passenger 4.0.60 → 5.0.0.beta1

data/ext/common/agents/Watchdog/AgentWatcher.cpp

@@ -292,17 +292,19 @@ public:
 						NULL);
 					_exit(1);
 				} catch (...) {
-					fprintf(stderr, "Passenger Watchdog: dup2() failed: %s (%d)\n",
+					fprintf(stderr, "PassengerWatchdog: dup2() failed: %s (%d)\n",
 						strerror(e), e);
 					fflush(stderr);
 					_exit(1);
 				}
 			}
 
+			resetSignalHandlersAndMask();
 			closeAllFileDescriptors(FEEDBACK_FD);
 
 			/* Become the process group leader so that the watchdog can kill the
-			 * agent as well as all its descendant processes. */
+			 * agent as well as all its descendant processes, and so that a Ctrl-C
+			 * only affects the watchdog but not agents. */
 			setpgid(getpid(), getpid());
 
 			setOomScore(oldOomScore);
@@ -321,7 +323,7 @@ public:
 					toString(e).c_str(),
 					NULL);
 			} catch (...) {
-				fprintf(stderr, "Passenger Watchdog: could not execute %s: %s (%d)\n",
+				fprintf(stderr, "PassengerWatchdog: could not execute %s: %s (%d)\n",
 					exeFilename.c_str(), strerror(e), e);
 				fflush(stderr);
 			}
@@ -415,8 +417,8 @@ public:
 					throw RuntimeException(string("Unable to start the ") + name() +
 						" because its executable (" + getExeFilename() + ") "
 						"doesn't exist. This probably means that your "
-						"Phusion Passenger installation is broken or "
-						"incomplete. Please reinstall Phusion Passenger");
+						PROGRAM_NAME " installation is broken or "
+						"incomplete. Please reinstall " PROGRAM_NAME);
 				} else {
 					throw SystemException(string("Unable to start the ") + name() +
 						" because exec(\"" + getExeFilename() + "\") failed",

data/ext/common/agents/Watchdog/HelperAgentWatcher.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2013 Phusion
+ *  Copyright (c) 2010-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -25,71 +25,50 @@
 
 class HelperAgentWatcher: public AgentWatcher {
 protected:
-	string helperAgentFilename;
-	VariantMap params, report;
-	string requestSocketFilename;
-	string messageSocketFilename;
+	string agentFilename;
 
 	virtual const char *name() const {
-		return "Phusion Passenger helper agent";
+		return PROGRAM_NAME " helper agent";
 	}
 
 	virtual string getExeFilename() const {
-		return helperAgentFilename;
+		return agentFilename;
 	}
 
 	virtual void execProgram() const {
 		if (hasEnvOption("PASSENGER_RUN_HELPER_AGENT_IN_VALGRIND", false)) {
 			execlp("valgrind", "valgrind", "--dsymutil=yes",
-				helperAgentFilename.c_str(), (char *) 0);
+				agentFilename.c_str(), AGENT_EXE, "server",
+				// Some extra space to allow the child process to change its process title.
+				"                                                ", (char *) 0);
 		} else {
-			execl(helperAgentFilename.c_str(), "PassengerHelperAgent", (char *) 0);
+			execl(agentFilename.c_str(), AGENT_EXE, "server",
+				// Some extra space to allow the child process to change its process title.
+				"                                                ", (char *) 0);
 		}
 	}
 
 	virtual void sendStartupArguments(pid_t pid, FileDescriptor &fd) {
-		VariantMap options = agentsOptions;
-		params.addTo(options);
+		VariantMap options = *agentsOptions;
+		options.erase("logging_agent_authorizations");
 		options.writeToFd(fd);
 	}
 
 	virtual bool processStartupInfo(pid_t pid, FileDescriptor &fd, const vector<string> &args) {
-		if (args[0] == "initialized") {
-			requestSocketFilename = args[1];
-			messageSocketFilename = args[2];
-			return true;
-		} else {
-			return false;
-		}
+		return args[0] == "initialized";
 	}
 
 public:
 	HelperAgentWatcher(const WorkingObjectsPtr &wo)
 		: AgentWatcher(wo)
 	{
-		helperAgentFilename = wo->resourceLocator->getAgentsDir() + "/PassengerHelperAgent";
-
-		report
-			.set("request_socket_filename",
-				agentsOptions.get("request_socket_filename", false,
-					wo->generation->getPath() + "/request"))
-			.set("request_socket_password",
-				agentsOptions.get("request_socket_password", false,
-					wo->randomGenerator.generateAsciiString(REQUEST_SOCKET_PASSWORD_SIZE)))
-			.set("helper_agent_admin_socket_address",
-				agentsOptions.get("helper_agent_admin_socket_address", false,
-					"unix:" + wo->generation->getPath() + "/helper_admin"))
-			.set("helper_agent_exit_password",
-				agentsOptions.get("helper_agent_exit_password", false,
-					wo->randomGenerator.generateAsciiString(MESSAGE_SERVER_MAX_PASSWORD_SIZE)));
-
-		params = report;
-		params
-			.set("logging_agent_address", wo->loggingAgentAddress)
-			.set("logging_agent_password", wo->loggingAgentPassword);
+		agentFilename = wo->resourceLocator->findSupportBinary(AGENT_EXE);
 	}
 
 	virtual void reportAgentsInformation(VariantMap &report) {
-		this->report.addTo(report);
+		const VariantMap &options = *agentsOptions;
+		vector<string> addresses = options.getStrSet("server_addresses");
+		report.set("server_address", addresses.front());
+		report.set("server_password", options.get("server_password"));
 	}
 };

data/ext/common/agents/Watchdog/InstanceDirToucher.cpp

@@ -0,0 +1,116 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2010-2014 Phusion
+ *
+ *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+
+/**
+ * Touch all files in the server instance dir every 6 hours in order to prevent /tmp
+ * cleaners from weaking havoc:
+ * http://code.google.com/p/phusion-passenger/issues/detail?id=365
+ */
+class InstanceDirToucher {
+private:
+	WorkingObjectsPtr wo;
+	oxt::thread *thr;
+
+	void
+	threadMain() {
+		while (!this_thread::interruption_requested()) {
+			syscalls::sleep(60 * 60);
+
+			begin_touch:
+
+			this_thread::disable_interruption di;
+			this_thread::disable_syscall_interruption dsi;
+			// Fork a process which touches everything in the server instance dir.
+			pid_t pid = syscalls::fork();
+			if (pid == 0) {
+				// Child
+				int prio, ret, e;
+
+				closeAllFileDescriptors(2);
+
+				// Make process nicer.
+				do {
+					prio = getpriority(PRIO_PROCESS, getpid());
+				} while (prio == -1 && errno == EINTR);
+				if (prio != -1) {
+					prio++;
+					if (prio > 20) {
+						prio = 20;
+					}
+					do {
+						ret = setpriority(PRIO_PROCESS, getpid(), prio);
+					} while (ret == -1 && errno == EINTR);
+				} else {
+					perror("getpriority");
+				}
+
+				do {
+					ret = chdir(wo->instanceDir->getPath().c_str());
+				} while (ret == -1 && errno == EINTR);
+				if (ret == -1) {
+					e = errno;
+					fprintf(stderr, "chdir(\"%s\") failed: %s (%d)\n",
+						wo->instanceDir->getPath().c_str(),
+						strerror(e), e);
+					fflush(stderr);
+					_exit(1);
+				}
+
+				setOomScore(oldOomScore);
+
+				execlp("/bin/sh", "/bin/sh", "-c", "find . | xargs touch", (char *) 0);
+				e = errno;
+				fprintf(stderr, "Cannot execute 'find . | xargs touch': %s (%d)\n",
+					strerror(e), e);
+				fflush(stderr);
+				_exit(1);
+			} else if (pid == -1) {
+				// Error
+				P_WARN("Could not touch the server instance directory because "
+					"fork() failed. Retrying in 2 minutes...");
+				this_thread::restore_interruption si(di);
+				this_thread::restore_syscall_interruption rsi(dsi);
+				syscalls::sleep(60 * 2);
+				goto begin_touch;
+			} else {
+				syscalls::waitpid(pid, NULL, 0);
+			}
+		}
+	}
+
+public:
+	InstanceDirToucher(const WorkingObjectsPtr &wo) {
+		this->wo = wo;
+		thr = new oxt::thread(boost::bind(&InstanceDirToucher::threadMain, this),
+			"Server instance dir toucher", 256 * 1024);
+	}
+
+	~InstanceDirToucher() {
+		thr->interrupt_and_join();
+		delete thr;
+	}
+};
+
+typedef boost::shared_ptr<InstanceDirToucher> InstanceDirToucherPtr;

