for dup3). That kind of sucks, but it lets us have two safe interfaces that can be used at different levels of abstraction. Would be cool if there was a better way though!

---

Regarding #493, I just need a final sign-off and I'll send a PR.

[sunfishcode]

By I/O safety, that dup2_raw should be unsafe, because it operates on raw fds (AsRawFd/IntoRawFd are not trustable).

[SUPERCILEX]

Even though it will handle closing the FD for you if it's owned? @ids1024 argued the same position, so I'm probably in the minority and would be fine with it being unsafe. I don't see a way to let you create create FDs out of thin air without raw FDs (well you could indirectly with BorrowedFd, but that would be icky), so that's why I landed on that solution.

[sunfishcode]

RawFd implements AsRawFd and IntoRawFd and it's just an i32 so you can pass in 42 and have it clobbered without knowing who owns 42.

Rustix's answer here is that you can OwnedFd::from_raw_fd if you really want to dup2 to an arbitrary integer.

[sunfishcode]

Rust code is allowed to assume that the identity of a file descriptor does not change without someone having access to the &mut OwnedFd. This is important for safety in several use cases, like mmapping a memfd you previously sealed.

[SUPERCILEX]

Rustix's answer here is that you can OwnedFd::from_raw_fd if you really want to dup2 to an arbitrary integer.

I don't think that's a good solution in the face of errors since you'll need to handle ManuallyDrop and friends yourself.

Rust code is allowed to assume that the identity of a file descriptor does not change without someone having access to the &mut OwnedFd.

This is a compelling argument for dup2_raw being unsafe, I agree now, thx. :)

[ids1024]

Yeah, OwnedFd::from_raw_fd for an fd that isn't open isn't quite right. You want to avoid dropping it, and technically just constructing an OwnedFd from an invalid fd may be considered unsound, though it's unlikely to be implemented in a way that could cause an issues.

If this is needed, having a variant of the function that's unsafe and takes a RawFd is probably best.

[sunfishcode]

If you have a RawFd which is invalid, meaning it's forged and potentially aliasing an OwnedFd somewhere else in the process, then doing a dup2_raw on it is unsound, in general. Constructing a new OwnedFd isn't the problem.

It gets ambiguous in the case where you're doing dup2's in preparation for an exec, and you know all the fds you want to pass to the exec, and you want to just overwrite any other fds that might be in the way. Ordinarily that should be considered unsound. At the same time, this is the main use case for dup2. So we need some rule to say it's ok in this specific case, and we don't yet have it.

[sunfishcode]

I filed #497 to discuss I/O safety for this dup2 issue.

[ids1024]

Constructing a new OwnedFd isn't the problem.

It shouldn't be unsound as implemented, or probably in any reasonable future implementation of std, but I'm just noting that you technically violate what OwnedFd::from_raw_fd says is required for safety:

Safety
The fd passed in must be a valid and open file descriptor.

Safety
The resource pointed to by fd must be open and suitable for assuming ownership. The resource must not require any cleanup other than close.

And it just isn't quite right semantically, since an fd that isn't open isn't what an OwnedFd is supposed to represent.

[sunfishcode]

And it just isn't quite right semantically, since an fd that isn't open isn't what an OwnedFd is supposed to represent.

It isn't known to be sound to pass in what you believe is a fd that isn't open to dup2_raw, because in general you don't know what file descriptors are open elsewhere in the process. So the OwnedFd::from_raw_fd requirement reflects what is currently known to be sound.

That doesn't cover everything that people expect to be able to do with dup2_raw, but that's where #497 comes in.

[SUPERCILEX]

On a different but breaking-ish topic, are we sure we want statx to to check for its own availability? I'm not a big fan of that because it bumps up codegen for everyone even if they don't care about compatibility with 4.x kernels. The rationale for this check is that the stdlib does this, so rustix should too. I don't believe this transitivity holds. The stdlib does this because it must be able to stat and would like to do so more efficiently when possible. On the other hand, Rustix offers all the stat functions, so developers choose which ones they want.

I think if statx gets special treatment, then a minimum kernel version should be chosen and all syscalls (such as io uring) should be using this pattern. But again, I don't think that's a good idea since everyone will have different min kernel versions and it'll be a perf hit. If people really want this, I think the better approach would be to write a wrapper library that does this.

Thoughts?

[sunfishcode]

Yeah, I'm open to making changes here.

Creating a whole extra library just to do "don't call statx again if it's just going to ENOSYS", a common need, is inconvenient. Would it work for you to rename the existing statx to statx_if_avail or so, and then add a new regular statx which doesn't do the extra code?

(io_uring is a different situation because if you don't have io_uring, you typically take a completely different path and never try to call it again)

[SUPERCILEX]

io_uring is a different situation because if you don't have io_uring, you typically take a completely different path and never try to call it again

Fair point, but what about openat2 or copy_file_range?

And yeah, I agree that a sperate lib would be a pain, but duplicating every function in the public API also seems unpleasant. Maybe we can use features for this? You could say "assume kernel x.x or later". Or maybe we can provide a macro keyed by the name of the syscall that wraps an arbitrary function returning the rustix result?

I think I'd vote for either the feature gate idea or yours (though I worry about the API complexity).