dante 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa7b32fa2eed7d038ee4835edd3155967b25f62360ba553c1f153004c8ccf0f6
-  data.tar.gz: 8e4d92c8ade70fd93d399744324de5205dbdb8c9f3b4c25a4b2445d0857a56d8
+  metadata.gz: 91147e1905316ceab12eff8d686555b8f2daa27d81d5065ab11d9b44e8594a2a
+  data.tar.gz: 2d385615f43931b2f3375dce1a32ccaa6655111722e208461adb44e850e26435
 SHA512:
-  metadata.gz: 97423c3af18736da37830316eee8ade12cf3d1205ec158a70743a65ceb99e9df9f6268ff7e3946aa66808e93eb7c2c38550ee647c8dff874dd796aa4b815fa7c
-  data.tar.gz: 30d083e38a48c5a6d64c9a0af91a441c577199b833c38176d0bc4f470b1fd7a2861d6fa95f998c9f690203e6e039f1670abc73939db5c0fcc7b383112eee48b4
+  metadata.gz: 22daf007c266f02863001eaca06415e7ab8711083e9cde13fee5be196f4fbeae5af9382fc58410952df1ad8702c3cb1d2caa3f1a47faf971740973c2656a729d
+  data.tar.gz: b06a655e3de739bb52ec35163d6000bed1903c83a7ee37639ff5cf5e43edaf7a65074e902612c36d5b92008db51289400031a4c6c6c7dbe03dca294871fc26cb

data/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

data/.github/workflows/ci.yml

@@ -18,9 +18,9 @@ jobs:
         ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1.336.0
       with:
         ruby-version: ${{ matrix.ruby-version }}
         bundler-cache: true # runs 'bundle install' and caches installed gems automatically

data/.github/workflows/github-release.yml

@@ -0,0 +1,69 @@
+# Creates the GitHub release page for a tag that already exists, with GitHub's generated notes (merged
+# PRs and new contributors since the previous release) after a link to CHANGELOG.md as of that tag (the
+# default branch's for an old tag that has none).
+# release.yml runs it after it publishes; "Run workflow" here (with the tag) creates the page for an
+# earlier release. A tag that already has a release is left alone, so running it twice is harmless.
+# A tag that isn't the newest vX.Y.Z tag is created with --latest=false; the API otherwise marks every
+# new release as Latest.
+
+name: github-release
+run-name: github release ${{ inputs.tag }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'An existing tag, e.g. v1.2.0'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  release-page:
+    if: github.repository == 'nesquena/dante'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # creates the release
+    steps:
+      - name: Create the GitHub release
+        shell: bash -eo pipefail {0}
+        env:
+          TAG: ${{ inputs.tag }}
+          CHANGELOG: CHANGELOG.md
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::'$TAG' is not a tag like v1.2.3"; exit 1; }
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "$TAG already has a release; leaving it alone"
+            exit 0
+          fi
+          # Compare with the newest vX.Y.Z tag rather than the "Latest" release, so a failed lookup stops the
+          # step (pipefail) instead of letting an older tag become Latest
+          newest=$(gh api --paginate "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" --jq '.[].ref' |
+            sed -nE 's#^refs/tags/(v[0-9]+\.[0-9]+\.[0-9]+)$#\1#p' | sort -V | tail -n 1) ||
+            { echo "::error::could not list the repository's tags"; exit 1; }
+          [ -n "$newest" ] || { echo "::error::found no vX.Y.Z tag (is $TAG pushed?)"; exit 1; }
+          flags=()
+          if [ "$newest" != "$TAG" ]; then
+            echo "$TAG is not the newest tag ($newest): not marking it as latest"
+            flags=(--latest=false)
+          fi
+          # Link the changelog as of the tag, or the default branch's for an old tag without one. Any error
+          # but a 404 stops the step.
+          ref=$TAG
+          if ! err=$(gh api "repos/$GITHUB_REPOSITORY/contents/$CHANGELOG?ref=$TAG" --silent 2>&1 >/dev/null); then
+            [[ "$err" == *"HTTP 404"* ]] || { echo "::error::could not look up $CHANGELOG at $TAG: $err"; exit 1; }
+            echo "$TAG has no $CHANGELOG; linking the default branch's"
+            ref=HEAD
+          fi
+          # --verify-tag: refuse rather than create the tag. With --generate-notes, GitHub puts these notes
+          # before the generated ones.
+          gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$TAG" --generate-notes "${flags[@]}" \
+            --notes "What changed, and what to do when upgrading: [$CHANGELOG](https://github.com/$GITHUB_REPOSITORY/blob/$ref/$CHANGELOG)."

data/.github/workflows/release.yml

@@ -10,9 +10,11 @@
 # which rebuilds) resumes a release that stopped partway.
 # If the gem is pushed but the tag step keeps failing, push the tag by hand at the built commit: that
 # tag push's run skips the push (same sum).
+# Then github-release.yml creates the GitHub release page for the tag (it can also be run by hand for
+# an earlier tag).
 #
-# Dry run: tick dry_run to check the wiring. Everything runs except the changelog checks, the tag and
-# the push; the credential exchange fails unless the trusted publisher is set up.
+# Dry run: tick dry_run to check the wiring. Everything runs except the changelog checks, the tag, the
+# push and the release page; the credential exchange fails unless the trusted publisher is set up.
 #
 # The "release" environment's protection rules are the ONLY gate on publishing (required reviewer, no
 # admin bypass, deployments only from master and v*.*.* tags): RubyGems trusts any run of this file
@@ -208,3 +210,12 @@ jobs:
           else
             echo "::error::tag $TAG is not at $GITHUB_SHA (now: $tagged)"; exit 1
           fi
+
+  release-page:
+    needs: [build, publish]
+    if: ${{ !inputs.dry_run }}
+    permissions:
+      contents: write   # github-release.yml creates the release
+    uses: ./.github/workflows/github-release.yml
+    with:
+      tag: ${{ needs.build.outputs.tag }}