data/ext/common/agents/Watchdog/LoggingAgentWatcher.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2013 Phusion
+ *  Copyright (c) 2010-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -29,7 +29,7 @@ protected:
 	string socketAddress;
 
 	virtual const char *name() const {
-		return "Phusion Passenger logging agent";
+		return PROGRAM_NAME " logging agent";
 	}
 
 	virtual string getExeFilename() const {
@@ -37,36 +37,32 @@ protected:
 	}
 
 	virtual void execProgram() const {
-		execl(agentFilename.c_str(), "PassengerLoggingAgent", (char *) 0);
+		execl(agentFilename.c_str(), AGENT_EXE, "logger",
+			// Some extra space to allow the child process to change its process title.
+			"                                                ", (char *) 0);
 	}
 
 	virtual void sendStartupArguments(pid_t pid, FileDescriptor &fd) {
-		VariantMap options = agentsOptions;
-		options.set("logging_agent_address", wo->loggingAgentAddress);
-		options.set("logging_agent_password", wo->loggingAgentPassword);
-		options.set("logging_agent_admin_address", wo->loggingAgentAdminAddress);
+		VariantMap options = *agentsOptions;
+		options.erase("server_password");
+		options.erase("server_authorizations");
 		options.writeToFd(fd);
 	}
 
 	virtual bool processStartupInfo(pid_t pid, FileDescriptor &fd, const vector<string> &args) {
-		if (args[0] == "initialized") {
-			return true;
-		} else {
-			return false;
-		}
+		return args[0] == "initialized";
 	}
 
 public:
 	LoggingAgentWatcher(const WorkingObjectsPtr &wo)
 		: AgentWatcher(wo)
 	{
-		agentFilename = wo->resourceLocator->getAgentsDir() + "/PassengerLoggingAgent";
+		agentFilename = wo->resourceLocator->findSupportBinary(AGENT_EXE);
 	}
 
 	virtual void reportAgentsInformation(VariantMap &report) {
-		report
-			.set("logging_socket_address", wo->loggingAgentAddress)
-			.set("logging_socket_password", wo->loggingAgentPassword)
-			.set("logging_socket_admin_address", wo->loggingAgentAdminAddress);
+		const VariantMap &options = *agentsOptions;
+		report.set("logging_agent_address", options.get("logging_agent_address"));
+		report.set("logging_agent_password", options.get("logging_agent_password"));
 	}
 };

data/ext/common/agents/Watchdog/Main.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2010-2013 Phusion
+ *  Copyright (c) 2010-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -32,34 +32,49 @@
 #include <string>
 #include <utility>
 #include <vector>
+#include <algorithm>
+
+#if !defined(sun) && !defined(__sun)
+	#define HAVE_FLOCK
+#endif
 
 #include <sys/select.h>
 #include <sys/types.h>
 #include <sys/time.h>
+#ifdef HAVE_FLOCK
+	#include <sys/file.h>
+#endif
 #include <sys/resource.h>
 #include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
+#include <fcntl.h>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <cerrno>
 
 #include <agents/Base.h>
+#include <agents/HelperAgent/OptionParser.h>
+#include <agents/LoggingAgent/OptionParser.h>
+#include <agents/Watchdog/AdminServer.h>
 #include <Constants.h>
-#include <ServerInstanceDir.h>
+#include <InstanceDirectory.h>
 #include <FileDescriptor.h>
 #include <RandomGenerator.h>
+#include <BackgroundEventLoop.h>
 #include <Logging.h>
 #include <Exceptions.h>
 #include <StaticString.h>
 #include <Hooks.h>
 #include <ResourceLocator.h>
 #include <Utils.h>
-#include <Utils/Base64.h>
 #include <Utils/Timer.h>
 #include <Utils/ScopeGuard.h>
 #include <Utils/StrIntUtils.h>
 #include <Utils/IOUtils.h>
 #include <Utils/MessageIO.h>
+#include <Utils/OptionParsing.h>
 #include <Utils/VariantMap.h>
 
 using namespace std;
@@ -75,70 +90,67 @@ enum OomFileType {
 
 #define REQUEST_SOCKET_PASSWORD_SIZE     64
 
-class ServerInstanceDirToucher;
+class InstanceDirToucher;
 class AgentWatcher;
-static bool hasEnvOption(const char *name, bool defaultValue = false);
-static void setOomScore(const StaticString &score);
-
 
-/***** Agent options *****/
-
-static VariantMap agentsOptions;
-static string  tempDir;
-static bool    userSwitching;
-static string  defaultUser;
-static string  defaultGroup;
-static uid_t   webServerWorkerUid;
-static gid_t   webServerWorkerGid;
 
 /***** Working objects *****/
 
-struct WorkingObjects {
-	RandomGenerator randomGenerator;
-	EventFd errorEvent;
-	ResourceLocatorPtr resourceLocator;
-	ServerInstanceDirPtr serverInstanceDir;
-	ServerInstanceDir::GenerationPtr generation;
-	uid_t defaultUid;
-	gid_t defaultGid;
-	vector<string> cleanupPidfiles;
-	string loggingAgentAddress;
-	string loggingAgentPassword;
-	string loggingAgentAdminAddress;
-	string adminToolStatusPassword;
-	string adminToolManipulationPassword;
-};
+namespace Passenger {
+namespace WatchdogAgent {
+	struct WorkingObjects {
+		RandomGenerator randomGenerator;
+		EventFd errorEvent;
+		EventFd exitEvent;
+		ResourceLocatorPtr resourceLocator;
+		uid_t defaultUid;
+		gid_t defaultGid;
+		InstanceDirectoryPtr instanceDir;
+		int lockFile;
+		vector<string> cleanupPidfiles;
+		bool pidsCleanedUp;
+		bool pidFileCleanedUp;
+
+		vector<AdminServer::Authorization> adminAuthorizations;
+		int adminServerFds[SERVER_KIT_MAX_SERVER_ENDPOINTS];
+		BackgroundEventLoop *bgloop;
+		ServerKit::Context *serverKitContext;
+		AdminServer *adminServer;
+
+		WorkingObjects()
+			: pidsCleanedUp(false),
+			  pidFileCleanedUp(false),
+			  bgloop(NULL),
+			  serverKitContext(NULL),
+			  adminServer(NULL)
+		{
+			for (unsigned int i = 0; i < SERVER_KIT_MAX_SERVER_ENDPOINTS; i++) {
+				adminServerFds[i] = -1;
+			}
+		}
+	};
+
+	typedef boost::shared_ptr<WorkingObjects> WorkingObjectsPtr;
+} // namespace WatchdogAgent
+} // namespace Passenger
 
-typedef boost::shared_ptr<WorkingObjects> WorkingObjectsPtr;
+using namespace Passenger::WatchdogAgent;
 
+static VariantMap *agentsOptions;
+static WorkingObjects *workingObjects;
 static string oldOomScore;
 
+static void setOomScore(const StaticString &score);
+static void cleanup(const WorkingObjectsPtr &wo);
+
 #include "AgentWatcher.cpp"
-#include "ServerInstanceDirToucher.cpp"
+#include "InstanceDirToucher.cpp"
 #include "HelperAgentWatcher.cpp"
 #include "LoggingAgentWatcher.cpp"
 
