|
| 1 | +use std::sync::Mutex; |
| 2 | +use std::sync::atomic::{AtomicBool, Ordering}; |
| 3 | +use std::thread; |
| 4 | +use std::time::Duration; |
| 5 | + |
| 6 | +lazy_static! { |
| 7 | + /// Global flag indicating shutdown has been requested |
| 8 | + static ref SHUTDOWN_FLAG: AtomicBool = AtomicBool::new(false); |
| 9 | + |
| 10 | + /// List of child process IDs that need to be terminated during shutdown |
| 11 | + static ref CHILD_PROCESSES: Mutex<Vec<u32>> = Mutex::new(Vec::new()); |
| 12 | +} |
| 13 | + |
| 14 | +/// Check if shutdown has been requested |
| 15 | +pub fn is_shutting_down() -> bool { |
| 16 | + SHUTDOWN_FLAG.load(Ordering::SeqCst) |
| 17 | +} |
| 18 | + |
| 19 | +/// Signal that shutdown should begin |
| 20 | +pub fn request_shutdown() { |
| 21 | + SHUTDOWN_FLAG.store(true, Ordering::SeqCst); |
| 22 | +} |
| 23 | + |
| 24 | +/// Register a child process for tracking during shutdown |
| 25 | +pub fn register_child_process(pid: u32) { |
| 26 | + let mut processes = CHILD_PROCESSES.lock() |
| 27 | + .unwrap_or_else(|poisoned| { |
| 28 | + warn!("CHILD_PROCESSES mutex was poisoned during registration, recovering data"); |
| 29 | + poisoned.into_inner() |
| 30 | + }); |
| 31 | + processes.push(pid); |
| 32 | +} |
| 33 | + |
| 34 | +/// Remove a child process from tracking (called when process exits normally) |
| 35 | +pub fn unregister_child_process(pid: u32) { |
| 36 | + let mut processes = CHILD_PROCESSES.lock() |
| 37 | + .unwrap_or_else(|poisoned| { |
| 38 | + warn!("CHILD_PROCESSES mutex was poisoned during unregistration, recovering data"); |
| 39 | + poisoned.into_inner() |
| 40 | + }); |
| 41 | + processes.retain(|&p| p != pid); |
| 42 | +} |
| 43 | + |
| 44 | +/// Gracefully terminate all child processes using a hybrid approach |
| 45 | +/// Phase 1: Broadcasts SIGTERM to process group (includes factotum but it has a handler) |
| 46 | +/// Phase 2: Sends SIGKILL only to individual child PIDs (excludes factotum) |
| 47 | +pub fn terminate_all_children() { |
| 48 | + let pids = { |
| 49 | + let processes = CHILD_PROCESSES.lock() |
| 50 | + .unwrap_or_else(|poisoned| { |
| 51 | + warn!("CHILD_PROCESSES mutex was poisoned during shutdown, recovering data"); |
| 52 | + poisoned.into_inner() |
| 53 | + }); |
| 54 | + processes.clone() |
| 55 | + }; |
| 56 | + |
| 57 | + if pids.is_empty() { |
| 58 | + return; |
| 59 | + } |
| 60 | + |
| 61 | + println!("Terminating {} child process(es) gracefully...", pids.len()); |
| 62 | + |
| 63 | + // Phase 1: Broadcast SIGTERM to entire process group |
| 64 | + // This includes factotum, but factotum has a signal handler so it won't die |
| 65 | + // This is race-free - all processes get SIGTERM atomically |
| 66 | + unsafe { |
| 67 | + #[cfg(unix)] |
| 68 | + { |
| 69 | + // SAFETY: Sending SIGTERM to process group (pid 0). |
| 70 | + // - Process group targeting (pid 0) is atomic and race-free |
| 71 | + // - Factotum has signal handlers installed (see main.rs), so it will set |
| 72 | + // the shutdown flag but not terminate |
| 73 | + // - All children spawned by factotum inherit the same process group and |
| 74 | + // will receive SIGTERM for graceful shutdown |
| 75 | + // - PID recycling is not a concern here because we're targeting the entire |
| 76 | + // process group by ID, not individual PIDs |
| 77 | + // - Platform: Unix-only. Non-Unix platforms don't reach this code path. |
| 78 | + libc::kill(0, libc::SIGTERM); |
| 79 | + } |
