pidfd 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pidfd-0.1.0/.github/CODEOWNERS +3 -0
- pidfd-0.1.0/.github/dependabot.yml +16 -0
- pidfd-0.1.0/.github/workflows/ci.yml +59 -0
- pidfd-0.1.0/.github/workflows/codeql.yml +35 -0
- pidfd-0.1.0/.github/workflows/dependency-review.yml +22 -0
- pidfd-0.1.0/.github/workflows/release.yml +63 -0
- pidfd-0.1.0/.github/workflows/scorecard.yml +42 -0
- pidfd-0.1.0/.github/workflows/zizmor.yml +28 -0
- pidfd-0.1.0/.gitignore +11 -0
- pidfd-0.1.0/CHANGELOG.md +22 -0
- pidfd-0.1.0/CONTRIBUTING.md +19 -0
- pidfd-0.1.0/LICENSE +12 -0
- pidfd-0.1.0/Makefile +16 -0
- pidfd-0.1.0/PKG-INFO +79 -0
- pidfd-0.1.0/README.md +51 -0
- pidfd-0.1.0/SECURITY.md +6 -0
- pidfd-0.1.0/pyproject.toml +114 -0
- pidfd-0.1.0/src/pidfd/__init__.py +41 -0
- pidfd-0.1.0/src/pidfd/_syscall.py +163 -0
- pidfd-0.1.0/src/pidfd/errors.py +10 -0
- pidfd-0.1.0/src/pidfd/pidfd.py +222 -0
- pidfd-0.1.0/src/pidfd/py.typed +0 -0
- pidfd-0.1.0/tests/__init__.py +1 -0
- pidfd-0.1.0/tests/conftest.py +7 -0
- pidfd-0.1.0/tests/test_api.py +275 -0
- pidfd-0.1.0/tests/test_pidfd.py +301 -0
- pidfd-0.1.0/uv.lock +760 -0
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: github-actions
|
|
4
|
+
directory: /
|
|
5
|
+
schedule:
|
|
6
|
+
interval: weekly
|
|
7
|
+
cooldown:
|
|
8
|
+
default-days: 7
|
|
9
|
+
open-pull-requests-limit: 5
|
|
10
|
+
- package-ecosystem: uv
|
|
11
|
+
directory: /
|
|
12
|
+
schedule:
|
|
13
|
+
interval: weekly
|
|
14
|
+
cooldown:
|
|
15
|
+
default-days: 7
|
|
16
|
+
open-pull-requests-limit: 5
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: "9 7 * * 1"
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
lint:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
steps:
|
|
16
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
17
|
+
with:
|
|
18
|
+
egress-policy: audit
|
|
19
|
+
|
|
20
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
21
|
+
with:
|
|
22
|
+
persist-credentials: false
|
|
23
|
+
|
|
24
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
25
|
+
with:
|
|
26
|
+
version: "0.11.32"
|
|
27
|
+
enable-cache: true
|
|
28
|
+
|
|
29
|
+
- run: uv sync --locked
|
|
30
|
+
|
|
31
|
+
- run: uv run ruff check .
|
|
32
|
+
- run: uv run ruff format --check .