 
 /***** Functions *****/
 
-static bool
-hasEnvOption(const char *name, bool defaultValue) {
-	const char *value = getenv(name);
-	if (value != NULL) {
-		if (*value != '\0') {
-			return strcmp(value, "yes") == 0
-				|| strcmp(value, "y") == 0
-				|| strcmp(value, "1") == 0
-				|| strcmp(value, "on") == 0
-				|| strcmp(value, "true") == 0;
-		} else {
-			return defaultValue;
-		}
-	} else {
-		return defaultValue;
-	}
-}
-
 static FILE *
 openOomAdjFile(const char *mode, OomFileType &type) {
 	FILE *f = fopen("/proc/self/oom_score_adj", mode);
@@ -223,6 +235,12 @@ setOomScoreNeverKill() {
 	return oldScore;
 }
 
+static void
+terminationHandler(int signo) {
+	ssize_t ret = write(workingObjects->exitEvent.writerFd(), "x", 1);
+	(void) ret; // Don't care about the result.
+}
+
 /**
  * Wait until the starter process has exited or sent us an exit command,
  * or until one of the watcher threads encounter an error. If a thread
@@ -234,20 +252,31 @@ setOomScoreNeverKill() {
  */
 static bool
 waitForStarterProcessOrWatchers(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watchers) {
+	TRACE_POINT();
 	fd_set fds;
-	int max, ret;
+	int max = -1, ret;
 	char x;
 
-	FD_ZERO(&fds);
-	FD_SET(FEEDBACK_FD, &fds);
-	FD_SET(wo->errorEvent.fd(), &fds);
+	wo->bgloop->start("Main event loop", 0);
 
-	if (FEEDBACK_FD > wo->errorEvent.fd()) {
-		max = FEEDBACK_FD;
-	} else {
-		max = wo->errorEvent.fd();
+	struct sigaction action;
+	action.sa_handler = terminationHandler;
+	action.sa_flags = SA_RESTART;
+	sigemptyset(&action.sa_mask);
+	sigaction(SIGINT, &action, NULL);
+	sigaction(SIGTERM, &action, NULL);
+
+	FD_ZERO(&fds);
+	if (feedbackFdAvailable()) {
+		FD_SET(FEEDBACK_FD, &fds);
+		max = std::max(max, FEEDBACK_FD);
 	}
+	FD_SET(wo->errorEvent.fd(), &fds);
+	max = std::max(max, wo->errorEvent.fd());
+	FD_SET(wo->exitEvent.fd(), &fds);
+	max = std::max(max, wo->exitEvent.fd());
 
+	UPDATE_TRACE_POINT();
 	ret = syscalls::select(max + 1, &fds, NULL, NULL, NULL);
 	if (ret == -1) {
 		int e = errno;
@@ -255,7 +284,20 @@ waitForStarterProcessOrWatchers(const WorkingObjectsPtr &wo, vector<AgentWatcher
 		return false;
 	}
 
+	action.sa_handler = SIG_DFL;
+	sigaction(SIGINT, &action, NULL);
+	sigaction(SIGTERM, &action, NULL);
+
+	P_DEBUG("Stopping admin server");
+	wo->bgloop->stop();
+	for (unsigned int i = 0; i < SERVER_KIT_MAX_SERVER_ENDPOINTS; i++) {
+		if (wo->adminServerFds[i] != -1) {
+			syscalls::close(wo->adminServerFds[i]);
+		}
+	}
+
 	if (FD_ISSET(wo->errorEvent.fd(), &fds)) {
+		UPDATE_TRACE_POINT();
 		vector<AgentWatcherPtr>::const_iterator it;
 		string message, backtrace, watcherName;
 
@@ -272,7 +314,11 @@ waitForStarterProcessOrWatchers(const WorkingObjectsPtr &wo, vector<AgentWatcher
 				message << "\n" << backtrace);
 		}
 		return false;
+	} else if (FD_ISSET(wo->exitEvent.fd(), &fds)) {
+		return true;
 	} else {
+		UPDATE_TRACE_POINT();
+		assert(feedbackFdAvailable());
 		ret = syscalls::read(FEEDBACK_FD, &x, 1);
 		return ret == 1 && x == 'c';
 	}
@@ -313,19 +359,28 @@ killCleanupPids(const vector<pid_t> &cleanupPids) {
 
 static void
 killCleanupPids(const WorkingObjectsPtr &wo) {
-	killCleanupPids(readCleanupPids(wo));
+	if (!wo->pidsCleanedUp) {
+		killCleanupPids(readCleanupPids(wo));
+		wo->pidsCleanedUp = true;
+	}
+}
+
+static void
+deletePidFile(const WorkingObjectsPtr &wo) {
+	string pidFile = agentsOptions->get("pid_file", false);
+	if (!pidFile.empty() && !wo->pidFileCleanedUp && agentsOptions->getBool("delete_pid_file")) {
+		syscalls::unlink(pidFile.c_str());
+		wo->pidFileCleanedUp = true;
+	}
 }
 
 static void
 cleanupAgentsInBackground(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watchers, char *argv[]) {
 	this_thread::disable_interruption di;
 	this_thread::disable_syscall_interruption dsi;
-	vector<pid_t> cleanupPids;
 	pid_t pid;
 	int e;
 
-	cleanupPids = readCleanupPids(wo);
-
 	pid = fork();
 	if (pid == 0) {
 		// Child
@@ -341,9 +396,10 @@ cleanupAgentsInBackground(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &
 				strcpy(argv[0], "PassengerWatchdog (cleaning up...)");
 			#endif
 
-			// Wait until all agent processes have exited. The starter
-			// process is responsible for telling the individual agents
-			// to exit.
+			P_DEBUG("Sending SIGTERM to all agent processes");
+			for (it = watchers.begin(); it != watchers.end(); it++) {
+				(*it)->signalShutdown();
+			}
 
 			max = 0;
 			FD_ZERO(&fds);
@@ -354,6 +410,7 @@ cleanupAgentsInBackground(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &
 				}
 			}
 
+			P_DEBUG("Waiting until all agent processes have exited...");
 			timer.start();
 			agentProcessesDone = 0;
 			while (agentProcessesDone != -1
@@ -382,29 +439,18 @@ cleanupAgentsInBackground(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &
 			if (agentProcessesDone == -1 || timer.elapsed() >= deadline) {
 				// An error occurred or we've waited long enough. Kill all the
 				// processes.
-				P_WARN("Some Phusion Passenger agent processes did not exit " <<
+				P_WARN("Some " PROGRAM_NAME " agent processes did not exit " <<
 					"in time, forcefully shutting down all.");
 			} else {
-				P_DEBUG("All Phusion Passenger agent processes have exited. Forcing all subprocesses to shut down.");
-			}
-			P_DEBUG("Sending SIGTERM");
-			for (it = watchers.begin(); it != watchers.end(); it++) {
-				(*it)->signalShutdown();
+				P_DEBUG("All " PROGRAM_NAME " agent processes have exited. Forcing all subprocesses to shut down.");
 			}
-			usleep(1000000);
-			P_DEBUG("Sending SIGKILL");
+			P_DEBUG("Sending SIGKILL to all agent processes");
 			for (it = watchers.begin(); it != watchers.end(); it++) {
 				(*it)->forceShutdown();
 			}
 
-			// Now clean up the server instance directory.
-			wo->generation->destroy();
-			wo->serverInstanceDir->destroy();
-
-			// Notify given PIDs about our shutdown.
-			killCleanupPids(cleanupPids);
+			cleanup(wo);
 
-			strcpy(argv[0], "PassengerWatchdog (cleaning up 6...)");
 			_exit(0);
 		} catch (const std::exception &e) {
 			P_CRITICAL("An exception occurred during cleaning up: " << e.what());
@@ -423,8 +469,7 @@ cleanupAgentsInBackground(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &
 		// Parent
 
 		// Let child process handle cleanup.
-		wo->serverInstanceDir->detach();
-		wo->generation->detach();
+		wo->instanceDir->detach();
 	}
 }
 
