common,agent,gpg,dirmngr,g13,scd,tests,tools: New spawn function.

* common/exechelp-posix.c (do_exec, gnupg_spawn_process): Remove.
(check_syscall_func, pre_syscall, post_syscall) : New.
(do_create_socketpair, posix_open_null, call_spawn_cb): New.
(my_exec, spawn_detached, gnupg_spawn_helper): New.
(gnupg_process_spawn, process_kill, gnupg_process_terminate): New.
(gnupg_process_get_fds, gnupg_process_get_streams): New.
(process_vctl, gnupg_process_ctl): New.
(gnupg_process_wait, gnupg_process_release): New.
(gnupg_process_wait_list): New.
* common/exechelp-w32.c: Add definition of _WIN32_WINNT as 0x600.
(check_syscall_func, pre_syscall, post_syscall): New.
(gnupg_spawn_process): Remove.
(check_windows_version): New.
(spawn_detached, gnupg_spawn_helper, gnupg_process_spawn): New.
(gnupg_process_get_fds, gnupg_process_get_streams): New.
(process_kill, process_vctl, gnupg_process_ctl): New.
(gnupg_process_wait, gnupg_process_terminate): New.
(gnupg_process_release, gnupg_process_wait_list): New.
* common/exechelp.h: Re-write for new API.
* common/exectool.c (gnupg_exec_tool_stream): Follow the change.
* common/asshelp.c (start_new_service): Likewise.
* agent/genkey.c (do_check_passphrase_pattern): Likewise.
* dirmngr/ldap-wrapper.c (struct wrapper_context_s): Use PROC.
(destroy_wrapper): Follow the change of API.
(read_log_data): Follow the change of API, use printable_pid.
(ldap_reaper_thread, ldap_wrapper_release_context): Likewise.
(ldap_wrapper_connection_cleanup, ldap_wrapper): Likewise.
* g10/photoid.c (run_with_pipe): Follow the change of API.
(show_photo): Likewise.
* g13/be-encfs.c (run_umount_helper): Likewise.
(run_encfs_tool): Likewise.
* g13/g13.c: Add including ./common/exechelp.h.
* g13/mount.c: Likewise.
* g13/runner.c: Follow the change of API.
* g13/runner.h: Follow the change of API.
* scd/app.c (setup_env): New.
(report_change): Follow the change of API.
* tests/gpgscm/ffi.c (proc_object_finalize): New.
(proc_object_to_string): New.
(proc_wrap, proc_unwrap): New.
(do_spawn_process): Remove.
(do_process_spawn): New.
(setup_std_fds): New.
(do_spawn_process_fd): Remove.
(do_process_spawn_fd): New.
(do_wait_process): Remove.
(do_process_wait): New.
(do_wait_processes): Remove.
* tests/gpgscm/t-child.scm: Follow the change of API.
* tests/gpgscm/tests.scm: Likewise.
* tests/openpgp/defs.scm: Likewise.
* tests/tpm2dtests/defs.scm: Likewise.
* tools/gpg-card.c: Likewise.
* tools/gpgconf-comp.c: Likewise.
* tools/gpgconf.c: Likewise.
* tools/gpgtar-create.c: Likewise.
* tools/gpgtar-extract.c: Likewise.
* tools/gpgtar-list.c: Likewise.

--

GnuPG-bug-id: 6275
Signed-off-by: NIIBE Yutaka <[email protected]>

1 files changed, 554 insertions, 439 deletions

diff --git a/common/exechelp-posix.c b/common/exechelp-posix.c
index fa613449d..7b20a3796 100644
--- a/common/exechelp-posix.c
+++ b/common/exechelp-posix.c
@@ -273,73 +273,6 @@ get_all_open_fds (void)
 }
 