|
|
33
|
+
- run: uv run bandit -r src/
|
|
34
|
+
- run: uv run mypy
|
|
35
|
+
- run: uvx ty check src tests
|
|
36
|
+
|
|
37
|
+
test:
|
|
38
|
+
runs-on: ubuntu-latest
|
|
39
|
+
strategy:
|
|
40
|
+
fail-fast: false
|
|
41
|
+
matrix:
|
|
42
|
+
python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
|
|
43
|
+
steps:
|
|
44
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
45
|
+
with:
|
|
46
|
+
egress-policy: audit
|
|
47
|
+
|
|
48
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
49
|
+
with:
|
|
50
|
+
persist-credentials: false
|
|
51
|
+
|
|
52
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
53
|
+
with:
|
|
54
|
+
version: "0.11.32"
|
|
55
|
+
enable-cache: true
|
|
56
|
+
|
|
57
|
+
- run: uv python install ${{ matrix.python }}
|
|
58
|
+
- run: uv sync --locked --python ${{ matrix.python }}
|
|
59
|
+
- run: uv run pytest --cov
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
name: CodeQL
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: "17 3 * * 4"
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
analyze:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
permissions:
|
|
16
|
+
actions: read
|
|
17
|
+
contents: read
|
|
18
|
+
security-events: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
29
|
+
with:
|
|
30
|
+
languages: python
|
|
31
|
+
queries: security-and-quality
|
|
32
|
+
|
|
33
|
+
- uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
34
|
+
with:
|
|
35
|
+
category: "/language:python"
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
name: Dependency Review
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
pull_request:
|
|
5
|
+
|
|
6
|
+
permissions: {}
|
|
7
|
+
|
|
8
|
+
jobs:
|
|
9
|
+
dependency-review:
|
|
10
|
+
runs-on: ubuntu-latest
|
|
11
|
+
permissions:
|
|
12
|
+
contents: read
|
|
13
|
+
steps:
|
|
14
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
15
|
+
with:
|
|
16
|
+
egress-policy: audit
|
|
17
|
+
|
|
18
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
19
|
+
with:
|
|
20
|
+
persist-credentials: false
|
|
21
|
+
|
|
22
|
+
- uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
name: Release
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
tags: ["v*"]
|
|
6
|
+
|
|
7
|
+
permissions: {}
|
|
8
|
+
|
|
9
|
+
jobs:
|
|
10
|
+
release:
|
|
11
|
+
runs-on: ubuntu-latest
|
|
12
|
+
environment:
|
|
13
|
+
name: pypi
|
|
14
|
+
url: https://pypi.org/p/pidfd
|
|
15
|
+
permissions:
|
|
16
|
+
contents: write
|
|
17
|
+
id-token: write
|
|
18
|
+
attestations: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
29
|
+
with:
|
|
30
|
+
version: "0.11.32"
|
|
31
|
+
|
|
32
|
+
- run: uv sync --locked
|
|
33
|
+
|
|
34
|
+
- name: Verify tag matches package version
|
|
35
|
+
run: |
|
|
36
|
+
tag="${GITHUB_REF_NAME#v}"
|
|
37
|
+
version="$(uv run python -c 'import pidfd; print(pidfd.__version__)')"
|
|
38
|
+
if [ "$tag" != "$version" ]; then
|
|
39
|
+
echo "tag $tag does not match package version $version" >&2
|
|
40
|
+
exit 1
|
|
41
|
+
fi
|
|
42
|
+
|
|
43
|
+
- run: uv build
|
|
44
|
+
|
|
45
|
+
- name: Attest build provenance
|
|
46
|
+
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
|
|
47
|
+
with:
|
|
48
|
+
subject-path: dist/*
|
|
49
|
+
|
|
50
|
+
- uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
|
|
51
|
+
with:
|
|
52
|
+
attestations: true
|
|
53
|
+
|
|
54
|
+
- name: Create GitHub release
|
|
55
|
+
env:
|
|
56
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
57
|
+
run: |
|
|
58
|
+
gh release create "${GITHUB_REF_NAME}" \
|
|
59
|
+
--repo "${GITHUB_REPOSITORY}" \
|
|
60
|
+
--verify-tag \
|
|
61
|
+
--title "${GITHUB_REF_NAME}" \
|
|
62
|
+
--generate-notes \
|
|
63
|
+
dist/*
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
name: OpenSSF Scorecard
