Python踩坑之旅其二裸用os.system的原罪

发布时间:2020-09-17 04:57:41 作者:mythmgn
来源:网络 阅读:486

[TOC]

代码示例支持
平台: Centos 6.3
Python: 2.7.14
Github: https://github.com/baidu/CUP

欢迎关注公众号进行技术互动和讨论:
Python踩坑之旅其二裸用os.system的原罪

1.1 踩坑案例

今天的坑不仅包括裸用os.system还包括裸用相关的家族:

这些坑是新同学非常容易踩,而且 code review 过程中容易漏掉:

[1] 长期运行 Service 中裸用以函数家族

[2] 自动化测试中裸用以上函数家族而不加以保护

1.2 填坑解法

  1. 支持超时 kill 策略,禁止任何情况下的 shell 执行裸用家族函数

提供一个作者的代码参考: https://github.com/baidu/CUP/blob/master/cup/shell/oper.py

        from cup import shell
        shellexec = shell.ShellExec()
        # timeout=None will block the execution until it finishes
        shellexec.run('/bin/ls', timeout=None)
        # timeout>=0 will open non-blocking mode
        # The process will be killed if the cmd timeouts
        shellexec.run(cmd='/bin/ls', timeout=100)

见ShellExec类的run函数

  1. 内存消耗型服务/进程, 长期运行服务进程避免fork 进程执行 shell 命令

1.3 坑位分析

建议看下第二章节关于进程和子进程继承类信息,script使用上述家族进行执行时,采用了启动一个子进程的方式

1.4.1 技术关键字

1.5 填坑总结

Shell执行是个非常常见的操作,所以很多同学特别是新同学,在使用过程中经常不注意而随意使用。 裸用一时爽,进程死亡火葬场

2. 前坑回顾

2.1 Linux中, 子进程拷贝父进程哪些信息

参考资料来源:


fork()  creates a new process by duplicating the calling process.  The new process, referred to as the child, is an exact duplicate of the calling process, referred to as the parent, except for the follow-
ing points:

    *  The child has its own unique process ID, and this PID does not match the ID of any existing process group (setpgid(2)).

    *  The child's parent process ID is the same as the parent's process ID.

    *  The child does not inherit its parent's memory locks (mlock(2), mlockall(2)).

    *  Process resource utilizations (getrusage(2)) and CPU time counters (times(2)) are reset to zero in the child.

    *  The child's set of pending signals is initially empty (sigpending(2)).

    *  The child does not inherit semaphore adjustments from its parent (semop(2)).

    *  The child does not inherit record locks from its parent (fcntl(2)).

    *  The child does not inherit timers from its parent (setitimer(2), alarm(2), timer_create(2)).

    *  The child does not inherit outstanding asynchronous I/O operations from its parent (aio_read(3), aio_write(3)), nor does it inherit any asynchronous I/O contexts from its parent (seeio_setup(2)).

       The process attributes in the preceding list are all specified in POSIX.1-2001.  The parent and child also differ with respect to the following Linux-specific process attributes:

    *  The child does not inherit directory change notifications (dnotify) from its parent (see the description of F_NOTIFY in fcntl(2)).

    *  The prctl(2) PR_SET_PDEATHSIG setting is reset so that the child does not receive a signal when its parent terminates.

    *  Memory mappings that have been marked with the madvise(2) MADV_DONTFORK flag are not inherited across a fork().

    *  The termination signal of the child is always SIGCHLD (see clone(2)).

在说继承、拷贝父进程的

此外

2.2 Agent常驻进程选择>60000端口的意义

在 Linux 系统中, 一般系统会自动替程序选择端口连接到用户指定的目的端口, 而这个端口范围是提前设定好的, 比如作者的 centos:

$ cat /proc/sys/net/ipv4/ip_local_port_range
10000   60000

欢迎关注公众号进行技术互动和讨论:

Python踩坑之旅其二裸用os.system的原罪

推荐阅读:
  1. ingress rollingUpdate 踩坑记录
  2. Python踩坑之旅其一杀不死的Shell子进程

免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。

python 技术思考 经验总结

上一篇:Vue + Element UI图片上传控件使用详解

下一篇:android在service中使用AsyncHttpClient加载网络资源

相关阅读

您好,登录后才能下订单哦!

密码登录
登录注册
其他方式登录
点击 登录注册 即表示同意《亿速云用户服务条款》