cmd: keep connection cycle safe on pre-5.3 kernels

Boost.Process v2 uses pidfd_open on Linux, which requires kernel 5.3+.
On Ubuntu 18.04 (kernel 4.15) it fails and surfaces as "assign: Bad
file descriptor" in reactive_descriptor_service, tearing down the IOTMP
connection in a JOIN/LEAVE loop whenever the platform invokes a cmd.

Disable pidfd via BOOST_PROCESS_V2_DISABLE_PIDFD_OPEN so the SIGCHLD
handle is used everywhere, and wrap the cmd resource handler in a
try/catch so any future throw from the execution path returns a 500 to
the caller instead of escaping into the connection cycle.

Author: alvarolb

CMakeLists.txt

@@ -50,6 +50,13 @@ else()
 endif()
 find_package(Boost REQUIRED COMPONENTS program_options date_time process iostreams)
 
+# Boost.Process v2 defaults to pidfd_open on Linux for process tracking, but
+# that syscall requires kernel 5.3+. On older kernels (e.g. Ubuntu 18.04's
+# 4.15) it fails with ENOSYS and surfaces as "assign: Bad file descriptor"
+# from reactive_descriptor_service, taking down the caller. Force the
+# SIGCHLD-based handle so the binary stays portable to pre-5.3 kernels.
+add_definitions(-DBOOST_PROCESS_V2_DISABLE_PIDFD_OPEN)
+
 add_definitions( -DTHINGER_ENABLE_STREAM_LISTENER)
 add_definitions( -DTHINGER_SERVER="iot.thinger.io")
 add_definitions( -DTHINGER_KEEP_ALIVE_SECONDS=60)

src/thinger/iotmp/extensions/cmd/cmd.cpp

@@ -27,61 +27,74 @@ namespace thinger::iotmp{
                 out["stdout"]   = "";
                 out["stderr"]   = "";
             }else{
-                std::string pout;
-                std::string perr;
-                auto command = get_value(in.payload(), "cmd", empty::string);
-                auto timeout = get_value(in.payload(), "timeout", 30);
-                auto stdin_data = get_value(in.payload(), "stdin", empty::string);
-                bool timeout_flag = false;
-                int retcode = 0;
-
-                // If the body starts with a shebang, materialize it to a temp
-                // file and execute it directly so the interpreter declared in
-                // the shebang (python3, node, …) takes effect. Otherwise fall
-                // back to running the command through the shell, which keeps
-                // multi-line shell snippets, pipes and redirects working.
-                if(command.rfind("#!", 0) == 0){
-                    namespace fs = std::filesystem;
-                    std::random_device rd;
-                    std::uniform_int_distribution<uint64_t> dist;
-                    char buf[17];
-                    std::snprintf(buf, sizeof(buf), "%016llx", (unsigned long long) dist(rd));
-                    auto tmp_path = fs::temp_directory_path() / (std::string("thinr-cmd-") + buf);
-                    std::error_code ec;
-
-                    {
-                        std::ofstream ofs(tmp_path, std::ios::binary);
-                        ofs.write(command.data(), command.size());
+                // Isolate the entire execution from the caller's message loop:
+                // Boost.Process v2, pipe setup and shell materialization can
+                // throw (e.g. pidfd_open ENOSYS on pre-5.3 kernels surfaces
+                // as "assign: Bad file descriptor"), and we must never let
+                // those escape and tear down the IOTMP connection cycle.
+                try{
+                    std::string pout;
+                    std::string perr;
+                    auto command = get_value(in.payload(), "cmd", empty::string);
+                    auto timeout = get_value(in.payload(), "timeout", 30);
+                    auto stdin_data = get_value(in.payload(), "stdin", empty::string);
+                    bool timeout_flag = false;
+                    int retcode = 0;
+
+                    if(command.rfind("#!", 0) == 0){
+                        namespace fs = std::filesystem;
+                        std::random_device rd;
+                        std::uniform_int_distribution<uint64_t> dist;
+                        char buf[17];
+                        std::snprintf(buf, sizeof(buf), "%016llx", (unsigned long long) dist(rd));
+                        auto tmp_path = fs::temp_directory_path() / (std::string("thinr-cmd-") + buf);
+                        std::error_code ec;
+
+                        {
+                            std::ofstream ofs(tmp_path, std::ios::binary);
+                            ofs.write(command.data(), command.size());
+                        }
+                        fs::permissions(tmp_path,
+                            fs::perms::owner_read | fs::perms::owner_write | fs::perms::owner_exec,
+                            fs::perm_options::replace, ec);
+
+                        retcode = exec(tmp_path.string(), {}, pout, perr, stdin_data, timeout, &timeout_flag);
+
+                        fs::remove(tmp_path, ec);
+                    }else{
+                        retcode = exec(preferred_shell(), {"-c", command}, pout, perr, stdin_data, timeout, &timeout_flag);
                     }
-                    fs::permissions(tmp_path,
-                        fs::perms::owner_read | fs::perms::owner_write | fs::perms::owner_exec,
-                        fs::perm_options::replace, ec);
-
-                    retcode = exec(tmp_path.string(), {}, pout, perr, stdin_data, timeout, &timeout_flag);
-
-                    fs::remove(tmp_path, ec);
-                }else{
-                    retcode = exec(preferred_shell(), {"-c", command}, pout, perr, stdin_data, timeout, &timeout_flag);
-                }
 
-                // signal error at protocol level
-                if(timeout_flag){
-                    out.set_error(408, "command timed out");
-                }else if(retcode != 0){
-                    out.set_error(500, "command failed");
-                }
+                    if(timeout_flag){
+                        out.set_error(408, "command timed out");
+                    }else if(retcode != 0){
+                        out.set_error(500, "command failed");
+                    }
 
-                std::string mode = get_value(in.payload(), "mode", empty::string);
-                if(mode=="api" || mode == ""){
-                    out["retcode"] = retcode;
-                    out["stdout"]  = pout;
-                    out["stderr"]  = perr;
-                }else if(mode=="text"){
-                    if(!pout.empty()){
-                        out = pout;
-                    }else{
-                        out = perr;
+                    std::string mode = get_value(in.payload(), "mode", empty::string);
+                    if(mode=="api" || mode == ""){
+                        out["retcode"] = retcode;
+                        out["stdout"]  = pout;
+                        out["stderr"]  = perr;
+                    }else if(mode=="text"){
+                        if(!pout.empty()){
+                            out = pout;
+                        }else{
+                            out = perr;
+                        }
                     }
+                }catch(const std::exception& e){
+                    LOG_ERROR("cmd execution failed: {}", e.what());
+                    out.set_error(500, std::string("command execution error: ") + e.what());
+                    out["retcode"] = -1;
+                    out["stdout"]  = "";
+                    out["stderr"]  = e.what();
+                }catch(...){
+                    LOG_ERROR("cmd execution failed: unknown exception");
+                    out.set_error(500, "command execution error: unknown");
+                    out["retcode"] = -1;
+                    out["stdout"]  = "";
+                    out["stderr"]  = "unknown exception";
                 }
             }
         };