data/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## 0.4.0 (2026-11-01)
+
+Changes since 0.3.0:
+
+- Fixed: the daemon writes its pid file to a new file in the same directory and renames it into place, so a
+  symlink or another file already at the pid file's path is replaced instead of written through, and a reader
+  never sees a half-written pid file. The pid file now always belongs to the daemon's user, with mode 0666 less
+  the umask; an existing pid file used to keep its owner and mode. In a directory the daemon's user cannot write
+  (a pid file an init script created and handed to that user, say), it writes the existing pid file in place as
+  before, except through a symlink. **What to do:** if another user's tool reads the pid file (a monitor such as
+  god), start the daemon with a umask that leaves it readable (022 gives 0644). (#31, @nesquena)
+- Fixed: stopping (`-k`, `stop`) and `daemon_running?` ignore a pid file that another user could have written to
+  have the process it names stopped: a symlink, a file with other hard links, or a file owned by neither root, nor
+  the user stopping, nor any of the uids the process runs as. A stop then keeps the pid file and returns false,
+  saying "No <name> processes are running" for a symlink and why for the others (for one, "pid file X is owned by
+  uid A but process P belongs to uid B; not stopping it"), and a start goes ahead and replaces the pid file. The owner is checked through `/proc` (Linux); elsewhere only symlinks and
+  hard links are. **What to do:** nothing for pid files the daemon writes itself, including a daemon started with
+  `sudo ... -u nobody` and stopped with `sudo ... -k`; a pid file written by another tool must be a plain file
+  belonging to root or to the daemon's user. (#31, @nesquena)
+- Fixed: the log file is no longer given mode 0644 at every start. An existing log file keeps its mode (through a
+  symlinked log path, so does the file it points to), and a new one is created with mode 0644 less the umask:
+  0644 with the usual umask of 022, 0640 with 027. **What to do:** for a log file other users can read under a
+  stricter umask, create it with the mode you want before starting, or set the umask. (#31, @nesquena)
+- New `:argv` option: `Dante::Runner.new(name, :argv => [...])`, `Dante.run(name, :argv => [...])` or
+  `execute(:argv => [...])` parses the options in that array instead of `ARGV`, so dante can run inside a program
+  that has options of its own (a test runner, for one) without failing on them; `:argv => []` parses nothing. The
+  array is not changed. Without `:argv`, `ARGV` is parsed as before. Reported by @neomantic-zz in #4.
+  (#33, @nesquena)
+- Fixed: a daemon's standard input is now `/dev/null`. It stayed on the terminal or pipe it was started from, so a
+  daemon reading stdin read the user's keystrokes, and a terminal or pty that started it never saw end-of-file
+  while the daemon ran. (#30, @nesquena)
+- Fixed: stopping (`-k`, `stop`) reads the pid file once, then signals and waits for that daemon, and removes the
+  pid file only if it still names it. Two stops at once no longer fail with `Errno::ENOENT`; a new daemon that
+  records its pid while an old one stops keeps its pid file, and `--force` no longer sends it SIGKILL. A pid file
+  path containing `[`, `*` or `?` can now be stopped. The `-k` help text now says what it does: it stops the daemon
+  in the pid file, and ignores its optional argument. (#30, @nesquena)
+- Fixed: stopping checks whether the daemon has exited every 0.1 seconds instead of every second, so `-k` returns
+  as soon as the daemon has stopped rather than after a second at least. It still waits up to 5 seconds (and 5
+  more with `--force`). (#30, @nesquena)
+- Fixed: `:kill => false` and `:restart => false` passed to `execute` are now off. Before, giving either key at
+  all stopped the daemon (`:kill`) or stopped and restarted it (`:restart`), whatever its value. `:kill => nil`, as
+  `-k` sets it, still stops. (#30, @nesquena)
+- Fixed: `:daemonize => false` with a `:log_path` now writes the output to the log file, as leaving `:daemonize`
+  out does; before, the log path was ignored. (#30, @nesquena)
+- Fixed: `Runner#restart` starts the service as a daemon when `:daemonize` is set, as `execute` does; it used to
+  run it in the foreground, in the calling process. **What to do:** to keep running the service in the calling
+  process, call `restart` on a runner without `:daemonize`. (#30, @nesquena)
+- For subclasses of `Dante::Runner`: `stop` now reads the pid file and checks the process itself instead of calling
+  `daemon_running?` and `daemon_stopped?`, and the protected `kill_pid` and `wait_for_stop` now take the pid first
+  (`kill_pid(pid, k, sig)`, `wait_for_stop(pid, signalled)`). (#30, @nesquena)
+- Documentation: the README's `-u nobody -G nogroup` example now gives pid and log paths that user can write (with
+  the defaults, the daemon failed to start), says what `-k` and `-f`/`--force` do, lists all the options, and adds
+  the requirements (MRI on Unix, for `fork`), running under systemd, and log rotation with `copytruncate` (SIGHUP
+  stops the daemon). (#30, @nesquena)
+- The gemspec links the source code, this changelog and the issue tracker (shown on rubygems.org), and sets
+  `rubygems_mfa_required`, so pushes of the gem to rubygems.org now require MFA. (#30, @nesquena)
+
 ## 0.3.0 (2026-10-31)
 
 Changes since 0.2.0:

data/README.md

@@ -10,6 +10,11 @@ can be started via command line or start/stop a daemon, and will store a pid fil
 If you need to create a ruby executable and you want standard daemon start/stop with pid files
 and no hassle, this gem will be a great way to get started.
 
+## Requirements
+
+Dante daemonizes with `fork`, so it needs MRI (CRuby) 2.7 or newer on Unix: Linux, macOS or a BSD. It does not
+run on Windows or JRuby, which have no `fork`.
+
 ## Installation
 
 Add to your Gemfile:
@@ -81,24 +86,54 @@ All stdout and stderr will be redirected to the specified logfile. If no logfile
 stdout and stderr will be directed to /var/log/<myapp name>.log.
 
 ```
-./bin/myapp -d -u nobody -G nogroup
+sudo install -d -o nobody -g nogroup /var/run/myapp /var/log/myapp
+sudo ./bin/myapp -d -u nobody -G nogroup -P /var/run/myapp/myapp.pid -l /var/log/myapp/myapp.log
 ```
 
 will switch to the user nobody before starting, with the group given by `-G`. When started as root, the group
 defaults to the user's primary group, and the process takes on the user's supplementary groups (plus the `-G`
-group, if given).
+group, if given). The switch happens before the pid file and the log file are written, so both must be in
+directories that user can write: the defaults, `/var/run/myapp.pid` and `/var/log/myapp.log`, are not, and the
+daemon would fail to start. Keep the pid file and the log in directories that only the daemon's user (or root) can
+write, never in one that other users can write, such as `/tmp`: another user could put a file or a symlink of
+their own at that path. On most Linux systems `/var/run` is emptied at boot, so create its directory at each boot
+(systemd's `RuntimeDirectory=`, below, or a `tmpfiles.d` entry) rather than once.
 
 ```
 ./bin/myapp -k -P /var/run/myapp.pid
 ```
 
