Add ProcessStartInfo.InheritedHandles to restrict child process handle inheritance

src/libraries/Common/src/Interop/Unix/System.Native/Interop.ForkAndExecProcess.cs

@@ -16,12 +16,14 @@ internal static partial class Sys
         internal static unsafe int ForkAndExecProcess(
             string filename, string[] argv, IDictionary<string, string?> env, string? cwd,
             bool setUser, uint userId, uint groupId, uint[]? groups,
-            out int lpChildPid, SafeFileHandle? stdinFd, SafeFileHandle? stdoutFd, SafeFileHandle? stderrFd, bool shouldThrow = true)
+            out int lpChildPid, SafeFileHandle? stdinFd, SafeFileHandle? stdoutFd, SafeFileHandle? stderrFd,
+            SafeHandle[]? inheritedHandles = null, bool shouldThrow = true)
         {
             byte** argvPtr = null, envpPtr = null;
             int result = -1;
 
             bool stdinRefAdded = false, stdoutRefAdded = false, stderrRefAdded = false;
+            int inheritedRefsAdded = 0;
             try
             {
                 int stdinRawFd = -1, stdoutRawFd = -1, stderrRawFd = -1;
@@ -44,14 +46,37 @@ internal static unsafe int ForkAndExecProcess(
                     stderrRawFd = stderrFd.DangerousGetHandle().ToInt32();
                 }
 
+                // inheritedFdCount == -1 means no restriction; >= 0 means restrict to stdio + list
+                int inheritedFdCount = -1;
+                scoped Span<int> inheritedFds = default;
+
+                if (inheritedHandles is not null)
+                {
+                    inheritedFdCount = inheritedHandles.Length;
+                    inheritedFds = inheritedHandles.Length <= 64
+                        ? stackalloc int[64]
+                        : new int[inheritedFdCount];
+
+                    bool ignore = false;
+                    for (int i = 0; i < inheritedHandles.Length; i++)
+                    {
+                        SafeHandle handle = inheritedHandles[i];
+                        handle.DangerousAddRef(ref ignore);
+                        inheritedRefsAdded++;
+                        inheritedFds[i] = handle.DangerousGetHandle().ToInt32();
+                    }
+                }
+
                 AllocArgvArray(argv, ref argvPtr);
                 AllocEnvpArray(env, ref envpPtr);
                 fixed (uint* pGroups = groups)
+                fixed (int* pInheritedFds = inheritedFds)
                 {
                     result = ForkAndExecProcess(
                         filename, argvPtr, envpPtr, cwd,
                         setUser ? 1 : 0, userId, groupId, pGroups, groups?.Length ?? 0,
-                        out lpChildPid, stdinRawFd, stdoutRawFd, stderrRawFd);
+                        out lpChildPid, stdinRawFd, stdoutRawFd, stderrRawFd,
+                        pInheritedFds, inheritedFdCount);
                 }
                 return result == 0 ? 0 : Marshal.GetLastPInvokeError();
             }
@@ -66,14 +91,21 @@ internal static unsafe int ForkAndExecProcess(
                     stdoutFd!.DangerousRelease();
                 if (stderrRefAdded)
                     stderrFd!.DangerousRelease();
+
+                // Only release the handles that were successfully AddRef'd
+                for (int i = 0; i < inheritedRefsAdded; i++)
+                {
+                    inheritedHandles![i].DangerousRelease();
+                }
             }
         }
 
         [LibraryImport(Libraries.SystemNative, EntryPoint = "SystemNative_ForkAndExecProcess", StringMarshalling = StringMarshalling.Utf8, SetLastError = true)]
         private static unsafe partial int ForkAndExecProcess(
             string filename, byte** argv, byte** envp, string? cwd,
             int setUser, uint userId, uint groupId, uint* groups, int groupsLength,
-            out int lpChildPid, int stdinFd, int stdoutFd, int stderrFd);
+            out int lpChildPid, int stdinFd, int stdoutFd, int stderrFd,
+            int* inheritedFds, int inheritedFdCount);
 
         /// <summary>
         /// Allocates a single native memory block containing both a null-terminated pointer array