@@ -432,14 +477,15 @@ static void
 forceAllAgentsShutdown(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watchers) {
 	vector<AgentWatcherPtr>::iterator it;
 
+	P_DEBUG("Sending SIGTERM to all agent processes");
 	for (it = watchers.begin(); it != watchers.end(); it++) {
 		(*it)->signalShutdown();
 	}
 	usleep(1000000);
+	P_DEBUG("Sending SIGKILL to all agent processes");
 	for (it = watchers.begin(); it != watchers.end(); it++) {
 		(*it)->forceShutdown();
 	}
-	killCleanupPids(wo);
 }
 
 static string
@@ -459,14 +505,241 @@ runHookScriptAndThrowOnError(const char *name) {
 	HookScriptOptions options;
 
 	options.name = name;
-	options.spec = agentsOptions.get(string("hook_") + name, false);
-	options.agentsOptions = &agentsOptions;
+	options.spec = agentsOptions->get(string("hook_") + name, false);
+	options.agentsOptions = agentsOptions;
 
 	if (!runHookScripts(options)) {
 		throw RuntimeException(string("Hook script ") + name + " failed");
 	}
 }
 
+
+static void
+usage() {
+	printf("Usage: " AGENT_EXE " watchdog <OPTIONS...>\n");
+	printf("Runs the " PROGRAM_NAME " watchdog.\n\n");
+	printf("The watchdog runs and supervises various " PROGRAM_NAME " agent processes,\n");
+	printf("namely the HTTP server and logging server. Arguments marked with \"[A]\", e.g.\n");
+	printf("--passenger-root and --log-level, are automatically passed to all supervised\n");
+	printf("agents, unless you explicitly override them by passing extra arguments to a\n");
+	printf("supervised agent specifically. You can pass arguments to a supervised agent by\n");
+	printf("wrapping those arguments between --BS/--ES and --BL/--EL.\n");
+	printf("\n");
+	printf("  Example 1: pass some arguments to the HTTP server.\n\n");
+	printf("  " AGENT_EXE " watchdog --passenger-root /opt/passenger \\\n");
+	printf("    --BS --listen tcp://127.0.0.1:4000 /webapps/foo\n");
+	printf("\n");
+	printf("  Example 2: pass some arguments to the HTTP server, and some others to the\n");
+	printf("  logging server. The watchdog itself and the HTTP server will use logging\n");
+	printf("  level 3, while the logging server will use logging level 1.\n\n");
+	printf("  " AGENT_EXE " watchdog --passenger-root /opt/passenger \\\n");
+	printf("    --BS --listen tcp://127.0.0.1:4000 /webapps/foo --ES \\\n");
+	printf("    --BL --log-level 1 --EL \\\n");
+	printf("    --log-level 3\n");
+	printf("\n");
+	printf("Required options:\n");
+	printf("       --passenger-root PATH  The location to the " PROGRAM_NAME " source\n");
+	printf("                              directory [A]\n");
+	printf("\n");
+	printf("Argument passing options (optional):\n");
+	printf("  --BS, --begin-server-args   Signals the beginning of arguments to pass to the\n");
+	printf("                              HTTP server\n");
+	printf("  --ES, --end-server-args     Signals the end of arguments to pass to the HTTP\n");
+	printf("                              server\n");
+	printf("  --BL, --begin-logger-args   Signals the beginning of arguments to pass to the\n");
+	printf("                              logging server\n");
+	printf("  --EL, --end-logger-args     Signals the end of arguments to pass to the\n");
+	printf("                              logging server\n");
+	printf("\n");
+	printf("Other options (optional):\n");
+	printf("      --admin-listen ADDRESS\n");
+	printf("                            Listen on the given address for admin commands.\n");
+	printf("                            The address must be formatted as tcp://IP:PORT for\n");
+	printf("                            TCP sockets, or unix:PATH for Unix domain sockets.\n");
+	printf("                            You can specify this option multiple times (up to\n");
+	printf("                            %u times) to listen on multiple addresses.\n",
+		SERVER_KIT_MAX_SERVER_ENDPOINTS - 1);
+	printf("      --authorize [LEVEL]:USERNAME:PASSWORDFILE\n");
+	printf("                            Enables authentication on the admin server, through\n");
+	printf("                            the given admin account. LEVEL indicates the\n");
+	printf("                            privilege level (see below). PASSWORDFILE must\n");
+	printf("                            point to a file containing the password\n");
+	printf("\n");
+	printf("      --instance-registry-dir  Directory to register instance into.\n");
+	printf("                               Default: %s\n", getSystemTempDir());
+	printf("\n");
+	printf("      --no-user-switching     Disables user switching support [A]\n");
+	printf("      --default-user NAME     Default user to start apps as, when user\n");
+	printf("                              switching is enabled. Default: " DEFAULT_WEB_APP_USER "\n");
+	printf("      --default-group NAME    Default group to start apps as, when user\n");
+	printf("                              switching is disabled. Default: the default\n");
+	printf("                              user's primary group\n");
+	printf("\n");
+	printf("      --daemonize             Daemonize into the background\n");
+	printf("      --user NAME             Lower privilege to the given user\n");
+	printf("      --pid-file PATH         Store the watchdog's PID in the given file. The\n");
+	printf("                              file is deleted on exit\n");
+	printf("      --no-delete-pid-file    Do not delete PID file on exit\n");
+	printf("      --log-file PATH         Log to the given file.\n");
+	printf("      --log-level LEVEL       Logging level. [A] Default: %d\n", DEFAULT_LOG_LEVEL);
+	printf("      --cleanup-pidfile PATH  Upon shutdown, kill the process specified by\n");
+	printf("                              the given PID file\n");
+	printf("\n");
+	printf("      --ctl NAME=VALUE        Set custom internal option\n");
+	printf("\n");
+	printf("  -h, --help                  Show this help\n");
+	printf("\n");
+	printf("[A] = Automatically passed to supervised agents\n");
+	printf("\n");
+	printf("Admin account privilege levels (ordered from most to least privileges):\n");
+	printf("  readonly    Read-only access\n");
+	printf("  full        Full access (default)\n");
+}
+
+static void
+parseOptions(int argc, const char *argv[], VariantMap &options) {
+	OptionParser p(usage);
+	int i = 2;
+
+	while (i < argc) {
+		if (p.isValueFlag(argc, i, argv[i], '\0', "--passenger-root")) {
+			options.set("passenger_root", argv[i + 1]);
+			i += 2;
+		} else if (p.isFlag(argv[i], '\0', "--BS")
+			|| p.isFlag(argv[i], '\0', "--begin-server-args"))
+		{
+			i++;
+			while (i < argc) {
+				if (p.isFlag(argv[i], '\0', "--ES")
+				 || p.isFlag(argv[i], '\0', "--end-server-args"))
+				{
+					i++;
+					break;
+				} else if (p.isFlag(argv[i], '\0', "--BL")
+				 || p.isFlag(argv[i], '\0', "--begin-logger-args"))
+				{
+					break;
+				} else if (!parseServerOption(argc, argv, i, options)) {
+					fprintf(stderr, "ERROR: unrecognized HTTP server argument %s. Please "
+						"type '%s server --help' for usage.\n", argv[i], argv[0]);
+					exit(1);
+				}
+			}
+		} else if (p.isFlag(argv[i], '\0', "--BL")
+			|| p.isFlag(argv[i], '\0', "--begin-logger-args"))
+		{
+			i++;
+			while (i < argc) {
+				if (p.isFlag(argv[i], '\0', "--EL")
+				 || p.isFlag(argv[i], '\0', "--end-logger-args"))
+				{
+					i++;
+					break;
+				} else if (p.isFlag(argv[i], '\0', "--BS")
+				 || p.isFlag(argv[i], '\0', "--begin-server-args"))
+				{
+					break;
+				} else if (!parseLoggingAgentOption(argc, argv, i, options)) {
+					fprintf(stderr, "ERROR: unrecognized logging agent argument %s. Please "
+						"type '%s logger --help' for usage.\n", argv[i], argv[0]);
+					exit(1);
+				}
+			}
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--admin-listen")) {
+			if (getSocketAddressType(argv[i + 1]) != SAT_UNKNOWN) {
+				vector<string> addresses = options.getStrSet("watchdog_admin_addresses",
+					false);
+				if (addresses.size() == SERVER_KIT_MAX_SERVER_ENDPOINTS - 1) {
+					fprintf(stderr, "ERROR: you may specify up to %u --admin-listen addresses.\n",
+						SERVER_KIT_MAX_SERVER_ENDPOINTS - 1);
+					exit(1);
+				}
+				addresses.push_back(argv[i + 1]);
+				options.setStrSet("watchdog_admin_addresses", addresses);
+				i += 2;
+			} else {
+				fprintf(stderr, "ERROR: invalid address format for --admin-listen. The address "
+					"must be formatted as tcp://IP:PORT for TCP sockets, or unix:PATH "
+					"for Unix domain sockets.\n");
+				exit(1);
+			}
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--authorize")) {
+			vector<string> args;
+			vector<string> authorizations = options.getStrSet("watchdog_authorizations",
+				false);
+
+			split(argv[i + 1], ':', args);
+			if (args.size() < 2 || args.size() > 3) {
+				fprintf(stderr, "ERROR: invalid format for --authorize. The syntax "
+					"is \"[LEVEL:]USERNAME:PASSWORDFILE\".\n");
+				exit(1);
+			}
+
+			authorizations.push_back(argv[i + 1]);
+			options.setStrSet("watchdog_authorizations", authorizations);
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--instance-registry-dir")) {
+			options.set("instance_registry_dir", argv[i + 1]);
+			i += 2;
+		} else if (p.isFlag(argv[i], '\0', "--no-user-switching")) {
+			options.setBool("user_switching", false);
+			i++;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--default-user")) {
+			options.set("default_user", argv[i + 1]);
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--default-group")) {
+			options.set("default_group", argv[i + 1]);
+			i += 2;
+		} else if (p.isFlag(argv[i], '\0', "--daemonize")) {
+			options.setBool("daemonize", true);
+			i++;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--user")) {
+			options.set("user", argv[i + 1]);
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--pid-file")) {
+			options.set("pid_file", argv[i + 1]);
+			i += 2;
+		} else if (p.isFlag(argv[i], '\0', "--no-delete-pid-file")) {
+			options.setBool("delete_pid_file", false);
+			i++;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--log-level")) {
+			options.setInt("log_level", atoi(argv[i + 1]));
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--cleanup-pidfile")) {
+			vector<string> pidfiles = options.getStrSet("cleanup_pidfiles", false);
+			pidfiles.push_back(argv[i + 1]);
+			options.setStrSet("cleanup_pidfiles", pidfiles);
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--log-file")) {
+			options.set("debug_log_file", argv[i + 1]);
+			i += 2;
+		} else if (p.isValueFlag(argc, i, argv[i], '\0', "--ctl")) {
+			const char *value = strchr(argv[i + 1], '=');
+			if (value == NULL) {
+				fprintf(stderr, "ERROR: '%s' is not a valid --ctl parameter. "
+					"It must be in the form of NAME=VALUE.\n", argv[i + 1]);
+				exit(1);
+			}
+			string name(argv[i + 1], value - argv[i + 1]);
+			value++;
+			if (*value == '\0') {
+				fprintf(stderr, "ERROR: '%s' is not a valid --ctl parameter. "
+					"The value must be non-empty.\n", argv[i + 1]);
+				exit(1);
+			}
+			options.set(name, value);
+			i += 2;
+		} else if (p.isFlag(argv[i], 'h', "--help")) {
+			usage();
+			exit(0);
+		} else {
+			fprintf(stderr, "ERROR: unrecognized argument %s. Please type "
+				"'%s watchdog --help' for usage.\n", argv[i], argv[0]);
+			exit(1);
+		}
+	}
+}
+
 static void
 initializeBareEssentials(int argc, char *argv[]) {
 	/*
@@ -475,7 +748,6 @@ initializeBareEssentials(int argc, char *argv[]) {
 	 * forcefully redirect stdout to stderr so that everything ends up in the
 	 * same place.
 	 */
-	int oldStdout = dup(1);
 	dup2(2, 1);
 