-will stop all daemonized processes for the specified pid file.
+will stop the daemon whose pid is in the specified pid file: it sends SIGTERM, waits up to 5 seconds for the
+daemon to exit, and then removes the pid file. If the daemon is still running, it says "Failed to kill daemonized
+process" and keeps the pid file.
+
+```
+./bin/myapp -k -f -P /var/run/myapp.pid
+```
+
+will do the same, and if the daemon survives SIGTERM, send it SIGKILL (`-f`/`--force`, or `:force => true`) and
+wait up to 5 more seconds.
 
 ```
 ./bin/myapp --help
 ```
 
-Will return a useful help banner message explaining the simple usage.
+Will return a useful help banner message explaining the simple usage. These are all the built-in options:
+
+```
+    -p, --port PORT           Specify port
+                              (default: )
+    -P, --pid FILE            save PID in FILE when using -d option.
+                              (default: /var/run/myapp.pid)
+    -d, --daemon              Daemonize mode
+    -l, --log FILE            Logfile for output
+                              (default: /var/log/myapp.log)
+    -k, --kill [PORT]         Stop the daemon in the pid file (PORT is ignored)
+    -u, --user USER           User to run as
+    -G, --group GROUP         Group to run as
+    -f, --force               Force kill if SIGTERM fails
+    -?, --help                Display this usage information.
+```
 
 ### Advanced
 
@@ -158,6 +193,83 @@ Dante::Runner.new('gitdocs').execute(:daemonize => true, :restart => true, :pid_
 
 so you can use dante as part of a more complex CLI executable.
 
+### Options from somewhere other than ARGV
+
+`execute` parses the command-line options in `ARGV`. Inside a program that has options of its own (a test runner,
+say, or a Rake task), pass dante the options to parse with `:argv` instead, to `Dante::Runner.new`, `Dante.run`
+or `execute`:
+
+```ruby
+# parses only these, and leaves ARGV alone
+Dante::Runner.new('gitdocs', :argv => ['-d', '-P', @pid]).execute { something! }
+# parses nothing
+Dante::Runner.new('gitdocs').execute(:argv => [], :daemonize => true, :pid_path => @pid) { something! }
+```
+
+Without `:argv`, ARGV is parsed as before, and the options dante knows are removed from it. The array given as
+`:argv` is never changed.
+
+## systemd
+
+Under systemd, let systemd run the process in the foreground (`Type=simple`), as the user it names, with the
+output going to the journal:
+
+```ini
+# /etc/systemd/system/myapp.service
+[Unit]
+Description=myapp
+After=network.target
+
+[Service]
+Type=simple
+User=myapp
+Group=myapp
+ExecStart=/path/to/myapp/bin/myapp -p 8080
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+```
+
+systemd stops it with SIGTERM, which dante handles. To have dante daemonize instead, use `Type=forking` with the
+pid file and the log in directories systemd creates for that user:
+
+```ini
+[Service]
+Type=forking
+User=myapp
+Group=myapp
+RuntimeDirectory=myapp
+LogsDirectory=myapp
+PIDFile=/run/myapp/myapp.pid
+ExecStart=/path/to/myapp/bin/myapp -d -p 8080 -P /run/myapp/myapp.pid -l /var/log/myapp/myapp.log
+Restart=on-failure
+```
+
+Use `User=` and `Group=` rather than `-u` and `-G` under systemd, so that the process starts as that user and the
+directories systemd creates belong to it.
+
+## Log rotation
+
+The daemon opens its log file once, for appending, and has no SIGHUP handler: SIGHUP stops it. So rotate the log
+with logrotate's `copytruncate`, rather than a `postrotate` script that sends SIGHUP:
+
+```
+# /etc/logrotate.d/myapp
+/var/log/myapp/myapp.log {
+  weekly
+  rotate 4
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+```
+
+`copytruncate` copies the log and empties it in place, and the daemon carries on writing at the start of the
+emptied file. Lines written between the copy and the truncation are lost.
+
 ## God
 
 Dante can be used well in conjunction with the excellent God process manager. Simply, use Dante to daemonize a process

data/dante.gemspec

@@ -11,6 +11,12 @@ Gem::Specification.new do |s|
   s.summary     = %q{Turn any process into a demon}
   s.description = %q{Turn any process into a demon.}
   s.license     = "MIT"
+  s.metadata    = {
+    "source_code_uri"       => "https://github.com/nesquena/dante",
+    "changelog_uri"         => "https://github.com/nesquena/dante/blob/master/CHANGELOG.md",
+    "bug_tracker_uri"       => "https://github.com/nesquena/dante/issues",
+    "rubygems_mfa_required" => "true"
+  }
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")

data/lib/dante/runner.rb

@@ -47,26 +47,29 @@ module Dante
       @with_options = block
     end
 
-    # Executes the runner based on options
+    # Executes the runner based on options, after parsing the command-line options in
+    # options[:argv] (given to new or execute), or else in ARGV
     # @runner.execute
     # @runner.execute { ... }
     def execute(opts={}, &block)
+      options[:argv] = opts[:argv] if opts.key?(:argv) # needed before the rest of opts is merged
       parse_options
       self.options.merge!(opts)
 
       @verify_options_hook.call(self.options) if @verify_options_hook
 
-      if options.include?(:kill)
+      # A key given as false is off; -k with no argument sets :kill to nil, which is on.
+      if options.fetch(:kill, false) != false
         self.stop
       else # create process
-        self.stop if options.include?(:restart)
+        self.stop if options.fetch(:restart, false) != false
 
         # If a username, uid, groupname, or gid is passed,
         # drop privileges accordingly.
         switch_user(options[:user], options[:group]) if options[:user] || options[:group]
 
         @startup_command = block if block_given?
-        options[:daemonize] ? daemonize : start
+        start_service
       end
     end
 
@@ -89,6 +92,7 @@ module Dante
             trap_signals
             store_pid(Process.pid)
             redirect_output!
+            reopen_stream(IO.for_fd(0, autoclose: false), File::NULL, 'r') # fd 0, whatever STDIN or $stdin is
             start
           end
           started = daemon_survives?(daemon)
@@ -130,26 +134,31 @@ module Dante
     def start
       log "Starting #{@name} service..."
 