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.CreateProcessWithLogon.cs

@@ -19,10 +19,10 @@ internal static unsafe partial bool CreateProcessWithLogonW(
             string? appName,
             char* cmdLine,
             int creationFlags,
-            IntPtr environmentBlock,
+            char* environmentBlock,
             string? lpCurrentDirectory,
-            ref Interop.Kernel32.STARTUPINFO lpStartupInfo,
-            ref Interop.Kernel32.PROCESS_INFORMATION lpProcessInformation);
+            Interop.Kernel32.STARTUPINFO* lpStartupInfo,
+            Interop.Kernel32.PROCESS_INFORMATION* lpProcessInformation);
 
         [Flags]
         internal enum LogonFlags

src/libraries/Common/src/Interop/Windows/Kernel32/Interop.CreateProcess.cs

@@ -3,7 +3,6 @@
 
 using System;
 using System.Runtime.InteropServices;
-using System.Text;
 using Microsoft.Win32.SafeHandles;
 
 internal static partial class Interop
@@ -19,10 +18,10 @@ internal static unsafe partial bool CreateProcess(
             ref SECURITY_ATTRIBUTES threadSecAttrs,
             [MarshalAs(UnmanagedType.Bool)] bool bInheritHandles,
             int dwCreationFlags,
-            IntPtr lpEnvironment,
+            char* lpEnvironment,
             string? lpCurrentDirectory,
-            ref STARTUPINFO lpStartupInfo,
-            ref PROCESS_INFORMATION lpProcessInformation
+            STARTUPINFOEX* lpStartupInfo,
+            PROCESS_INFORMATION* lpProcessInformation
         );
 
         [StructLayout(LayoutKind.Sequential)]
@@ -56,5 +55,37 @@ internal struct STARTUPINFO
             internal IntPtr hStdOutput;
             internal IntPtr hStdError;
         }
+
+        internal const int PROC_THREAD_ATTRIBUTE_HANDLE_LIST = 0x00020002;
+        internal const int EXTENDED_STARTUPINFO_PRESENT = 0x00080000;
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal unsafe struct STARTUPINFOEX
+        {
+            internal STARTUPINFO StartupInfo;
+            internal void* lpAttributeList;
+        }
+
+        [LibraryImport(Libraries.Kernel32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static unsafe partial bool InitializeProcThreadAttributeList(
+            void* lpAttributeList,
+            int dwAttributeCount,
+            int dwFlags,
+            ref nuint lpSize);
+
+        [LibraryImport(Libraries.Kernel32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static unsafe partial bool UpdateProcThreadAttribute(
+            void* lpAttributeList,
+            int dwFlags,
+            IntPtr attribute,
+            void* lpValue,
+            nuint cbSize,
+            void* lpPreviousValue,
+            nuint* lpReturnSize);
+
+        [LibraryImport(Libraries.Kernel32, SetLastError = true)]
+        internal static unsafe partial void DeleteProcThreadAttributeList(void* lpAttributeList);
     }
 }

src/libraries/System.Diagnostics.Process/ref/System.Diagnostics.Process.cs

@@ -271,6 +271,7 @@ public ProcessStartInfo(string fileName, System.Collections.Generic.IEnumerable<
         public Microsoft.Win32.SafeHandles.SafeFileHandle? StandardOutputHandle { get { throw null; } set { } }
         public System.Text.Encoding? StandardInputEncoding { get { throw null; } set { } }
         public System.Text.Encoding? StandardOutputEncoding { get { throw null; } set { } }
+        public System.Collections.Generic.IList<System.Runtime.InteropServices.SafeHandle>? InheritedHandles { get { throw null; } set { } }
         [System.Diagnostics.CodeAnalysis.AllowNullAttribute]
         public string UserName { get { throw null; } set { } }
         public bool UseShellExecute { get { throw null; } set { } }

src/libraries/System.Diagnostics.Process/src/Microsoft/Win32/SafeHandles/SafeProcessHandle.Unix.cs

@@ -92,9 +92,9 @@ private bool SignalCore(PosixSignal signal)
         private delegate SafeProcessHandle StartWithShellExecuteDelegate(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle, out ProcessWaitState.Holder? waitStateHolder);
         private static StartWithShellExecuteDelegate? s_startWithShellExecute;
 