 	/*
@@ -489,53 +761,39 @@ initializeBareEssentials(int argc, char *argv[]) {
 	 */
 	oldOomScore = setOomScoreNeverKill();
 
-	agentsOptions = initializeAgent(argc, argv, "PassengerWatchdog");
+	agentsOptions = new VariantMap();
+	*agentsOptions = initializeAgent(argc, &argv, AGENT_EXE " watchdog",
+		parseOptions, NULL, 2);
+
+	// Start all sub-agents with this environment variable.
+	setenv("PASSENGER_USE_FEEDBACK_FD", "true", 1);
+}
 
-	if (agentsOptions.get("test_binary", false) == "1") {
-		int ret;
-		do {
-			ret = write(oldStdout, "PASS\n", 5);
-		} while (ret == -1 && errno == EAGAIN);
-		exit(0);
+static void
+setAgentsOptionsDefaults() {
+	VariantMap &options = *agentsOptions;
+
+	options.setDefault("instance_registry_dir", getSystemTempDir());
+	options.setDefaultBool("user_switching", true);
+	options.setDefault("default_user", DEFAULT_WEB_APP_USER);
+	if (!options.has("default_group")) {
+		options.set("default_group",
+			inferDefaultGroup(options.get("default_user")));
 	}
-	close(oldStdout);
+	options.setDefault("server_software", SERVER_TOKEN_NAME "/" PASSENGER_VERSION);
+	options.setDefaultStrSet("cleanup_pidfiles", vector<string>());
+	options.setDefault("data_buffer_dir", getSystemTempDir());
+	options.setDefaultBool("delete_pid_file", true);
 }
 
 static void
-initializeOptions() {
-	TRACE_POINT();
-	agentsOptions
-		.setDefaultInt ("log_level", DEFAULT_LOG_LEVEL)
-		.setDefault    ("temp_dir", getSystemTempDir())
-
-		.setDefaultBool("user_switching", true)
-		.setDefault    ("default_user", DEFAULT_WEB_APP_USER)
-		.setDefaultUid ("web_server_worker_uid", getuid())
-		.setDefaultGid ("web_server_worker_gid", getgid())
-		.setDefault    ("default_ruby", DEFAULT_RUBY)
-		.setDefault    ("default_python", DEFAULT_PYTHON)
-		.setDefaultInt ("max_pool_size", DEFAULT_MAX_POOL_SIZE)
-		.setDefaultInt ("pool_idle_time", DEFAULT_POOL_IDLE_TIME);
-	agentsOptions.set  ("passenger_version", PASSENGER_VERSION);
-
-	// Check for required options
-	UPDATE_TRACE_POINT();
-	agentsOptions.get("passenger_root");
-	agentsOptions.getPid("web_server_pid");
+sanityCheckOptions() {
+	VariantMap &options = *agentsOptions;
 
-	// Fetch optional options
-	UPDATE_TRACE_POINT();
-	tempDir       = agentsOptions.get("temp_dir");
-	userSwitching = agentsOptions.getBool("user_switching");
-	defaultUser   = agentsOptions.get("default_user");
-	if (!agentsOptions.has("default_group")) {
-		agentsOptions.set("default_group", inferDefaultGroup(defaultUser));
+	if (!options.has("passenger_root")) {
+		fprintf(stderr, "ERROR: please set the --passenger-root argument.\n");
+		exit(1);
 	}
-	defaultGroup       = agentsOptions.get("default_group");
-	webServerWorkerUid = agentsOptions.getUid("web_server_worker_uid");
-	webServerWorkerGid = agentsOptions.getGid("web_server_worker_gid");
-
-	P_INFO("Options: " << agentsOptions.inspect());
 }
 
 static void
@@ -546,15 +804,113 @@ maybeSetsid() {
 	 * we can kill all of our subprocesses in a single killpg().
 	 *
 	 * AgentsStarter.h already calls setsid() before exec()ing
-	 * the Watchdog, but FlyingPassenger does not.
+	 * the Watchdog, but Flying Passenger does not.
 	 */
-	if (agentsOptions.getBool("setsid", false)) {
+	if (agentsOptions->getBool("setsid", false)) {
 		setsid();
 	}
 }
 