-      if log_path = options[:log_path] && options[:daemonize].nil?
-         redirect_output! 
-      end
+      # A daemon has redirected its output already
+      redirect_output! if options[:log_path] && !options[:daemonize]
 
       trap_signals
 
       @startup_command.call(self.options) if @startup_command
     end
 
-    # Stops a daemonized process
+    # Stops a daemonized process. The pid file is read once: the daemon it names then is
+    # the one signalled and waited for, whatever the pid file says by the time it stops.
     def stop(kill_arg=nil)
-      if self.daemon_running?
-        if wait_for_stop(kill_pid(kill_arg || options[:kill]))
-          FileUtils.rm options[:pid_path] # Only kill if we stopped the daemon
+      pid, pid_file_stat = read_pid_file(options[:pid_path])
+      running = pid && process_running?(pid)
+      if running && (untrusted = untrusted_pid_file(pid, pid_file_stat))
+        log "#{untrusted}; not stopping it"
+        false
+      elsif running
+        if wait_for_stop(pid, kill_pid(pid, kill_arg || options[:kill]))
+          remove_pid_file(pid) # Only once the daemon has stopped
           log "Daemonized process killed after term."
         else
           log "Failed to kill daemonized process"
           if options[:force]
-            if wait_for_stop(kill_pid(kill_arg || options[:kill], 'KILL'))
-              FileUtils.rm options[:pid_path] # Only kill if we stopped the daemon
+            if wait_for_stop(pid, kill_pid(pid, kill_arg || options[:kill], 'KILL'))
+              remove_pid_file(pid) # Only once the daemon has stopped
               log "Daemonized process killed after kill."
             end
           end
@@ -162,7 +171,7 @@ module Dante
 
     def restart
       self.stop
-      self.start
+      start_service
     end
 
     def interrupt
@@ -179,21 +188,22 @@ module Dante
       ! self.daemon_running?
     end
 
-    # Returns running for the daemonized process
+    # Returns running for the daemonized process. A pid file that another user could have
+    # written (see untrusted_pid_file) names no daemon.
     # self.daemon_running?
     def daemon_running?
-      return false unless File.exist?(options[:pid_path])
-      return false unless pid = read_pid(options[:pid_path])
-      Process.kill 0, pid
-      true
-    rescue Errno::EPERM # the process exists but belongs to another user
-      true
-    rescue Errno::ESRCH
-      false
+      pid, pid_file_stat = read_pid_file(options[:pid_path])
+      return false unless pid
+      process_running?(pid) && !untrusted_pid_file(pid, pid_file_stat)
     end
 
     protected
 
+    # Starts the service: as a daemon with :daemonize, else in the foreground.
+    def start_service
+      options[:daemonize] ? daemonize : start
+    end
+
     def parse_options
       headline = [@name, @description].compact.join(" - ")
       OptionParser.new do |opts|
@@ -219,7 +229,7 @@ module Dante
           options[:log_path] = v
         end
 
-        opts.on("-k", "--kill [PORT]", String, "Kill specified running daemons - leave blank to kill all.") do |v|
+        opts.on("-k", "--kill [PORT]", String, "Stop the daemon in the pid file (PORT is ignored)") do |v|
           options[:kill] = v
         end
 
@@ -242,7 +252,7 @@ module Dante
         
         # Load options specified through 'with_options'
         instance_exec(opts, &@with_options) if @with_options
-      end.parse!
+      end.parse!(options[:argv] ? options[:argv].dup : ARGV) # a copy of the caller's array
       options
     end
 
@@ -293,9 +303,30 @@ module Dante
       }
     end
 
+    # Writes pid to a new file in the pid file's directory and renames it into place, so
+    # that whatever was at the pid file's path (a symlink, or another file) is replaced
+    # rather than written into, and a reader sees either the old pid file or the whole new
+    # one. In a directory the daemon cannot write, it writes the pid file there already.
     def store_pid(pid)
-      FileUtils.mkdir_p(File.dirname(options[:pid_path]))
-      File.open(options[:pid_path], 'w'){|f| f.write("#{pid}\n")}
+      pid_path = options[:pid_path]
+      FileUtils.mkdir_p(File.dirname(pid_path))
+      tmp_path = "#{pid_path}.#{pid}.tmp"
+      FileUtils.rm_f(tmp_path) # one left by a crash (a symlink is removed, not followed)
+      begin
+        # EXCL: never written through a file or symlink put there since
+        File.open(tmp_path, File::WRONLY | File::CREAT | File::EXCL) { |f| f.write("#{pid}\n") }
+      rescue Errno::EACCES
+        # A pid file made for the daemon's user in a directory it cannot write, as an init
+        # script might. Without CREAT, a missing one fails, as it did before.
+        # ceiling: not atomic, so a reader can see it half-written; giving the daemon's user
+        # the directory restores the rename.
+        tmp_path = nil
+        File.open(pid_path, File::WRONLY | File::TRUNC | File::NOFOLLOW) { |f| f.write("#{pid}\n") }
+        return
+      end
+      File.rename(tmp_path, pid_path)
+    ensure
+      FileUtils.rm_f(tmp_path) if tmp_path # left only when writing or renaming failed
     end
 
     # Whether daemon, a child of this process, is still running START_GRACE seconds after
@@ -320,38 +351,77 @@ module Dante
     end
 
     # Removes the pid file if it still holds pid (another start may have replaced it).
+    # ceiling: the read and the delete are two steps, so a daemon that writes its pid between them loses its
+    # pid file; a lock on the pid file (flock) would close that window
     def remove_pid_file(pid)
       File.delete(options[:pid_path]) if read_pid(options[:pid_path]) == pid
     rescue Errno::ENOENT
     end
 
-    # The pid in pid_file, or nil when it holds none: a pid file left empty by a crash
-    # between creating and writing it names no process (and pid 0 or a negative pid would
-    # signal a whole process group), nor does a number too large for a pid_t.
+    # The pid in pid_file, or nil when there is none: no pid file, or one left empty by a
+    # crash between creating and writing it, names no process (and pid 0 or a negative pid
+    # would signal a whole process group), nor does a number too large for a pid_t.
     def read_pid(pid_file)
-      pid = File.read(pid_file).to_i
-      pid if pid > 0 && pid < 2**31
+      read_pid_file(pid_file)&.first
     end
 
