homepage

System info:
kernel: 3.4.8-1-ARCH
dist: Arch linux
python: 3.2.3
subprocess.Popen() fails if python interpreter is started with closed 0, 1 or 2 descriptor.
Traceback (most recent call last):
 File "<string>", line 14, in <module>
 File "/usr/lib/python3.2/subprocess.py", line 745, in __init__
 restore_signals, start_new_session)
 File "/usr/lib/python3.2/subprocess.py", line 1197, in _execute_child
 restore_signals, start_new_session, preexec_fn)
ValueError: errpipe_write must be >= 3

#10806 seems related.

It's caused by the following check in _posixsubprocess.c:
 if (close_fds && errpipe_write < 3) { /* precondition */
 PyErr_SetString(PyExc_ValueError, "errpipe_write must be >= 3");
 return NULL;
 }
which was written by Gregory P. Smith in 2010 (adding to nosy list).
I'm not entirely sure why this check is here, presumably its due to the way close_fds=True is handled.
The close fds logic is also hardcoded to close fds from 3 upwards,.

easy enough to reproduce...
$ ./python.exe -c 'import os, subprocess as s; os.close(0); os.close(1); s.Popen(["/bin/true"])'
Traceback (most recent call last):
 File "<string>", line 1, in <module>
 File "/Users/gps/python/hg/default/Lib/subprocess.py", line 818, in __init__
 restore_signals, start_new_session)
 File "/Users/gps/python/hg/default/Lib/subprocess.py", line 1363, in _execute_child
 restore_signals, start_new_session, preexec_fn)
ValueError: errpipe_write must be >= 3
Examining the code, it looks like that restriction is to prevent the dup2's for any passed in stdin, stdout or stderr pipes from overwriting errpipe_write in Modules/_posixsubprocess.c's child_exec() function.
First guess at a fix: child_exec() needs to detect this situation and dup(errpipe_write) until it gets a fd not in the 0..2 range before the dup2(...) calls that could otherwise blindly clobber it. This could possibly be done by the parent process's _create_pipe() in Lib/subprocess.py when allocating the errpipe_read and errpipe_write fds.
Suggested Workaround: for now for any code running into this (Python daemons launching subprocesses?) - Call os.pipe() twice at the start of your program to burn 4 fds. That'll guarantee 0, 1 and 2 will not be used for this pipe.

The attached patch + test seems to fix the issue.
It's not very elegant.

Yes, something along the lines of that patch is what I was thinking. BTW, this is only necessary for the errpipe_write fd. errpipe_read is for the parent process.
I'm going to do it within _create_pipe so that the optimal _posixsubprocess.cloexec_pipe pipe2() based implementation can be used when possible rather than needing to call _set_cloexec() on the dup'ed fd.
There are some recent Linux specific possibilities such as fcntl with F_DUPFD, or better F_DUPFD_CLOEXEC, that would make this a single call. Using that may be overkill for this situation but it looks easy enough while I'm in there.

It may be implemented simplier.
fcntl(fd, F_DUPFD_CLOEXEC, min_fd_number) will allocate new fd at least min_fd_number. So, it is not necessary to do a lot of dup() calls.

F_DUPFD_CLOEXEC appears exclusive to modern Linux kernels. Any idea how wide spread support for plain F_DUPFD is? If that is "everywhere" the code I've just whipped up could lose a lot of loops...

Here's my initial fix.
If fcntl(errpipe_write, F_DUPFD, 3) is widely available this could be shrunk a bit to avoid the for loop potentially calling dup a few times and tracking the wasted fds to close later.
Otherwise if it isn't I'd rather not bother with F_DUPFD as this code takes the optimal path when F_DUPFD_CLOEXEC is supported (true on all modern linux systems) and should cause no harm beyond a couple extra dup and close syscalls otherwise.
Note: Linux pipe2() support appears in kernels a few revisions after F_DUPFD_CLOEXEC support so the good behavior when pipe2 exists will be kept in this situation as that also means F_DUPFD_CLOEXEC support should exist. The code will work regardless of that (incase someone has a frankenkernel, or other OSes choose to implement one but not the other).

I sent a review through on rietveld; I'm attaching a patch with the changes so that it compiles and passes the tests.

I haven't tested Ross's latest patch, but it looks ok to me.

Would it simplify matters to stop treating 0,1,2 specially and just add them to pass_fds instead?

adding {0,1,2} to fds_to_keep (populated from pass_fds) is indeed an alternate approach. A variant of an alternate patch doing that attached.
This actually simplifies code. Is there anything this would hurt that i'm not seeing?
I suppose it adds minor overhead to the fork_exec() call by passing more in and lookups into the fds_to_keep list now that it will always contain at least 4 values instead of the previous 1. I doubt that is matters (I haven't measured anything).

New changeset c4cd891cf167 by Gregory P. Smith in branch '3.3':
Fixes Issue #15798 - subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/c4cd891cf167
New changeset 0387054b2038 by Gregory P. Smith in branch 'default':
Fixes Issue #15798 - subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/0387054b2038 

New changeset efcdf2a70f2a by Gregory P. Smith in branch '3.3':
Undo supposed fix for Issue #15798 until I understand why this is
http://hg.python.org/cpython/rev/efcdf2a70f2a
New changeset ddbf9632795b by Gregory P. Smith in branch 'default':
Undo supposed fix for Issue #15798 until I understand why this is
http://hg.python.org/cpython/rev/ddbf9632795b 

New changeset 2df5e1f537b0 by Gregory P. Smith in branch 'default':
Fixes issue #15798: subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/2df5e1f537b0 

New changeset 07425df887b5 by Gregory P. Smith in branch '3.3':
Fixes issue #15798: subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/07425df887b5 

i went with the less invasive in terms of behavior change approach of making sure that the errpipe_write fd is always >= 3. In Python 3.4 the code change was different and much simpler and on the Python only side as all fd's are opened O_CLOEXEC by default.
I'm not entirely sure why the test_multiprocessing_forkserver and test_multiprocessing_spawn failures happened on 3.4 with the earlier change that attempted to always list 0,1,2 in the fds_to_keep (derived from pass_fds) list so there _may_ be a bug lurking elsewhere there but I suspect the bug is actually that we don't always want to blindly list them in fds_to_keep as some programs may have reused some of them for other non-stdio purposes but still want them closed.
The change has been backported to the python-subprocess32 repo.