+static void
+redirectStdinToNull() {
+	int fd = open("/dev/null", O_RDONLY);
+	if (fd != -1) {
+		dup2(fd, 1);
+		close(fd);
+	}
+}
+
+static void
+maybeDaemonize() {
+	pid_t pid;
+	int e;
+
+	if (agentsOptions->getBool("daemonize", false)) {
+		pid = fork();
+		if (pid == 0) {
+			setsid();
+			if (chdir("/") == -1) {
+				e = errno;
+				throw SystemException("Cannot change working directory to /", e);
+			}
+			redirectStdinToNull();
+		} else if (pid == -1) {
+			e = errno;
+			throw SystemException("Cannot fork", e);
+		} else {
+			_exit(0);
+		}
+	}
+}
+
+static void
+createPidFile() {
+	TRACE_POINT();
+	string pidFile = agentsOptions->get("pid_file", false);
+	if (!pidFile.empty()) {
+		char pidStr[32];
+
+		snprintf(pidStr, sizeof(pidStr), "%lld", (long long) getpid());
+
+		int fd = syscalls::open(pidFile.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0644);
+		if (fd == -1) {
+			int e = errno;
+			throw FileSystemException("Cannot create PID file " + pidFile, e, pidFile);
+		}
+
+		UPDATE_TRACE_POINT();
+		writeExact(fd, pidStr, strlen(pidStr));
+		syscalls::close(fd);
+	}
+}
+
+static void
+lowerPrivilege() {
+	TRACE_POINT();
+	const VariantMap &options = *agentsOptions;
+	string userName = options.get("user", false);
+
+	if (geteuid() == 0 && !userName.empty()) {
+		struct passwd *pwUser = getpwnam(userName.c_str());
+
+		if (pwUser == NULL) {
+			throw RuntimeException("Cannot lookup user information for user " +
+				userName);
+		}
+
+		gid_t gid = pwUser->pw_gid;
+		string groupName = getGroupName(pwUser->pw_gid);
+
+		if (initgroups(userName.c_str(), gid) != 0) {
+			int e = errno;
+			throw SystemException("Unable to lower " AGENT_EXE " watchdog's privilege "
+				"to that of user '" + userName + "' and group '" + groupName +
+				"': cannot set supplementary groups", e);
+		}
+		if (setgid(gid) != 0) {
+			int e = errno;
+			throw SystemException("Unable to lower " AGENT_EXE " watchdog's privilege "
+				"to that of user '" + userName + "' and group '" + groupName +
+				"': cannot set group ID to " + toString(gid), e);
+		}
+		if (setuid(pwUser->pw_uid) != 0) {
+			int e = errno;
+			throw SystemException("Unable to lower " AGENT_EXE " watchdog's privilege "
+				"to that of user '" + userName + "' and group '" + groupName +
+				"': cannot set user ID to " + toString(pwUser->pw_uid), e);
+		}
+
+		setenv("USER", pwUser->pw_name, 1);
+		setenv("HOME", pwUser->pw_dir, 1);
+		setenv("UID", toString(gid).c_str(), 1);
+	}
+}
+
 static void
 lookupDefaultUidGid(uid_t &uid, gid_t &gid) {
+	VariantMap &options = *agentsOptions;
+	const string &defaultUser = options.get("default_user");
+	const string &defaultGroup = options.get("default_group");
 	struct passwd *userEntry;
 
 	userEntry = getpwnam(defaultUser.c_str());
@@ -572,66 +928,108 @@ lookupDefaultUidGid(uid_t &uid, gid_t &gid) {
 }
 
 static void
-initializeWorkingObjects(WorkingObjectsPtr &wo, ServerInstanceDirToucherPtr &serverInstanceDirToucher) {
+initializeWorkingObjects(WorkingObjectsPtr &wo, InstanceDirToucherPtr &instanceDirToucher) {
 	TRACE_POINT();
-	wo = boost::make_shared<WorkingObjects>();
-	wo->resourceLocator = boost::make_shared<ResourceLocator>(agentsOptions.get("passenger_root"));
-
-	UPDATE_TRACE_POINT();
-	// Must not used boost::make_shared() here because Watchdog.cpp
-	// deletes the raw pointer in cleanupAgentsInBackground().
-	if (agentsOptions.get("server_instance_dir", false).empty()) {
-		/* We embed the super structure version in the server instance directory name
-		 * because it's possible to upgrade Phusion Passenger without changing the
-		 * web server's PID. This way each incompatible upgrade will use its own
-		 * server instance directory.
-		 */
-		string path = tempDir +
-			"/passenger." +
-			toString(SERVER_INSTANCE_DIR_STRUCTURE_MAJOR_VERSION) + "." +
-			toString(SERVER_INSTANCE_DIR_STRUCTURE_MINOR_VERSION) + "." +
-			toString<unsigned long long>(agentsOptions.getPid("web_server_pid"));
-		wo->serverInstanceDir.reset(new ServerInstanceDir(path));
-	} else {
-		wo->serverInstanceDir.reset(new ServerInstanceDir(agentsOptions.get("server_instance_dir")));
-		agentsOptions.set("server_instance_dir", wo->serverInstanceDir->getPath());
+	VariantMap &options = *agentsOptions;
+	vector<string> strset;
+
+	options.set("instance_registry_dir",
+		absolutizePath(options.get("instance_registry_dir")));
+	if (options.get("server_software").find(SERVER_TOKEN_NAME) == string::npos
+	 && options.get("server_software").find(FLYING_PASSENGER_NAME) == string::npos)
+	{
+		options.set("server_software", options.get("server_software") +
+			(" " SERVER_TOKEN_NAME "/" PASSENGER_VERSION));
 	}
-	wo->generation = wo->serverInstanceDir->newGeneration(userSwitching, defaultUser,
-		defaultGroup, webServerWorkerUid, webServerWorkerGid);
-	agentsOptions.set("server_instance_dir", wo->serverInstanceDir->getPath());
-	agentsOptions.setInt("generation_number", wo->generation->getNumber());
-	agentsOptions.set("generation_path", wo->generation->getPath());
 
-	UPDATE_TRACE_POINT();
-	serverInstanceDirToucher = boost::make_shared<ServerInstanceDirToucher>(wo);
+	wo = boost::make_shared<WorkingObjects>();
+	workingObjects = wo.get();
+	wo->resourceLocator = boost::make_shared<ResourceLocator>(agentsOptions->get("passenger_root"));
 
 	UPDATE_TRACE_POINT();
 	lookupDefaultUidGid(wo->defaultUid, wo->defaultGid);
+	wo->cleanupPidfiles = options.getStrSet("cleanup_pidfiles", false);
 
 	UPDATE_TRACE_POINT();
-	wo->cleanupPidfiles = agentsOptions.getStrSet("cleanup_pidfiles", false);
+	InstanceDirectory::CreationOptions instanceOptions;
+	instanceOptions.userSwitching = options.getBool("user_switching");
+	instanceOptions.defaultUid = wo->defaultUid;
+	instanceOptions.defaultGid = wo->defaultGid;
+	instanceOptions.properties["name"] = wo->randomGenerator.generateAsciiString(8);
+	instanceOptions.properties["server_software"] = options.get("server_software");
+	wo->instanceDir = boost::make_shared<InstanceDirectory>(instanceOptions,
+		options.get("instance_registry_dir"));
+	options.set("instance_dir", wo->instanceDir->getPath());
+	instanceDirToucher = boost::make_shared<InstanceDirToucher>(wo);
 
