[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

STINNER Victor added the comment: > I'm reducing the severity from release blocker to high and keep the ticket in > pending to give Eric a change to review the commits. Python 3.8.0 is released with the fix. It's now time to close the issue. -- stage: commit review -> resolved

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: https://github.com/freeipa/freeipa/pull/3769 should address the issue. -- ___ Python tracker ___

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: I'll address the issue in FreeIPA. The ipautil.run() function is a helper around subprocess.Popen. The function always installs a preexec_fn in case it needs to change umask or drop priviliges. The WSGI server does not need these features. --

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Adam Williamson added the comment: It's this function: https://github.com/freeipa/freeipa/blob/master/ipalib/install/kinit.py#L66 The function `run` is imported from `ipapython.ipautil`, it's defined here: https://github.com/freeipa/freeipa/blob/master/ipapython/ipautil.py#L391 all of this

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Gregory P. Smith added the comment: preexec_fn is fundamentally unsupportable. what code is using it, there should be a way not to rely on that. -- ___ Python tracker ___

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Adam Williamson added the comment: Well, now our (Fedora QA's) automated testing of FreeIPA is showing what looks like a problem with preexec_fn (rather than fork) being disallowed: https://bugzilla.redhat.com/show_bug.cgi?id=1759290 Login to the FreeIPA webUI is failing, and at the time it

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: Thanks Victor and Gregory! I'm reducing the severity from release blocker to high and keep the ticket in pending to give Eric a change to review the commits. -- priority: release blocker -> high resolution: -> fixed stage: patch review -> commit

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

miss-islington added the comment: New changeset 03c52f2f63a8abeb4afb75e9da46c7d6c0a8afd5 by Miss Islington (bot) in branch '3.8': bpo-37951: Lift subprocess's fork() restriction (GH-15544) https://github.com/python/cpython/commit/03c52f2f63a8abeb4afb75e9da46c7d6c0a8afd5 -- nosy:

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Change by miss-islington : -- pull_requests: +15229 pull_request: https://github.com/python/cpython/pull/15554 ___ Python tracker ___

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: New changeset 98d90f745d35d5d07bffcb46788b50e05eea56c6 by Christian Heimes in branch 'master': bpo-37951: Lift subprocess's fork() restriction (GH-15544) https://github.com/python/cpython/commit/98d90f745d35d5d07bffcb46788b50e05eea56c6 --

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: I have created a PR that implements Greg's proposal https://bugs.python.org/issue34651#msg325302 -- type: -> behavior ___ Python tracker

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Change by Christian Heimes : -- keywords: +patch pull_requests: +15221 stage: -> patch review pull_request: https://github.com/python/cpython/pull/15544 ___ Python tracker

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Gregory P. Smith added the comment: FWIW, _posixsubprocess.fork_exec() should be safe to allow. The only thing within it to disallow, if you're going to bother to check this at all, is any use of the legacy preexec_fn support. -- nosy: +gregory.p.smith

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Łukasz Langa added the comment: Christian, you're right to treat this as Release Blocker. Let's have this fixed. Assigning Eric? -- assignee: -> eric.snow ___ Python tracker

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

Christian Heimes added the comment: It's a bit more complicated. FreeIPA uses cryptography, which uses asn1crypto, which uses ctypes, which is broken in mod_wsgi due to bpo-34651. It's not just FreeIPA that is affected by the issue. Any application running in mod_wsgi is potentially affected

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

STINNER Victor added the comment: subprocess still work in subinterpreters in Python 3.8 if posix_spawn() can be used, but posix_spawn() is only used under some conditions: https://docs.python.org/dev/whatsnew/3.8.html#optimizations "The subprocess module can now use the os.posix_spawn()

[issue37951] Disallow fork in a subinterpreter broke subprocesses in mod_wsgi daemon mode

New submission from Christian Heimes : BPO https://bugs.python.org/issue34651 disabled fork in subinterpreters. The patch also disabled fork() in _posixsubprocess.fork_exec(). This broke the ability to spawn subprocesses in mod_wsgi daemons, which use subinterpreters. Any attempt to spawn