std::process::Command does not work properly with less privileged children accessing stdin/stdout/stderr file descriptors

[TaaviE]

I tried this code:

use std::io::Write;
use std::os::unix::process::CommandExt;
use std::process::{Command, Stdio};

fn main() {
    let mut command = Command::new("/bin/cat");
    command.arg("/dev/fd/0")
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .uid(35565)
        .gid(35565);

    let mut child = command.spawn().unwrap();
    child.stdin.take().unwrap().write_all("foo".as_ref()).unwrap();
}

Tokio version:

use std::process::Stdio;

use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::process::Command;

#[tokio::main]
async fn main() {
    tokio::task::spawn(async move {
        let mut command = Command::new("/bin/cat");
        command.arg("/dev/fd/0")
            .stdin(Stdio::piped())
            .stdout(Stdio::piped())
            .stderr(Stdio::piped())
            .uid(35565)
            .gid(35565);

        let mut child = command.spawn().unwrap();
        child.stdin.take().unwrap().write_all("foo".as_ref()).await.unwrap();
    });
}

I expected to see this happen:
The child process opens and reads it's stdin.

Instead, this happened:
The child process was unable to read it's stdin fd.

Meta

I've asked around about this issue in other places and it seems that it's Linux quirk that the Rust standard library does not handle. Neither does there seem to be a proper way to handle it (nor do I know how to safely work around stdlib).

• https://superuser.com/a/1699427
• tokio::process::Command does not work properly with less privileged children accessing stdin/stdout/stderr file descriptors tokio-rs/tokio#6193
• https://users.rust-lang.org/t/letting-child-process-read-stdin-after-dropping-privileges/90860

rustc --version --verbose:

rustc 1.74.1 (a28077b28 2023-12-04)

[the8472]

Maybe the anonymous pipes can be fchowned when changing process uid. No idea if that works.

(nor do I know how to safely work around stdlib).

you could try that in a pre_exec hook.