-    # Sends sig to the daemons, and returns whether it reached any of them.
-    def kill_pid(k='*', sig='TERM')
-      Dir[options[:pid_path]].count do |f|
-        begin
-          next false unless pid = read_pid(f)
-          Process.kill(sig, pid)
-          log "Sent SIG#{sig} to PID: #{pid} at #{f}"
-          true
-        rescue => e
-          log "Failed to stop! #{k}: #{e}"
-          false
-        end
-      end > 0
+    # The pid in pid_file, as read_pid gives it, and the pid file's File::Stat, both from
+    # the one file opened; nil without a pid. A symlink is not followed, and names no pid
+    # (a start replaces it).
+    def read_pid_file(pid_file)
+      return unless File.exist?(pid_file)
+      File.open(pid_file, File::RDONLY | File::NOFOLLOW) do |file|
+        pid = file.read.to_i
+        [pid, file.stat] if pid > 0 && pid < 2**31
+      end
+    rescue Errno::ENOENT, Errno::ELOOP # removed since the check, or a symlink
+    end
+
+    # Why the pid file, with File::Stat pid_file_stat, cannot be trusted to name pid, its
+    # daemon: it has other hard links (which keep the owner of the file they link to), or
+    # it is owned by neither root, nor a user that pid runs as (any of its uids), nor the
+    # user running this (whose own permissions are all a stop could use), so another user
+    # could have written it to have that process stopped. nil when it can be trusted, or
+    # when the owner of pid cannot be told (it has gone, say).
+    # ceiling: the owner of a process is read from /proc (Linux); elsewhere only the hard
+    # links are checked. `ps -o ruid=,uid= -p PID` would tell the owner on other Unixes.
+    def untrusted_pid_file(pid, pid_file_stat)
+      return "pid file #{options[:pid_path]} has other hard links" if pid_file_stat.nlink > 1
+      pid_file_uid = pid_file_stat.uid
+      return if pid_file_uid == 0 || pid_file_uid == Process.euid
+      uids = File.read("/proc/#{pid}/status")[/^Uid:(.*)$/, 1] or return # no Uid line
+      process_uids = uids.split.map { |uid| Integer(uid) } # real, effective, saved, filesystem
+      return if process_uids.include?(pid_file_uid)
+      "pid file #{options[:pid_path]} is owned by uid #{pid_file_uid} but process #{pid} belongs to uid #{process_uids.first}"
+    rescue SystemCallError # no /proc
+    end
+
+    # Whether pid is a running process, counting one that belongs to another user.
+    def process_running?(pid)
+      Process.kill 0, pid
+      true
+    rescue Errno::EPERM # the process exists but belongs to another user
+      true
+    rescue Errno::ESRCH
+      false
+    end
+
+    # Sends sig to pid, the daemon, and returns whether it reached it.
+    def kill_pid(pid, k, sig='TERM')
+      Process.kill(sig, pid)
+      log "Sent SIG#{sig} to PID: #{pid} at #{options[:pid_path]}"
+      true
+    rescue => e
+      log "Failed to stop! #{k}: #{e}"
+      false
     end
 
-    # Waits for the daemon to stop once a signal reached it. When none did (the daemon
-    # belongs to another user), it cannot stop, so this only checks once.
-    def wait_for_stop(signalled)
-      signalled ? until_true(MAX_START_TRIES) { self.daemon_stopped? } : self.daemon_stopped?
+    # Waits for pid, the daemon, to stop once a signal reached it, checking every 0.1
+    # seconds (a Rational step, so the steps add up to exactly MAX_START_TRIES seconds).
+    # When no signal reached it (the daemon belongs to another user), it cannot stop, so
+    # this only checks once.
+    def wait_for_stop(pid, signalled)
+      signalled ? until_true(MAX_START_TRIES, Rational(1, 10)) { !process_running?(pid) } : !process_running?(pid)
     end
 
     # Redirect output based on log settings (reopens stdout/stderr to specified logfile)
@@ -360,12 +430,10 @@ module Dante
       if log_path = options[:log_path]
         # if the log directory doesn't exist, create it
         FileUtils.mkdir_p File.dirname(options[:log_path]), :mode => 0755
-        # touch the log file to create it
-        FileUtils.touch log_path
-        # Set permissions on the log file
-        File.chmod(0644, log_path)
-        # Reopen $stdout (NOT +STDOUT+) to start writing to the log file
-        reopen_stream($stdout, log_path, 'a')
+        # Reopen $stdout (NOT +STDOUT+) to append to the log file, created with mode 0644
+        # (less the umask) if absent. An existing log file keeps its mode; a symlink is
+        # followed.
+        reopen_stream($stdout, log_path, 'a', 0644)
         # Redirect $stderr to $stdout
         $stderr.reopen $stdout
         $stdout.sync = true
@@ -379,11 +447,11 @@ module Dante
       log_path = options[:log_path] ? options[:log_path] : '/dev/null'
     end
 
-    # Reopens stream onto path, opened with mode. Reopening onto an open File rather
-    # than a path works whatever mode the stream itself was opened with (a socket, for
-    # one, when run under Spring or Zeus).
-    def reopen_stream(stream, path, mode)
-      File.open(path, mode) { |file| stream.reopen(file) }
+    # Reopens stream onto path, opened with mode (and created with perm). Reopening onto
+    # an open File rather than a path works whatever mode the stream itself was opened
+    # with (a socket, for one, when run under Spring or Zeus).
+    def reopen_stream(stream, path, mode, perm=0666)
+      File.open(path, mode, perm) { |file| stream.reopen(file) }
     end
 
     # Runs until the block condition is met or the timeout_seconds is exceeded

data/lib/dante/version.rb

@@ -1,3 +1,3 @@
 module Dante
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/test/runner_test.rb

@@ -1,3 +1,4 @@
+require 'stringio'
 require File.expand_path('../test_helper', __FILE__)
 require 'socket'
 
@@ -38,6 +39,20 @@ describe "dante runner" do
     end
   end # no daemonize
 
+  describe "with daemonize set to false and a log file" do
+    it "writes its output to the log file" do
+      logfile = tmp_path('dante-foreground.log')
+      capture_stdout {
+        pid = fork do
+          Dante::Runner.new('test-process', :daemonize => false, :log_path => logfile) { puts "Started" }.execute
+          exit!(0)
+        end
+        Process.wait(pid) }
+
+      assert_equal "Started\n", (File.read(logfile) if File.exist?(logfile))
+    end
+  end # daemonize false
+
   describe "with daemonize flag" do
     before do
       @process = TestingProcess.new('b', @tmpdir)
@@ -255,11 +270,82 @@ describe "dante runner" do
       assert_equal "640", "%o" % (File.stat(@created).mode & 0777)
     end
 
-    it "still gives the log file mode 0644" do
-      assert_equal 0644, File.stat(@logfile).mode & 0777
+    it "creates the log file with mode 0644 less the umask" do
+      assert_equal "640", "%o" % (File.stat(@logfile).mode & 0777)
     end
   end # umask
 