 	UPDATE_TRACE_POINT();
-	wo->loggingAgentAddress  = "unix:" + wo->generation->getPath() + "/logging";
-	wo->loggingAgentPassword = wo->randomGenerator.generateAsciiString(64);
-	wo->loggingAgentAdminAddress  = "unix:" + wo->generation->getPath() + "/logging_admin";
+	string lockFilePath = wo->instanceDir->getPath() + "/lock";
+	wo->lockFile = syscalls::open(lockFilePath.c_str(), O_RDONLY);
+	if (wo->lockFile == -1) {
+		int e = errno;
+		throw FileSystemException("Cannot open " + lockFilePath + " for reading",
+			e, lockFilePath);
+	}
+
+	createFile(wo->instanceDir->getPath() + "/watchdog.pid", toString(getpid()));
 
 	UPDATE_TRACE_POINT();
-	wo->adminToolStatusPassword = wo->randomGenerator.generateAsciiString(MESSAGE_SERVER_MAX_PASSWORD_SIZE);
-	wo->adminToolManipulationPassword = wo->randomGenerator.generateAsciiString(MESSAGE_SERVER_MAX_PASSWORD_SIZE);
-	agentsOptions.set("admin_tool_status_password", wo->adminToolStatusPassword);
-	agentsOptions.set("admin_tool_manipulation_password", wo->adminToolManipulationPassword);
-	if (geteuid() == 0 && !userSwitching) {
-		createFile(wo->generation->getPath() + "/passenger-status-password.txt",
-			wo->adminToolStatusPassword, S_IRUSR, wo->defaultUid, wo->defaultGid);
-		createFile(wo->generation->getPath() + "/admin-manipulation-password.txt",
-			wo->adminToolManipulationPassword, S_IRUSR, wo->defaultUid, wo->defaultGid);
+	string readOnlyAdminPassword = wo->randomGenerator.generateAsciiString(24);
+	string fullAdminPassword = wo->randomGenerator.generateAsciiString(24);
+	if (geteuid() == 0 && !options.getBool("user_switching")) {
+		createFile(wo->instanceDir->getPath() + "/read_only_admin_password.txt",
+			readOnlyAdminPassword, S_IRUSR, wo->defaultUid, wo->defaultGid);
+		createFile(wo->instanceDir->getPath() + "/full_admin_password.txt",
+			fullAdminPassword, S_IRUSR, wo->defaultUid, wo->defaultGid);
 	} else {
-		createFile(wo->generation->getPath() + "/passenger-status-password.txt",
-			wo->adminToolStatusPassword, S_IRUSR | S_IWUSR);
-		createFile(wo->generation->getPath() + "/admin-manipulation-password.txt",
-			wo->adminToolManipulationPassword, S_IRUSR | S_IWUSR);
+		createFile(wo->instanceDir->getPath() + "/read_only_admin_password.txt",
+			readOnlyAdminPassword, S_IRUSR | S_IWUSR);
+		createFile(wo->instanceDir->getPath() + "/full_admin_password.txt",
+			fullAdminPassword, S_IRUSR | S_IWUSR);
 	}
+	options.setDefault("server_pid_file", wo->instanceDir->getPath() + "/server.pid");
+
+	UPDATE_TRACE_POINT();
+	strset = options.getStrSet("server_addresses", false);
+	strset.insert(strset.begin(),
+		"unix:" + wo->instanceDir->getPath() + "/agents.s/server");
+	options.setStrSet("server_addresses", strset);
+	options.setDefault("server_password",
+		wo->randomGenerator.generateAsciiString(24));
+
+	strset = options.getStrSet("server_admin_addresses", false);
+	strset.insert(strset.begin(),
+		"unix:" + wo->instanceDir->getPath() + "/agents.s/server_admin");
+	options.setStrSet("server_admin_addresses", strset);
+
+	UPDATE_TRACE_POINT();
+	options.setDefault("logging_agent_address",
+		"unix:" + wo->instanceDir->getPath() + "/agents.s/logging");
+	options.setDefault("logging_agent_password",
+		wo->randomGenerator.generateAsciiString(24));
+	strset = options.getStrSet("logging_agent_admin_addresses", false);
+	strset.insert(strset.begin(),
+		"unix:" + wo->instanceDir->getPath() + "/agents.s/logging_admin");
+	options.setStrSet("logging_agent_admin_addresses", strset);
+
+	UPDATE_TRACE_POINT();
+	strset = options.getStrSet("logging_agent_authorizations", false);
+	strset.insert(strset.begin(),
+		"readonly:ro_admin:" + wo->instanceDir->getPath() +
+		"/read_only_admin_password.txt");
+	strset.insert(strset.begin(),
+		"full:admin:" + wo->instanceDir->getPath() +
+		"/full_admin_password.txt");
+	options.setStrSet("logging_agent_authorizations", strset);
+
+	strset = options.getStrSet("server_authorizations", false);
+	strset.insert(strset.begin(),
+		"readonly:ro_admin:" + wo->instanceDir->getPath() +
+		"/read_only_admin_password.txt");
+	strset.insert(strset.begin(),
+		"full:admin:" + wo->instanceDir->getPath() +
+		"/full_admin_password.txt");
+	options.setStrSet("server_authorizations", strset);
 }
 
 static void
@@ -641,18 +1039,112 @@ initializeAgentWatchers(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &wa
 	watchers.push_back(make_shared<LoggingAgentWatcher>(wo));
 }
 
+static void
+makeFileWorldReadableAndWritable(const string &path) {
+	int ret;
+
+	do {
+		ret = chmod(path.c_str(), parseModeString("u=rw,g=rw,o=rw"));
+	} while (ret == -1 && errno == EINTR);
+}
+
+static void
+parseAndAddAdminAuthorization(const WorkingObjectsPtr &wo, const string &description) {
+	TRACE_POINT();
+	AdminServer::Authorization auth;
+	vector<string> args;
+
+	split(description, ':', args);
+
+	if (args.size() == 2) {
+		auth.level = AdminServer::FULL;
+		auth.username = args[0];
+		auth.password = strip(readAll(args[1]));
+	} else if (args.size() == 3) {
+		auth.level = AdminServer::parseLevel(args[0]);
+		auth.username = args[1];
+		auth.password = strip(readAll(args[2]));
+	} else {
+		P_BUG("Too many elements in authorization description");
+	}
+
+	wo->adminAuthorizations.push_back(auth);
+}
+
+static void
+initializeAdminServer(const WorkingObjectsPtr &wo) {
+	TRACE_POINT();
+	VariantMap &options = *agentsOptions;
+	vector<string> authorizations = options.getStrSet("watchdog_authorizations", false);
+	vector<string> adminAddresses = options.getStrSet("watchdog_admin_addresses", false);
+	string description;
+
+	UPDATE_TRACE_POINT();
+	authorizations.insert(authorizations.begin(),
+		"readonly:ro_admin:" + wo->instanceDir->getPath() +
+		"/read_only_admin_password.txt");
+	authorizations.insert(authorizations.begin(),
+		"full:admin:" + wo->instanceDir->getPath() +
+		"/full_admin_password.txt");
+	options.setStrSet("watchdog_authorizations", authorizations);
+
+	foreach (description, authorizations) {
+		parseAndAddAdminAuthorization(wo, description);
+	}
+
+	UPDATE_TRACE_POINT();
+	adminAddresses.insert(adminAddresses.begin(),
+		"unix:" + wo->instanceDir->getPath() + "/agents.s/watchdog");
+	options.setStrSet("watchdog_admin_addresses", adminAddresses);
+
+	UPDATE_TRACE_POINT();
+	for (unsigned int i = 0; i < adminAddresses.size(); i++) {
+		P_DEBUG("Admin server will listen on " << adminAddresses[i]);
+		wo->adminServerFds[i] = createServer(adminAddresses[i]);
+		if (getSocketAddressType(adminAddresses[i]) == SAT_UNIX) {
+			makeFileWorldReadableAndWritable(parseUnixSocketAddress(adminAddresses[i]));
+		}
+	}
+
+	UPDATE_TRACE_POINT();
+	wo->bgloop = new BackgroundEventLoop(true, true);
+	wo->serverKitContext = new ServerKit::Context(wo->bgloop->safe);
+	wo->serverKitContext->defaultFileBufferedChannelConfig.bufferDir =
+		absolutizePath(options.get("data_buffer_dir"));
+
+	UPDATE_TRACE_POINT();
+	wo->adminServer = new AdminServer(wo->serverKitContext);
+	wo->adminServer->exitEvent = &wo->exitEvent;
+	wo->adminServer->authorizations = wo->adminAuthorizations;
+	for (unsigned int i = 0; i < adminAddresses.size(); i++) {
+		wo->adminServer->listen(wo->adminServerFds[i]);
+	}
+}
+
 static void
 startAgents(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watchers) {
 	TRACE_POINT();
 	foreach (AgentWatcherPtr watcher, watchers) {
+		P_DEBUG("Starting agent: " << watcher->name());
 		try {
 			watcher->start();
 		} catch (const std::exception &e) {
-			writeArrayMessage(FEEDBACK_FD,
-				"Watchdog startup error",
-				e.what(),
-				NULL);
+			if (feedbackFdAvailable()) {
+				writeArrayMessage(FEEDBACK_FD,
+					"Watchdog startup error",
+					e.what(),
+					NULL);
+			} else {
+				const oxt::tracable_exception *e2 =
+					dynamic_cast<const oxt::tracable_exception *>(&e);
+				if (e2 != NULL) {
+					P_CRITICAL("ERROR: " << e2->what() << "\n" << e2->backtrace());
+				} else {
+					P_CRITICAL("ERROR: " << e.what());
+				}
+			}
 			forceAllAgentsShutdown(wo, watchers);
+			cleanup(wo);
 			exit(1);
 		}
 		// Allow other exceptions to propagate and crash the watchdog.
@@ -670,6 +1162,7 @@ beginWatchingAgents(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watche
 				e.what(),
 				NULL);
 			forceAllAgentsShutdown(wo, watchers);
+			cleanup(wo);
 			exit(1);
 		}
 		// Allow other exceptions to propagate and crash the watchdog.
@@ -678,43 +1171,86 @@ beginWatchingAgents(const WorkingObjectsPtr &wo, vector<AgentWatcherPtr> &watche
 
