Subject: bug#78757: shepherd: dangling file descriptor to /dev/console

From: Ludovic Courtès <[email-masked]>
Date: Sat, 14 Jun 2025 00:47:56 +0200

Hi burban,

burban--- via Bug reports for GNU Guix <[email-masked]> writes:

> All shepherd children have an open file descriptor to /dev/console,
> probably because of the use of dup2 (and not dup3) in system.scm.

I checked the /proc/PID/fd directory of several of my system services on
Guix System (nscd, guix-publish, ntpd, upower-daemon) and I don’t see
any file descriptor pointing to /dev/console, with version 1.0.5.

You said you’re on Debian; which version of the Shepherd is it?

I also don’t see any ‘dup2’ call in ‘system.scm’; this takes place
rather in ‘service.scm’.

> The pb. disapears if I force that flag with that code before I define
> my services (context: shepherd used as init system on Debian):
> (port-for-each (lambda (x)
>                  (catch #t
> 		   (lambda ()
> 		     (when (= (fcntl x F_GETFD) 0)
> 		       (fcntl x F_SETFD FD_CLOEXEC)
> 		       (format #t "FD_CLOEXEC flag set on port ~a (fd: ~a)\n" x (port->fdes x))))
> 		   (lambda (keys . args) (format #t "fcntl error for port ~a\n" x)))
> 		 ))

‘shepherd’ marks all previously-opened FDs as O_CLOEXEC upfront—see
‘mark-as-close-on-exec’ in ‘shepherd.scm’.  Those opened later are
opened with O_CLOEXEC, except for user code that explicitly omits the
O_CLOEXEC flag.

Thanks,
Ludo’.