+  describe "with daemonize flag and something at the pid file's path already" do
+    before do
+      @pid_path = tmp_path('dante.pid')
+      @other = tmp_path('other-file')
+      File.write(@other, "not a pid\n")
+    end
+
+    # Starts a daemon on @pid_path and returns its pid.
+    def start_daemon
+      started = tmp_path('started')
+      capture_stdout {
+        Dante::Runner.new('test-process', :daemonize => true, :pid_path => @pid_path, :log_path => tmp_path('dante.log')) {
+          File.write(started, ""); sleep 100 }.execute }
+      wait_for_output(started)
+      daemon_pid(@pid_path)
+    end
+
+    it "replaces a symlink with the pid file instead of writing through it" do
+      File.symlink(@other, @pid_path)
+      pid = start_daemon
+
+      refute File.symlink?(@pid_path), "the pid file is still a symlink"
+      assert_equal "#{pid}\n", File.read(@pid_path)
+      assert_equal "not a pid\n", File.read(@other)
+      assert_empty Dir[File.join(@tmpdir, '*.tmp')], "temporary file left behind"
+    end
+
+    it "replaces a hard link to another file instead of writing into it" do
+      File.link(@other, @pid_path)
+      pid = start_daemon
+
+      assert_equal "#{pid}\n", File.read(@pid_path)
+      assert_equal "not a pid\n", File.read(@other)
+    end
+  end # pid file path taken
+
+  describe "with a log file there already" do
+    # Runs a runner in the foreground in a forked child, writing to log_path.
+    def run_with_log(log_path)
+      capture_stdout {
+        pid = fork do
+          Dante::Runner.new('test-process', :log_path => log_path) { puts "Started" }.execute
+          exit!(0)
+        end
+        Process.wait(pid) }
+    end
+
+    it "appends to it and keeps its mode" do
+      logfile = tmp_path('dante.log')
+      File.write(logfile, "earlier line\n")
+      File.chmod(0600, logfile)
+      run_with_log(logfile)
+
+      assert_equal "earlier line\nStarted\n", File.read(logfile)
+      assert_equal "600", "%o" % (File.stat(logfile).mode & 0777)
+    end
+
+    it "follows a symlink to it, and keeps the mode of the file it points to" do
+      target = tmp_path('target.log')
+      File.write(target, "")
+      File.chmod(0600, target)
+      logfile = tmp_path('dante.log')
+      File.symlink(target, logfile)
+      run_with_log(logfile)
+
+      assert File.symlink?(logfile)
+      assert_equal "Started\n", File.read(target)
+      assert_equal "600", "%o" % (File.stat(target).mode & 0777)
+    end
+  end # existing log file
+
   describe "with the standard streams connected to a socket" do
     # Runs the block in a forked child whose stdin, stdout and stderr are one end of a
     # socket pair, as under Spring or Zeus. Returns the child's exit status and the
@@ -313,6 +399,53 @@ describe "dante runner" do
       assert_equal 0644, File.stat(@logfile).mode & 0777
     end
 
+    it "gives the daemon /dev/null as its standard input" do
+      stdin_path = tmp_path('daemon-stdin')
+      status, error = run_with_socket_streams do
+        Dante::Runner.new('test-process', :daemonize => true, :pid_path => tmp_path('dante.pid'), :log_path => tmp_path('dante.log')) {
+          File.write("#{stdin_path}.tmp", null_device?($stdin) ? "/dev/null" : $stdin.stat.ftype)
+          File.rename("#{stdin_path}.tmp", stdin_path)
+          sleep 100 }.execute
+      end
+
+      assert_equal [0, ""], [status, error]
+      wait_for_output(stdin_path)
+      assert_equal "/dev/null", File.read(stdin_path)
+    end
+
+    it "gives the daemon /dev/null as its standard input when $stdin is not STDIN" do
+      stdin_path = tmp_path('daemon-stdin')
+      status, error = run_with_socket_streams do
+        $stdin = StringIO.new("typed")
+        started = Dante::Runner.new('test-process', :daemonize => true, :pid_path => tmp_path('dante.pid'), :log_path => tmp_path('dante.log')) {
+          File.write("#{stdin_path}.tmp", null_device?(STDIN) ? "/dev/null" : STDIN.stat.ftype)
+          File.rename("#{stdin_path}.tmp", stdin_path)
+          sleep 100 }.execute
+        raise "not started" unless started
+      end
+
+      assert_equal [0, ""], [status, error]
+      wait_for_output(stdin_path)
+      assert_equal "/dev/null", File.read(stdin_path)
+    end
+
+    it "gives the daemon /dev/null as its standard input when STDIN is closed" do
+      stdin_path = tmp_path('daemon-stdin')
+      status, error = run_with_socket_streams do
+        STDIN.close
+        started = Dante::Runner.new('test-process', :daemonize => true, :pid_path => tmp_path('dante.pid'), :log_path => tmp_path('dante.log')) {
+          fd0 = IO.for_fd(0, autoclose: false)
+          File.write("#{stdin_path}.tmp", null_device?(fd0) ? "/dev/null" : fd0.stat.ftype)
+          File.rename("#{stdin_path}.tmp", stdin_path)
+          sleep 100 }.execute
+        raise "not started" unless started
+      end
+
+      assert_equal [0, ""], [status, error]
+      wait_for_output(stdin_path)
+      assert_equal "/dev/null", File.read(stdin_path)
+    end
+
     it "redirects all three streams to /dev/null without a log file" do
       status, error = run_with_socket_streams do
         Dante::Runner.new('test-process', :log_path => false).send(:redirect_output!)
@@ -533,6 +666,35 @@ describe "dante runner" do
       assert process_alive?(new_pid)
     end
 
