I/O safety of dup2 with an imminent exec

One of the main use cases for dup2 is to pass fds to an exec at arbitrarily chosen positions. I/O safety considers that to be forgery. But it's an important use case, and if you somehow know there will be no further I/O on any other fd, including on other threads, you can make it work reliably in practice. Is there a way we can accommodate this in I/O safety?

A related question: is it possible to call `fork` in Rust at all? POSIX says the child can only call async-signal-safe functions, but Rust doesn't currently guarantee that *anything* is async-signal-safe.

One option would be to say that these situations are too unwieldy, and that instead of trying to define soundness requirements for fork and exec, we should instead define "spawn" and "replace the current process" primitives which can be passed a list of fds to pass to exec, so that we can do all the dup2's etc in specially blessed code.

Inizia leggendo la discussione della issue su dup2, fork, exec e sui requisiti POSIX async-signal-safe. Determina se il progetto può definire requisiti di soundness per queste operazioni o se ha bisogno di primitive di spawn e sostituzione dei processi che accettino file descriptors. Il lavoro è completato quando la direzione dell'API e i requisiti di sicurezza sono chiaramente stabiliti.

Scritto dal modello di indicizzazione a partire dal testo della issue.