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
branch_protection_rule:
|
|
5
|
+
push:
|
|
6
|
+
branches: [master]
|
|
7
|
+
workflow_dispatch:
|
|
8
|
+
schedule:
|
|
9
|
+
- cron: "42 5 * * 6"
|
|
10
|
+
|
|
11
|
+
permissions: read-all
|
|
12
|
+
|
|
13
|
+
jobs:
|
|
14
|
+
analysis:
|
|
15
|
+
runs-on: ubuntu-latest
|
|
16
|
+
permissions:
|
|
17
|
+
security-events: write
|
|
18
|
+
id-token: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
|
|
29
|
+
with:
|
|
30
|
+
results_file: results.sarif
|
|
31
|
+
results_format: sarif
|
|
32
|
+
publish_results: true
|
|
33
|
+
|
|
34
|
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
35
|
+
with:
|
|
36
|
+
name: SARIF file
|
|
37
|
+
path: results.sarif
|
|
38
|
+
retention-days: 5
|
|
39
|
+
|
|
40
|
+
- uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
41
|
+
with:
|
|
42
|
+
sarif_file: results.sarif
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
name: zizmor
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
paths: [.github/**]
|
|
7
|
+
pull_request:
|
|
8
|
+
paths: [.github/**]
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
zizmor:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
permissions:
|
|
16
|
+
security-events: write
|
|
17
|
+
steps:
|
|
18
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
19
|
+
with:
|
|
20
|
+
egress-policy: audit
|
|
21
|
+
|
|
22
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
23
|
+
with:
|
|
24
|
+
persist-credentials: false
|
|
25
|
+
|
|
26
|
+
- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
|
27
|
+
with:
|
|
28
|
+
advanced-security: false
|
pidfd-0.1.0/.gitignore
ADDED
pidfd-0.1.0/CHANGELOG.md
ADDED
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## [0.1.0] - Unreleased
|
|
4
|
+
|
|
5
|
+
Initial release.
|
|
6
|
+
|
|
7
|
+
- PidFd class wrapping pidfd_open(2), with fileno(), close(), detach(),
|
|
8
|
+
context manager support and OpenFlag bits (NONBLOCK, THREAD).
|
|
9
|
+
- signal() via pidfd_send_signal(2) with optional SigInfo and the
|
|
10
|
+
SignalFlag scope bits, plus the pidfd_send_signal() module-level
|
|
11
|
+
convenience.
|
|
12
|
+
- wait() via the raw waitid(2) syscall with idtype P_PIDFD, returning a
|
|
13
|
+
typed WaitResult. WaitFlag and WaitCode enums cover the linux/wait.h
|
|
14
|
+
constants.
|
|
15
|
+
- getfd() via pidfd_getfd(2) for duplicating another process's file
|
|
16
|
+
descriptors under the PTRACE_MODE_ATTACH_REALCREDS rules.
|
|
17
|
+
- SigInfo ctypes model of the kernel siginfo_t for waitid output and
|
|
18
|
+
signal input.
|
|
19
|
+
- Per-architecture syscall numbers for x86_64, i386, aarch64, riscv,
|
|
20
|
+
loongarch64, arm, powerpc and s390. Unknown arches and the x32 ABI
|
|
21
|
+
raise UnsupportedError.
|
|
22
|
+
- Typed errors: PidFdError and UnsupportedError carry the kernel errno.
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
# Contributing
|
|
2
|
+
|
|
3
|
+
Report bugs through GitHub issues. Security reports go to
|
|
4
|
+
security@quad4.io (see SECURITY.md).
|
|
5
|
+
|
|
6
|
+
## Setup
|
|
7
|
+
|
|
8
|
+
uv sync
|
|
9
|
+
make check
|
|
10
|
+
|
|
11
|
+
`make check` runs the full local gate: ruff lint and format, bandit,
|
|
12
|
+
mypy strict, ty, and pytest with coverage.
|
|
13
|
+
|
|
14
|
+
## Conventions
|
|
15
|
+
|
|
16
|
+
- No runtime dependencies unless the project genuinely needs one.
|
|
17
|
+
- Source files start with the SPDX license identifier.
|
|
18
|
+
- Public API changes need tests.
|
|
19
|
+
- Commit messages: short, imperative, formal.
|
pidfd-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
Copyright (c) 2026 Quad4
|
|
2
|
+
|
|
3
|
+
Permission to use, copy, modify, and/or distribute this software for any purpose
|
|
4
|
+
with or without fee is hereby granted.