+    it "restarts the daemon as a daemon with #restart" do
+      ran_in = tmp_path('ran-in')
+      test_pid = Process.pid
+      runner = Dante::Runner.new('test-process', @run_options) {
+        File.write("#{ran_in}.tmp", Process.pid.to_s)
+        File.rename("#{ran_in}.tmp", ran_in)
+        sleep 100 unless Process.pid == test_pid } # returns if it runs in this process
+      result = nil
+      output = capture_stdout { result = runner.restart }
+
+      wait_for_output(ran_in)
+      refute_equal test_pid.to_s, File.read(ran_in), "the service ran in the caller"
+      assert_equal true, result
+      assert_match(/Daemonized process killed after term.*Daemon has started successfully/m, output)
+      refute process_alive?(@pid), "the first daemon is still running"
+      assert_equal daemon_pid(@pid_path).to_s, File.read(ran_in)
+    end
+
+    it "neither stops nor restarts the daemon with :kill or :restart given as false" do
+      [{ :kill => false }, { :restart => false }].each do |off|
+        output = capture_stdout {
+          Dante::Runner.new('test-process', @run_options.merge(off)) { sleep 100 }.execute }
+
+        assert_equal ["Process is already started\n"], output.lines.grep_v(/: warning: /), off.inspect
+        assert_equal "#{@pid}\n", File.read(@pid_path), off.inspect
+        assert process_alive?(@pid), off.inspect
+      end
+    end
+
     it "stops the daemon with -k and removes its pid file" do
       ARGV.replace(['-k', '-P', @pid_path])
       output = capture_stdout { Dante::Runner.new('test-process').execute }
@@ -544,6 +706,99 @@ describe "dante runner" do
     end
   end # controlling a running daemon
 
+  describe "with daemonize flag, stopping a daemon while its pid file changes" do
+    before do
+      @pid_path = tmp_path('dante.pid')
+      @ready = tmp_path('ready')
+    end
+
+    after do
+      if @replacement
+        Process.kill('KILL', @replacement)
+        Process.wait(@replacement)
+      end
+    end
+
+    # Starts a daemon that runs on_term when it gets SIGTERM, and returns its pid.
+    def start_daemon(pid_path = @pid_path, &on_term)
+      ready = @ready
+      capture_stdout {
+        Dante::Runner.new('test-process', :daemonize => true, :pid_path => pid_path, :log_path => tmp_path('dante.log')) {
+          trap('TERM', &on_term) if on_term
+          File.write(ready, "")
+          sleep 100 }.execute }
+      wait_for_output(ready)
+      daemon_pid(pid_path)
+    end
+
+    it "stops it from two stops at once, neither of them failing" do
+      pid = start_daemon { sleep 0.5; exit }
+      output = capture_stdout {
+        stoppers = 2.times.map { Thread.new { Dante::Runner.new('test-process', :pid_path => @pid_path).stop } }
+        stoppers.each { |t| t.report_on_exception = false }
+        stoppers.each(&:value) }
+
+      assert_equal 2, output.scan(/Daemonized process killed after term/).size, output
+      refute process_alive?(pid)
+      refute File.exist?(@pid_path), "pid file left behind"
+    end
+
+    it "keeps the pid file when a new daemon recorded its pid there meanwhile" do
+      replacement = @replacement = spawn('sleep', '60')
+      pid_path = @pid_path
+      pid = start_daemon { File.write(pid_path, "#{replacement}\n"); exit }
+      output = capture_stdout { Dante::Runner.new('test-process', :pid_path => @pid_path).stop }
+
+      assert_match(/Daemonized process killed after term/, output)
+      refute process_alive?(pid)
+      assert_equal "#{replacement}\n", File.read(@pid_path)
+    end
+
+    it "sends SIGKILL with :force to the daemon it signalled, not to a new one in the pid file" do
+      replacement = @replacement = spawn('sleep', '60')
+      pid_path = @pid_path
+      pid = start_daemon { File.write(pid_path, "#{replacement}\n") } # survives SIGTERM
+      output = capture_stdout { Dante::Runner.new('test-process', :pid_path => @pid_path, :force => true).stop }
+
+      assert_match(/Sent SIGKILL to PID: #{pid} /, output)
+      assert_match(/Daemonized process killed after kill/, output)
+      refute process_alive?(pid)
+      assert process_alive?(replacement), "the new daemon was killed"
+      assert_equal "#{replacement}\n", File.read(@pid_path)
+    end
+
+    it "returns soon after the daemon stops, well within the second it used to wait first" do
+      # A process of this test's that takes 0.2 seconds to stop on SIGTERM, reaped as soon
+      # as it exits (a daemon is reaped by init), stands in for the daemon.
+      script = "trap('TERM') { sleep 0.2; exit }; File.write(ARGV[0], ''); sleep 100"
+      pid = spawn(RbConfig.ruby, '-e', script, @ready)
+      reaper = Process.detach(pid)
+      wait_for_output(@ready)
+      File.write(@pid_path, "#{pid}\n")
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      output = capture_stdout { Dante::Runner.new('test-process', :pid_path => @pid_path).stop }
+      elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started
+
+      assert_match(/Daemonized process killed after term/, output)
+      assert_operator elapsed, :<, 0.8
+    ensure
+      if reaper && reaper.alive?
+        Process.kill('KILL', pid)
+        reaper.join
+      end
+    end
+
+    it "stops a daemon whose pid file path has glob characters in it" do
+      pid_path = tmp_path('run[1]/dante.pid')
+      pid = start_daemon(pid_path)
+      output = capture_stdout { Dante::Runner.new('test-process', :pid_path => pid_path).stop }
+
+      assert_match(/Daemonized process killed after term/, output)
+      refute process_alive?(pid)
+      refute File.exist?(pid_path), "pid file left behind"
+    end
+  end # pid file changes
+
   describe "with daemonize flag and no log path" do
     before do
       # Records the log path the daemon would redirect its output to, then sends the
@@ -746,6 +1001,41 @@ describe "dante runner" do
     end
   end # -p
 
+  describe "with the :argv option" do
+    before do
+      ARGV.replace(['--host-program-flag', 'file.rb']) # options dante does not know
+    end
+
+    # The port the startup block of runner gets, and ARGV afterwards.
+    def port_from(runner, opts = {})
+      port = :not_run
+      capture_stdout { runner.execute(opts) { |o| port = o[:port] } }
+      [port, ARGV]
+    end
+
+    it "parses the given options instead of ARGV, and leaves both arrays as they were" do
+      argv = ['-p', '1234', 'extra'].freeze
+
+      assert_equal [1234, ['--host-program-flag', 'file.rb']], port_from(Dante::Runner.new('test-process', :argv => argv))
+      assert_equal ['-p', '1234', 'extra'], argv
+    end
+
+    it "parses nothing when given an empty array" do
+      assert_equal [nil, ['--host-program-flag', 'file.rb']], port_from(Dante::Runner.new('test-process', :argv => []))
+    end
+
+    it "takes the options to parse from execute too" do
+      assert_equal [4321, ['--host-program-flag', 'file.rb']], port_from(Dante::Runner.new('test-process'), :argv => ['-p', '4321'])
+    end
+
+    it "takes the options to parse from Dante.run" do
+      port = :not_run
+      capture_stdout { Dante.run('test-process', :argv => ['-p', '1234']) { |o| port = o[:port] } }
+
+      assert_equal 1234, port
+    end
+  end # :argv
+
   describe "with parsing options" do
     before do
       ARGV.replace(['-t test_text'])