| 80 | + } |
| 81 | + |
| 82 | + // Wait 5 seconds for graceful shutdown |
| 83 | + thread::sleep(Duration::from_secs(5)); |
| 84 | + |
| 85 | + // Phase 2: Check which child processes are still alive and SIGKILL them individually |
| 86 | + // This excludes factotum - only tracked children are killed |
| 87 | + let surviving_pids: Vec<u32> = pids.iter() |
| 88 | + .filter(|&&pid| is_process_alive(pid)) |
| 89 | + .cloned() |
| 90 | + .collect(); |
| 91 | + |
| 92 | + if !surviving_pids.is_empty() { |
| 93 | + println!("Force-killing {} remaining process(es)...", surviving_pids.len()); |
| 94 | + for &pid in &surviving_pids { |
| 95 | + unsafe { |
| 96 | + #[cfg(unix)] |
| 97 | + { |
| 98 | + // SAFETY: Sending SIGKILL to individual child PIDs. |
| 99 | + // - PIDs are obtained from CHILD_PROCESSES, which tracks all spawned children |
| 100 | + // - PIDs are valid because they were registered immediately after spawn |
| 101 | + // - PIDs are filtered by is_process_alive() so we only kill surviving processes |
| 102 | + // - PID recycling edge case: If a PID is recycled between the is_process_alive() |
| 103 | + // check and this kill() call, we might signal an unrelated process. This is |
| 104 | + // extremely rare because: |
| 105 | + // 1. We only target PIDs from children spawned seconds ago |
| 106 | + // 2. The check-to-kill window is microseconds |
| 107 | + // 3. Unix systems typically have PID wraparound delays |
| 108 | + // 4. Recycled PIDs are usually given to unrelated processes, not critical ones |
| 109 | + // - This approach ensures factotum survives to send webhooks and write logs |
| 110 | + // - Platform: Unix-only. Non-Unix platforms don't reach this code path. |
| 111 | + libc::kill(pid as i32, libc::SIGKILL); |
| 112 | + } |
| 113 | + } |
| 114 | + } |
| 115 | + } |
| 116 | +} |
| 117 | + |
| 118 | +/// Check if a process is still running |
| 119 | +fn is_process_alive(pid: u32) -> bool { |
| 120 | + unsafe { |
| 121 | + #[cfg(unix)] |
| 122 | + { |
| 123 | + // SAFETY: Sending signal 0 checks if process exists without sending a real signal. |
| 124 | + // - Signal 0 is a null signal that performs permission and existence checks only |
| 125 | + // - Returns 0 (true) if process exists and we have permission to signal it |
| 126 | + // - Returns -1 (false) if process doesn't exist or permission is denied |
| 127 | + // - No side effects on the target process - completely safe for checking |
| 128 | + // - PID recycling: Could return true for a recycled PID (false positive), but this |
| 129 | + // is acceptable because we'll send SIGKILL to confirm termination. A false positive |
| 130 | + // just means we attempt to kill a process that may have changed identity, which is |
| 131 | + // handled by the SIGKILL safety invariants. |
| 132 | + // - Platform: Unix-only, where signal 0 is well-defined behavior |
| 133 | + libc::kill(pid as i32, 0) == 0 |
| 134 | + } |
| 135 | + #[cfg(not(unix))] |
| 136 | + { |
| 137 | + // SAFETY: On non-Unix platforms (Windows, etc.), we conservatively return false. |
| 138 | + // This means we'll always attempt SIGKILL in terminate_all_children(), which is |
| 139 | + // safe but suboptimal (no process liveness check). |
| 140 | + // TODO: Implement Windows-specific process checking using OpenProcess/GetExitCodeProcess |
| 141 | + // if Windows support is needed in the future. |
| 142 | + false |
| 143 | + } |
| 144 | + } |
| 145 | +} |
0 commit comments