|
|
5
|
+
|
|
6
|
+
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
7
|
+
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
8
|
+
FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
9
|
+
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
10
|
+
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
11
|
+
OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
12
|
+
PERFORMANCE OF THIS SOFTWARE.
|
pidfd-0.1.0/Makefile
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
.PHONY: check lint test build
|
|
2
|
+
|
|
3
|
+
check: lint test
|
|
4
|
+
|
|
5
|
+
lint:
|
|
6
|
+
uv run ruff check .
|
|
7
|
+
uv run ruff format --check .
|
|
8
|
+
uv run bandit -r src/
|
|
9
|
+
uv run mypy
|
|
10
|
+
uvx ty check src tests
|
|
11
|
+
|
|
12
|
+
test:
|
|
13
|
+
uv run pytest --cov --cov-report=term-missing
|
|
14
|
+
|
|
15
|
+
build:
|
|
16
|
+
uv build
|
pidfd-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
Metadata-Version: 2.5
|
|
2
|
+
Name: pidfd
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Python bindings for Linux pidfds
|
|
5
|
+
Project-URL: Homepage, https://quad4.io
|
|
6
|
+
Project-URL: Repository, https://github.com/Quad4-Software/pidfd
|
|
7
|
+
Project-URL: Issues, https://github.com/Quad4-Software/pidfd/issues
|
|
8
|
+
Project-URL: Changelog, https://github.com/Quad4-Software/pidfd/blob/master/CHANGELOG.md
|
|
9
|
+
Author: Quad4
|
|
10
|
+
License-Expression: 0BSD
|
|
11
|
+
License-File: LICENSE
|
|
12
|
+
Keywords: linux,pidfd,process,signals
|
|
13
|
+
Classifier: Development Status :: 4 - Beta
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: License :: OSI Approved :: BSD License
|
|
16
|
+
Classifier: Operating System :: POSIX :: Linux
|
|
17
|
+
Classifier: Programming Language :: Python :: 3
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
23
|
+
Classifier: Topic :: Security
|
|
24
|
+
Classifier: Topic :: System :: Operating System Kernels :: Linux
|
|
25
|
+
Classifier: Typing :: Typed
|
|
26
|
+
Requires-Python: >=3.10
|
|
27
|
+
Description-Content-Type: text/markdown
|
|
28
|
+
|
|
29
|
+
# pidfd
|
|
30
|
+
|
|
31
|
+
[](https://github.com/Quad4-Software/pidfd/actions/workflows/ci.yml)
|
|
32
|
+
[](https://github.com/Quad4-Software/pidfd/actions/workflows/codeql.yml)
|
|
33
|
+
[](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/pidfd)
|
|
34
|
+
[](https://pypi.org/project/pidfd/)
|
|
35
|
+
[](LICENSE)
|
|
36
|
+
|
|
37
|
+
Dependency-free Python bindings for Linux pidfds. A pidfd is a file
|
|
38
|
+
descriptor referring to a process: a stable handle that can never hit a
|
|
39
|
+
recycled pid, becomes readable when the task exits, can be waited on
|
|
40
|
+
with waitid(2), and can duplicate the task's file descriptors with
|
|
41
|
+
pidfd_getfd(2). Everything goes through pidfd_open(2),
|
|
42
|
+
pidfd_send_signal(2), pidfd_getfd(2) and waitid(2) via ctypes. There
|
|
43
|
+
are no runtime dependencies.
|
|
44
|
+
|
|
45
|
+
Requires Python 3.10+ and Linux.