data/test/user_switch_test.rb

@@ -191,4 +191,124 @@ describe "dante runner switching user and group" do
     assert_equal groups_of(member, passwd.gid), creds[:groups]
     assert_operator creds[:groups].size, :>, 1
   end
+
+  it "stops a daemon started with -u from root with -k" do
+    run_in_child do
+      ARGV.replace(['-d', '-P', @pid_path, '-l', @log_path, '-u', 'nobody'])
+      Dante::Runner.new('test-process').execute { sleep 100 }
+    end
+    pid = daemon_pid(@pid_path)
+    assert_equal @nobody.uid, File.stat(@pid_path).uid
+    ARGV.replace(['-k', '-P', @pid_path])
+    output = capture_stdout { Dante::Runner.new('test-process').execute }
+
+    assert_match(/Daemonized process killed after term/, output)
+    refute process_alive?(pid), "daemon still running after -k"
+    refute File.exist?(@pid_path), "pid file left behind after -k"
+  end
+
+  # A process that runs as the user uid until it is killed, reaped as soon as it exits
+  # (as init reaps a daemon). It returns once the process runs sleep: a signal that
+  # reaches the forked child before then is lost in the exec.
+  def spawn_as(uid)
+    pid = fork do
+      Process::UID.change_privilege(uid) unless uid == 0
+      exec('sleep', '60')
+    end
+    (@reapers ||= []) << Process.detach(pid)
+    assert wait_until { (File.read("/proc/#{pid}/comm") rescue nil) == "sleep\n" }, "sleep never ran"
+    pid
+  end
+
+  after do
+    Array(@reapers).each do |reaper|
+      begin
+        Process.kill('KILL', reaper.pid)
+      rescue Errno::ESRCH
+      end
+      reaper.join
+    end
+  end
+
+  it "does not stop a process of another user named by a pid file it does not own" do
+    other = spawn_as(0)
+    File.write(@pid_path, "#{other}\n")
+    File.chown(@nobody.uid, nil, @pid_path)
+    runner = Dante::Runner.new('test-process', :pid_path => @pid_path, :force => true)
+    result = :not_returned
+    output = capture_stdout { result = runner.stop }
+
+    assert process_alive?(other), "the other user's process was stopped"
+    assert_equal "pid file #{@pid_path} is owned by uid #{@nobody.uid} but process #{other} belongs to uid 0; not stopping it\n", output
+    assert_equal false, result
+    assert_equal false, runner.daemon_running?
+    assert_equal "#{other}\n", File.read(@pid_path)
+  end
+
+  it "does not follow a symlink at the pid file's path to a pid file of root's" do
+    other = spawn_as(0)
+    roots_pid_file = tmp_path('root-service.pid') # outside @dir, which nobody can write
+    File.write(roots_pid_file, "#{other}\n")
+    File.symlink(roots_pid_file, @pid_path)
+    File.lchown(@nobody.uid, nil, @pid_path)
+    runner = Dante::Runner.new('test-process', :pid_path => @pid_path, :force => true)
+    output = capture_stdout { runner.stop }
+
+    assert process_alive?(other), "the process named by the symlink's target was stopped"
+    assert_equal "No test-process processes are running\n", output
+    assert_equal false, runner.daemon_running?
+    assert File.symlink?(@pid_path)
+  end
+
+  it "does not stop a process named by a pid file with other hard links" do
+    other = spawn_as(0)
+    roots_pid_file = tmp_path('root-service.pid')
+    File.write(roots_pid_file, "#{other}\n")
+    File.link(roots_pid_file, @pid_path)
+    runner = Dante::Runner.new('test-process', :pid_path => @pid_path, :force => true)
+    output = capture_stdout { runner.stop }
+
+    assert process_alive?(other), "the process named by the hard-linked file was stopped"
+    assert_equal "pid file #{@pid_path} has other hard links; not stopping it\n", output
+    assert_equal false, runner.daemon_running?
+  end
+
+  it "counts a daemon whose effective uid owns the pid file as running" do
+    run_in_child do
+      Process::UID.eid = @nobody.uid # the real uid stays root's
+      Dante::Runner.new('test-process', :daemonize => true, :pid_path => @pid_path, :log_path => @log_path) { sleep 100 }.execute
+    end
+    daemon_pid(@pid_path)
+    assert_equal @nobody.uid, File.stat(@pid_path).uid
+
+    assert_equal true, Dante::Runner.new('test-process', :pid_path => @pid_path).daemon_running?
+  end
+
+  it "writes a pid file made for it in a directory it cannot write, and can be stopped" do
+    dir = tmp_path('run') # root's, mode 0755
+    Dir.mkdir(dir, 0755)
+    pid_path = File.join(dir, 'dante.pid')
+    File.write(pid_path, "")
+    File.chown(@nobody.uid, nil, pid_path)
+    run_in_child do
+      ARGV.replace(['-d', '-P', pid_path, '-l', @log_path, '-u', 'nobody'])
+      raise "not started" unless Dante::Runner.new('test-process').execute { sleep 100 }
+    end
+    pid = daemon_pid(pid_path)
+    assert_equal ['dante.pid'], Dir.children(dir)
+    ARGV.replace(['-k', '-P', pid_path])
+    output = capture_stdout { Dante::Runner.new('test-process').execute }
+
+    assert_match(/Daemonized process killed after term/, output)
+    refute process_alive?(pid), "daemon still running after -k"
+  end
+
+  it "stops a process of another user named by a pid file of root's" do
+    other = spawn_as(@nobody.uid)
+    File.write(@pid_path, "#{other}\n")
+    output = capture_stdout { Dante::Runner.new('test-process', :pid_path => @pid_path).stop }
+
+    assert_match(/Daemonized process killed after term/, output)
+    refute File.exist?(@pid_path), "pid file left behind"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dante
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Nathan Esquenazi
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-31 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -45,7 +45,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
+- ".github/workflows/github-release.yml"
 - ".github/workflows/release.yml"
 - ".gitignore"
 - CHANGELOG.md
@@ -64,7 +66,11 @@ files:
 homepage: https://github.com/nesquena/dante
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/nesquena/dante
+  changelog_uri: https://github.com/nesquena/dante/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/nesquena/dante/issues
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths: