Support linux namespace clone flags

[folly.git] / folly / Subprocess.h

diff --git a/folly/Subprocess.h b/folly/Subprocess.h
index 44e3fad6b08cbfd8e85ff7a21e010600d06e17df..86ca6bfecb80ecc7575b1c859c9d04812d1c8e98 100644 (file)
--- a/folly/Subprocess.h
+++ b/folly/Subprocess.h
@@ -112,11 +112,12 @@
 #include <folly/File.h>
 #include <folly/FileUtil.h>
 #include <folly/Function.h>
-#include <folly/gen/String.h>
-#include <folly/io/IOBufQueue.h>
 #include <folly/MapUtil.h>
+#include <folly/Optional.h>
 #include <folly/Portability.h>
 #include <folly/Range.h>
+#include <folly/gen/String.h>
+#include <folly/io/IOBufQueue.h>
 
 namespace folly {
 
@@ -397,6 +398,29 @@ class Subprocess {
       return *this;
     }
 
+#if __linux__
+    /**
+     * This is an experimental feature, it is best you don't use it at this
+     * point of time.
+     * Although folly would support cloning with custom flags in some form, this
+     * API might change in the near future. So use the following assuming it is
+     * experimental. (Apr 11, 2017)
+     *
+     * This unlocks Subprocess to support clone flags, many of them need
+     * CAP_SYS_ADMIN permissions. It might also require you to go through the
+     * implementation to understand what happens before, between and after the
+     * fork-and-exec.
+     *
+     * `man 2 clone` would be a starting point for knowing about the available
+     * flags.
+     */
+    using clone_flags_t = uint64_t;
+    Options& useCloneWithFlags(clone_flags_t cloneFlags) noexcept {
+      cloneFlags_ = cloneFlags;
+      return *this;
+    }
+#endif
+
     /**
      * Helpful way to combine Options.
      */
@@ -414,6 +438,11 @@ class Subprocess {
     bool processGroupLeader_{false};
     DangerousPostForkPreExecCallback*
       dangerousPostForkPreExecCallback_{nullptr};
+#if __linux__
+    // none means `vfork()` instead of a custom `clone()`
+    // Optional<> is used because value of '0' means do clone without any flags.
+    Optional<clone_flags_t> cloneFlags_;
+#endif
   };
 
   static Options pipeStdin() { return Options().stdinFd(PIPE); }