-        private static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle)
+        private static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle, SafeHandle[]? inheritedHandlesSnapshot = null)
         {
-            SafeProcessHandle startedProcess = StartCore(startInfo, stdinHandle, stdoutHandle, stderrHandle, out ProcessWaitState.Holder? waitStateHolder);
+            SafeProcessHandle startedProcess = StartCore(startInfo, stdinHandle, stdoutHandle, stderrHandle, inheritedHandlesSnapshot, out ProcessWaitState.Holder? waitStateHolder);
 
             // For standalone SafeProcessHandle.Start, we dispose the wait state holder immediately.
             // The DangerousAddRef on the SafeWaitHandle (Unix) keeps the handle alive.
@@ -103,7 +103,8 @@ private static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFileH
             return startedProcess;
         }
 
-        internal static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle, out ProcessWaitState.Holder? waitStateHolder)
+        internal static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle,
+            SafeFileHandle? stderrHandle, SafeHandle[]? inheritedHandles, out ProcessWaitState.Holder? waitStateHolder)
         {
             waitStateHolder = null;
 
@@ -142,10 +143,12 @@ internal static SafeProcessHandle StartCore(ProcessStartInfo startInfo, SafeFile
                 startInfo, filename, argv, env, cwd,
                 setCredentials, userId, groupId, groups,
                 stdinHandle, stdoutHandle, stderrHandle, usesTerminal,
+                inheritedHandles,
                 out waitStateHolder);
         }
 
-        private static SafeProcessHandle StartWithShellExecute(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle, out ProcessWaitState.Holder? waitStateHolder)
+        private static SafeProcessHandle StartWithShellExecute(ProcessStartInfo startInfo, SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle,
+            SafeFileHandle? stderrHandle, out ProcessWaitState.Holder? waitStateHolder)
         {
             IDictionary<string, string?> env = startInfo.Environment;
             string? cwd = !string.IsNullOrWhiteSpace(startInfo.WorkingDirectory) ? startInfo.WorkingDirectory : null;
@@ -182,6 +185,7 @@ private static SafeProcessHandle StartWithShellExecute(ProcessStartInfo startInf
                     startInfo, filename, argv, env, cwd,
                     setCredentials, userId, groupId, groups,
                     stdinHandle, stdoutHandle, stderrHandle, usesTerminal,
+                    null,
                     out waitStateHolder,
                     throwOnNoExec: false); // return invalid handle instead of throwing on ENOEXEC
 
@@ -202,6 +206,7 @@ private static SafeProcessHandle StartWithShellExecute(ProcessStartInfo startInf
                 startInfo, filename, openFileArgv, env, cwd,
                 setCredentials, userId, groupId, groups,
                 stdinHandle, stdoutHandle, stderrHandle, usesTerminal,
+                null,
                 out waitStateHolder);
 
             return result;
@@ -219,7 +224,7 @@ private static SafeProcessHandle ForkAndExecProcess(
             IDictionary<string, string?> env, string? cwd, bool setCredentials, uint userId,
             uint groupId, uint[]? groups,
             SafeFileHandle? stdinHandle, SafeFileHandle? stdoutHandle, SafeFileHandle? stderrHandle,
-            bool usesTerminal, out ProcessWaitState.Holder? waitStateHolder, bool throwOnNoExec = true)
+            bool usesTerminal, SafeHandle[]? inheritedHandles, out ProcessWaitState.Holder? waitStateHolder, bool throwOnNoExec = true)
         {
             waitStateHolder = null;
 
@@ -249,7 +254,8 @@ private static SafeProcessHandle ForkAndExecProcess(
                 errno = Interop.Sys.ForkAndExecProcess(
                     resolvedFilename, argv, env, cwd,
                     setCredentials, userId, groupId, groups,
-                    out childPid, stdinHandle, stdoutHandle, stderrHandle);
+                    out childPid, stdinHandle, stdoutHandle, stderrHandle,
+                    inheritedHandles);
 
                 if (errno == 0)
                 {