|
|
46
|
+
|
|
47
|
+
## Install
|
|
48
|
+
|
|
49
|
+
pip install pidfd
|
|
50
|
+
|
|
51
|
+
## Usage
|
|
52
|
+
|
|
53
|
+
```python
|
|
54
|
+
import select, signal, subprocess
|
|
55
|
+
from pidfd import PidFd, WaitCode
|
|
56
|
+
|
|
57
|
+
proc = subprocess.Popen(["sleep", "30"])
|
|
58
|
+
with PidFd.open(proc.pid) as pf:
|
|
59
|
+
# poll(2) reports the fd readable once the task is a zombie
|
|
60
|
+
pf.signal(signal.SIGKILL)
|
|
61
|
+
|
|
62
|
+
poller = select.poll()
|
|
63
|
+
poller.register(pf.fileno(), select.POLLIN)
|
|
64
|
+
poller.poll()
|
|
65
|
+
|
|
66
|
+
result = pf.wait() # waitid(P_PIDFD)
|
|
67
|
+
assert result.code == WaitCode.CLD_KILLED
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
`PidFd.open(pid, OpenFlag.NONBLOCK)` makes `wait()` fail with EAGAIN
|
|
71
|
+
instead of blocking. `pf.getfd(fd)` duplicates one of the target's open
|
|
72
|
+
fds (ptrace access rules apply).
|
|
73
|
+
|
|
74
|
+
## Development
|
|
75
|
+
|
|
76
|
+
uv sync --group dev
|
|
77
|
+
make check
|
|
78
|
+
|
|
79
|
+
License: 0BSD. Quad4 Software, https://quad4.io
|
pidfd-0.1.0/README.md
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# pidfd
|
|
2
|
+
|
|
3
|
+
[](https://github.com/Quad4-Software/pidfd/actions/workflows/ci.yml)
|
|
4
|
+
[](https://github.com/Quad4-Software/pidfd/actions/workflows/codeql.yml)
|
|
5
|
+
[](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/pidfd)
|
|
6
|
+
[](https://pypi.org/project/pidfd/)
|
|
7
|
+
[](LICENSE)
|
|
8
|
+
|
|
9
|
+
Dependency-free Python bindings for Linux pidfds. A pidfd is a file
|
|
10
|
+
descriptor referring to a process: a stable handle that can never hit a
|
|
11
|
+
recycled pid, becomes readable when the task exits, can be waited on
|
|
12
|
+
with waitid(2), and can duplicate the task's file descriptors with
|
|
13
|
+
pidfd_getfd(2). Everything goes through pidfd_open(2),
|
|
14
|
+
pidfd_send_signal(2), pidfd_getfd(2) and waitid(2) via ctypes. There
|
|
15
|
+
are no runtime dependencies.
|
|
16
|
+
|
|
17
|
+
Requires Python 3.10+ and Linux.
|
|
18
|
+
|
|
19
|
+
## Install
|
|
20
|
+
|
|
21
|
+
pip install pidfd
|
|
22
|
+
|
|
23
|
+
## Usage
|
|
24
|
+
|
|
25
|
+
```python
|
|
26
|
+
import select, signal, subprocess
|
|
27
|
+
from pidfd import PidFd, WaitCode
|
|
28
|
+
|
|
29
|
+
proc = subprocess.Popen(["sleep", "30"])
|
|
30
|
+
with PidFd.open(proc.pid) as pf:
|
|
31
|
+
# poll(2) reports the fd readable once the task is a zombie
|
|
32
|
+
pf.signal(signal.SIGKILL)
|
|
33
|
+
|
|
34
|
+
poller = select.poll()
|
|
35
|
+
poller.register(pf.fileno(), select.POLLIN)
|
|
36
|
+
poller.poll()
|
|
37
|
+
|
|
38
|
+
result = pf.wait() # waitid(P_PIDFD)
|
|
39
|
+
assert result.code == WaitCode.CLD_KILLED
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
`PidFd.open(pid, OpenFlag.NONBLOCK)` makes `wait()` fail with EAGAIN
|
|
43
|
+
instead of blocking. `pf.getfd(fd)` duplicates one of the target's open
|
|
44
|
+
fds (ptrace access rules apply).
