# Process descriptors in FreeBSD-Capsicum

DevFeed: [Process descriptors in FreeBSD-Capsicum](<https://devfeed.tech/articles/process-descriptors-in-freebsd-capsicum-21555.md>)

Original publisher: [Read original article](<http://lackingrhoticity.blogspot.com/2010/10/process-descriptors-in-freebsd-capsicum.html>)

Author: Mark Seaborn (noreply@blogger.com)

Published: 2010-10-23T15:10:00Z

Content type: opinion

Language: en

Sources: [Mark Seaborn](<https://devfeed.tech/sources/mark-seaborn.md>)

Topics: [Processes](<https://devfeed.tech/topics/processes.md>), [POSIX](<https://devfeed.tech/topics/posix.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [debugging](<https://devfeed.tech/topics/debugging.md>)

Tags: [argument](<https://devfeed.tech/tags/argument.md>), [fork](<https://devfeed.tech/tags/fork.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [memory](<https://devfeed.tech/tags/memory.md>), [posix](<https://devfeed.tech/tags/posix.md>), [process](<https://devfeed.tech/tags/process.md>), [processes](<https://devfeed.tech/tags/processes.md>), [race-condition](<https://devfeed.tech/tags/race-condition.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [signal](<https://devfeed.tech/tags/signal.md>), [unix](<https://devfeed.tech/tags/unix.md>)

## AI overview

The article examines Capsicum process descriptors in FreeBSD. It explains how pdfork(), pdwait(), and pdkill() replace PID-based process operations with file-descriptor-based operations, improving delegation, polling, and protection against PID-reuse race conditions. It also criticizes the design in which closing the last process descriptor terminates the process.

## Source excerpt

Capsicum is a set of new features for FreeBSD that adds better support for sandboxing, adding a capability mode in which the capabilities are Unix file descriptors (FDs). The features Capsicum adds are orthogonal, which is nice. One of the new features is process descriptors. Capsicum adds a replacement for fork() called pdfork(), which returns a process descriptor (a new type of FD) rather than a PID. Similarly, there are replacements for wait() and kill() -- pdwait() and pdkill() -- which take FDs as arguments instead of PIDs. The reason for the new interface is that kill() is not safe to allow in Capsicum's sandbox, because it provides ambient authority: it looks up its PID argument in a global namespace. But even if you ignore sandboxing issues, this new interface is a significant improvement on POSIX process management: It allows the ability to wait on a process to be delegated to another process. In contrast, with wait()/waitpid(), a process's exit status can only be read by the process's parent. Process descriptors can be used with poll(). This avoids the awkwardness of having to use SIGCHLD, which doesn't work well if multiple libraries within the same process want to wait() for child processes. It gets rid of the race condition associated with kill(). Sending a signal to a PID is dodgy because the original process with this PID could have exited, and the kernel could have recycled the PID for an unrelated process, especially on a system where processes are spawned and exit frequently. kill() is only really safe when used by a parent process on its child, and only when the parent makes sure to use it before wait() has returned the child's exit status. pdkill() gets rid of this problem. In future, process descriptors can be extended to provide access to the process's internal state for debugging purposes, e.g. for reading registers and memory, or modifying memory mappings or the FD table. This would be an improvement on Linux's ptrace() interface. However, th