 static void
 reportAgentsInformation(const WorkingObjectsPtr &wo, const vector<AgentWatcherPtr> &watchers) {
+	if (feedbackFdAvailable()) {
+		TRACE_POINT();
+		VariantMap report;
+
+		report.set("instance_dir", wo->instanceDir->getPath());
+
+		foreach (AgentWatcherPtr watcher, watchers) {
+			watcher->reportAgentsInformation(report);
+		}
+
+		report.writeToFd(FEEDBACK_FD, "Agents information");
+	}
+}
+
+static void
+finalizeInstanceDir(const WorkingObjectsPtr &wo) {
 	TRACE_POINT();
-	VariantMap report;
+	#ifdef HAVE_FLOCK
+		if (flock(wo->lockFile, LOCK_EX) == -1) {
+			int e = errno;
+			throw SystemException("Cannot obtain exclusive lock on the "
+				"instance directory lock file", e);
+		}
+	#endif
+	wo->instanceDir->finalizeCreation();
+}
 
-	report
-		.set("server_instance_dir", wo->serverInstanceDir->getPath())
-		.setInt("generation", wo->generation->getNumber());
+static void
+cleanup(const WorkingObjectsPtr &wo) {
+	TRACE_POINT();
 
-	foreach (AgentWatcherPtr watcher, watchers) {
-		watcher->reportAgentsInformation(report);
+	// We need to call destroy() explicitly because of circular references.
+	if (wo->instanceDir != NULL && wo->instanceDir->isOwner()) {
+		wo->instanceDir->destroy();
+		wo->instanceDir.reset();
 	}
 
-	report.writeToFd(FEEDBACK_FD, "Agents information");
+	killCleanupPids(wo);
+	deletePidFile(wo);
 }
 
 int
-main(int argc, char *argv[]) {
+watchdogMain(int argc, char *argv[]) {
 	initializeBareEssentials(argc, argv);
-	P_DEBUG("Starting Watchdog...");
+	setAgentsOptionsDefaults();
+	sanityCheckOptions();
+	P_NOTICE("Starting " AGENT_EXE " watchdog...");
+	P_DEBUG("Watchdog options: " << agentsOptions->inspect());
 	WorkingObjectsPtr wo;
-	ServerInstanceDirToucherPtr serverInstanceDirToucher;
+	InstanceDirToucherPtr instanceDirToucher;
 	vector<AgentWatcherPtr> watchers;
 
 	try {
 		TRACE_POINT();
-		initializeOptions();
 		maybeSetsid();
-		initializeWorkingObjects(wo, serverInstanceDirToucher);
+		maybeDaemonize();
+		createPidFile();
+		lowerPrivilege();
+		initializeWorkingObjects(wo, instanceDirToucher);
 		initializeAgentWatchers(wo, watchers);
+		initializeAdminServer(wo);
 		UPDATE_TRACE_POINT();
 		runHookScriptAndThrowOnError("before_watchdog_initialization");
 	} catch (const std::exception &e) {
-		writeArrayMessage(FEEDBACK_FD,
-			"Watchdog startup error",
-			e.what(),
-			NULL);
+		if (feedbackFdAvailable()) {
+			writeArrayMessage(FEEDBACK_FD,
+				"Watchdog startup error",
+				e.what(),
+				NULL);
+		} else {
+			const oxt::tracable_exception *e2 =
+				dynamic_cast<const oxt::tracable_exception *>(&e);
+			if (e2 != NULL) {
+				P_CRITICAL("ERROR: " << e2->what() << "\n" << e2->backtrace());
+			} else {
+				P_CRITICAL("ERROR: " << e.what());
+			}
+		}
 		if (wo != NULL) {
-			killCleanupPids(wo);
+			cleanup(wo);
 		}
 		return 1;
 	}
@@ -725,15 +1261,16 @@ main(int argc, char *argv[]) {
 		startAgents(wo, watchers);
 		beginWatchingAgents(wo, watchers);
 		reportAgentsInformation(wo, watchers);
-		P_INFO("All Phusion Passenger agents started!");
+		finalizeInstanceDir(wo);
+		P_INFO("All " PROGRAM_NAME " agents started!");
 		UPDATE_TRACE_POINT();
 		runHookScriptAndThrowOnError("after_watchdog_initialization");
 
 		UPDATE_TRACE_POINT();
 		this_thread::disable_interruption di;
 		this_thread::disable_syscall_interruption dsi;
-		bool exitGracefully = waitForStarterProcessOrWatchers(wo, watchers);
-		if (exitGracefully) {
+		bool shouldExitGracefully = waitForStarterProcessOrWatchers(wo, watchers);
+		if (shouldExitGracefully) {
 			/* Fork a child process which cleans up all the agent processes in
 			 * the background and exit this watchdog process so that we don't block
 			 * the web server.
@@ -746,18 +1283,22 @@ main(int argc, char *argv[]) {
 		runHookScriptAndThrowOnError("after_watchdog_shutdown");
 		UPDATE_TRACE_POINT();
 		AgentWatcher::stopWatching(watchers);
-		if (exitGracefully) {
+		if (shouldExitGracefully) {
 			UPDATE_TRACE_POINT();
 			cleanupAgentsInBackground(wo, watchers, argv);
+			// Child process will call cleanup()
 		} else {
 			UPDATE_TRACE_POINT();
 			forceAllAgentsShutdown(wo, watchers);
+			cleanup(wo);
 		}
 		UPDATE_TRACE_POINT();
 		runHookScriptAndThrowOnError("after_watchdog_shutdown");
-		return exitGracefully ? 0 : 1;
+
+		return shouldExitGracefully ? 0 : 1;
 	} catch (const tracable_exception &e) {
-		P_ERROR(e.what() << "\n" << e.backtrace());
+		P_CRITICAL("ERROR: " << e.what() << "\n" << e.backtrace());
+		cleanup(wo);
 		return 1;
 	}
 }