|
|
45
|
+
|
|
46
|
+
## Development
|
|
47
|
+
|
|
48
|
+
uv sync --group dev
|
|
49
|
+
make check
|
|
50
|
+
|
|
51
|
+
License: 0BSD. Quad4 Software, https://quad4.io
|
pidfd-0.1.0/SECURITY.md
ADDED
|
@@ -0,0 +1,114 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["hatchling"]
|
|
3
|
+
build-backend = "hatchling.build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "pidfd"
|
|
7
|
+
dynamic = ["version"]
|
|
8
|
+
description = "Python bindings for Linux pidfds"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.10"
|
|
11
|
+
license = "0BSD"
|
|
12
|
+
authors = [{ name = "Quad4" }]
|
|
13
|
+
keywords = ["pidfd", "linux", "process", "signals"]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 4 - Beta",
|
|
16
|
+
"Intended Audience :: Developers",
|
|
17
|
+
"License :: OSI Approved :: BSD License",
|
|
18
|
+
"Operating System :: POSIX :: Linux",
|
|
19
|
+
"Programming Language :: Python :: 3",
|
|
20
|
+
"Programming Language :: Python :: 3.10",
|
|
21
|
+
"Programming Language :: Python :: 3.11",
|
|
22
|
+
"Programming Language :: Python :: 3.12",
|
|
23
|
+
"Programming Language :: Python :: 3.13",
|
|
24
|
+
"Programming Language :: Python :: 3.14",
|
|
25
|
+
"Topic :: Security",
|
|
26
|
+
"Topic :: System :: Operating System Kernels :: Linux",
|
|
27
|
+
"Typing :: Typed",
|
|
28
|
+
]
|
|
29
|
+
dependencies = []
|
|
30
|
+
|
|
31
|
+
[project.urls]
|
|
32
|
+
Homepage = "https://quad4.io"
|
|
33
|
+
Repository = "https://github.com/Quad4-Software/pidfd"
|
|
34
|
+
Issues = "https://github.com/Quad4-Software/pidfd/issues"
|
|
35
|
+
Changelog = "https://github.com/Quad4-Software/pidfd/blob/master/CHANGELOG.md"
|
|
36
|
+
|
|
37
|
+
[tool.hatch.version]
|
|
38
|
+
path = "src/pidfd/__init__.py"
|
|
39
|
+
|
|
40
|
+
[dependency-groups]
|
|
41
|
+
dev = [
|
|
42
|
+
"pytest>=9.1.1",
|
|
43
|
+
"pytest-cov>=7.1.0",
|
|
44
|
+
"ruff>=0.16.8",
|
|
45
|
+
"bandit>=1.9.4",
|
|
46
|
+
"mypy>=2.3.1",
|
|
47
|
+
]
|
|
48
|
+
|
|
49
|
+
[tool.ruff]
|
|
50
|
+
target-version = "py310"
|
|
51
|
+
src = ["src", "tests"]
|
|
52
|
+
|
|
53
|
+
[tool.ruff.lint]
|
|
54
|
+
select = [
|
|
55
|
+
"E", "W", # pycodestyle
|
|
56
|
+
"F", # pyflakes
|
|
57
|
+
"I", # isort
|
|
58
|
+
"N", # pep8-naming
|
|
59
|
+
"UP", # pyupgrade
|
|
60
|
+
"YTT", # sys.version misuse
|
|
61
|
+
"FA", # future annotations
|
|
62
|
+
"A", # builtins shadowing
|
|
63
|
+
"B", # flake8-bugbear
|
|
64
|
+
"BLE", # blind except
|
|
65
|
+
"C4", # comprehensions
|
|
66
|
+
"C90", # mccabe complexity
|
|
67
|
+
"DTZ", # timezone-aware datetimes
|
|
68
|
+
"ERA", # commented-out code
|
|
69
|
+
"FURB", # refurb
|
|
70
|
+
"G", # logging format
|
|
71
|
+
"ICN", # import conventions
|
|
72
|
+
"ISC", # implicit string concat
|
|
73
|
+
"LOG", # logging
|
|
74
|
+
"PERF", # perflint
|
|
75
|
+
"PGH", # pygrep hooks
|
|
76
|
+
"PIE", # misc lints
|
|
77
|
+
"PT", # pytest style
|
|
78
|
+
"PTH", # pathlib
|
|
79
|
+
"RET", # return
|
|
80
|
+
"RSE", # raise/return
|
|
81
|
+
"S", # bandit rules
|
|
82
|
+
"SIM", # simplify
|
|
83
|
+
"SLOT", # __slots__
|
|
84
|
+
"T20", # print
|
|
85
|
+
"TRY", # exception handling
|
|
86
|
+
"RUF", # ruff-specific
|
|
87
|
+
]
|
|
88
|
+
ignore = [
|
|
89
|
+
"ISC001", # single-line implicit concat conflicts with the formatter
|
|
90
|
+
"TRY003", # long messages in raise calls are fine
|
|
91
|
+
]
|
|
92
|
+
|
|
93
|
+
[tool.ruff.lint.per-file-ignores]
|
|
94
|
+
"tests/*" = ["S101", "S603"]
|
|
95
|
+
|
|
96
|
+
[tool.mypy]
|
|
97
|
+
strict = true
|
|
98
|
+
files = ["src", "tests"]
|
|
99
|
+
|
|
100
|
+
[tool.bandit]
|
|
101
|
+
exclude_dirs = ["tests"]
|
|
102
|
+
|
|
103
|
+
[tool.coverage.run]
|
|
104
|
+
branch = true
|
|
105
|
+
source = ["src/pidfd"]
|
|
106
|
+
|
|
107
|
+
[tool.coverage.report]
|
|
108
|
+
show_missing = true
|
|
109
|
+
fail_under = 80
|
|
110
|
+
|
|
111
|
+
[tool.pytest.ini_options]
|
|
112
|
+
testpaths = ["tests"]
|
|
113
|
+
xfail_strict = true
|
|
114
|
+
filterwarnings = ["error"]
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
# SPDX-License-Identifier: 0BSD
|
|
2
|
+
"""Python bindings for Linux pidfds.
|
|
3
|
+
|
|
4
|
+
A pidfd is a file descriptor referring to a process. It is a stable
|
|
5
|
+
handle: signaling through it can never hit a recycled pid, it becomes
|
|
6
|
+
pollable-readable when the task exits, and it can be waited on with
|
|
7
|
+
waitid(2) or used to duplicate the task's file descriptors with
|
|
8
|
+
pidfd_getfd(2). Everything goes through raw syscalls via ctypes. There
|
|
9
|
+
are no runtime dependencies.
|
|
10
|
+
|
|
11
|
+
Kernel references: pidfd_open(2), pidfd_send_signal(2), pidfd_getfd(2),
|
|
12
|
+
waitid(2).
|
|
13
|
+
"""
|
|
14
|
+
|
|
15
|
+
from .errors import PidFdError, UnsupportedError
|
|
16
|
+
from .pidfd import (
|
|
17
|
+
OpenFlag,
|
|
18
|
+
PidFd,
|
|
19
|
+
SigInfo,
|
|
20
|
+
SignalFlag,
|
|
21
|
+
WaitCode,
|
|
22
|
+
WaitFlag,
|
|
23
|
+
WaitResult,
|
|
24
|
+
pidfd_send_signal,
|
|
25
|
+
)
|
|
26
|
+
|
|
27
|
+
__version__ = "0.1.0"
|
|
28
|
+
|
|
29
|
+
__all__ = [
|
|
30
|
+
"OpenFlag",
|
|
31
|
+
"PidFd",
|
|
32
|
+
"PidFdError",
|
|
33
|
+
"SigInfo",
|
|
34
|
+
"SignalFlag",
|
|
35
|
+
"UnsupportedError",
|
|
36
|
+
"WaitCode",
|
|
37
|
+
"WaitFlag",
|
|
38
|
+
"WaitResult",
|
|
39
|
+
"__version__",
|
|
40
|
+
"pidfd_send_signal",
|
|
41
|
+
]
|