 
-/* The exec core used right after the fork. This will never return. */
-static void
-do_exec (const char *pgmname, const char *argv[],
-         int fd_in, int fd_out, int fd_err,
-         int *except, unsigned int flags)
-{
-  char **arg_list;
-  int i, j;
-  int fds[3];
-  int nodevnull[3];
-
-  fds[0] = fd_in;
-  fds[1] = fd_out;
-  fds[2] = fd_err;
-
-  nodevnull[0] = !!(flags & GNUPG_SPAWN_KEEP_STDIN);
-  nodevnull[1] = !!(flags & GNUPG_SPAWN_KEEP_STDOUT);
-  nodevnull[2] = !!(flags & GNUPG_SPAWN_KEEP_STDERR);
-
-  /* Create the command line argument array.  */
-  i = 0;
-  if (argv)
-    while (argv[i])
-      i++;
-  arg_list = xcalloc (i+2, sizeof *arg_list);
-  arg_list[0] = strrchr (pgmname, '/');
-  if (arg_list[0])
-    arg_list[0]++;
-  else
-    arg_list[0] = xstrdup (pgmname);
-  if (argv)
-    for (i=0,j=1; argv[i]; i++, j++)
-      arg_list[j] = (char*)argv[i];
-
-  /* Assign /dev/null to unused FDs. */
-  for (i=0; i <= 2; i++)
-    {
-      if (nodevnull[i])
-        continue;
-      if (fds[i] == -1)
-        {
-          fds[i] = open ("/dev/null", i? O_WRONLY : O_RDONLY);
-          if (fds[i] == -1)
-            log_fatal ("failed to open '%s': %s\n",
-                       "/dev/null", strerror (errno));
-        }
-    }
-
-  /* Connect the standard files.  */
-  for (i=0; i <= 2; i++)
-    {
-      if (nodevnull[i])
-        continue;
-      if (fds[i] != i && dup2 (fds[i], i) == -1)
-        log_fatal ("dup2 std%s failed: %s\n",
-                   i==0?"in":i==1?"out":"err", strerror (errno));
-    }
-
-  /* Close all other files. */
-  close_all_fds (3, except);
-
-  execv (pgmname, arg_list);
-  /* No way to print anything, as we have closed all streams. */
-  _exit (127);
-}
-
-
 static gpg_error_t
 do_create_pipe (int filedes[2])
 {
@@ -431,487 +364,669 @@ gnupg_close_pipe (int fd)
     close (fd);
 }
 
+#include <sys/socket.h>
 
-/* Fork and exec the PGMNAME, see exechelp.h for details.  */
-gpg_error_t
-gnupg_spawn_process (const char *pgmname, const char *argv[],
-                     int *except, unsigned int flags,
-                     estream_t *r_infp,
-                     estream_t *r_outfp,
-                     estream_t *r_errfp,
-                     pid_t *pid)
-{
-  gpg_error_t err;
-  int inpipe[2] = {-1, -1};
-  int outpipe[2] = {-1, -1};
-  int errpipe[2] = {-1, -1};
-  estream_t infp = NULL;
-  estream_t outfp = NULL;
-  estream_t errfp = NULL;
-  int nonblock = !!(flags & GNUPG_SPAWN_NONBLOCK);
+struct gnupg_process {
+  const char *pgmname;
+  unsigned int terminated   :1; /* or detached */
+  unsigned int flags;
+  pid_t pid;
+  int fd_in;
+  int fd_out;
+  int fd_err;
+  int wstatus;
+};
 
-  if (r_infp)
-    *r_infp = NULL;
-  if (r_outfp)
-    *r_outfp = NULL;
-  if (r_errfp)
-    *r_errfp = NULL;
-  *pid = (pid_t)(-1); /* Always required.  */
+static int gnupg_process_syscall_func_initialized;
 
-  if (r_infp)
-    {
-      err = create_pipe_and_estream (inpipe, &infp, 1, nonblock);
-      if (err)
-        return err;
-    }
+/* Functions called before and after blocking syscalls.  */
+static void (*pre_syscall_func) (void);
+static void (*post_syscall_func) (void);
 
-  if (r_outfp)
+static void
+check_syscall_func (void)
+{
+  if (!gnupg_process_syscall_func_initialized)
     {
-      err = create_pipe_and_estream (outpipe, &outfp, 0, nonblock);
-      if (err)
-        {
-          if (infp)
-            es_fclose (infp);
-          else if (inpipe[1] != -1)
-            close (inpipe[1]);
-          if (inpipe[0] != -1)
-            close (inpipe[0]);
-
-          return err;
-        }
+      gpgrt_get_syscall_clamp (&pre_syscall_func, &post_syscall_func);
+      gnupg_process_syscall_func_initialized = 1;
     }
+}
 
-  if (r_errfp)
-    {
-      err = create_pipe_and_estream (errpipe, &errfp, 0, nonblock);
-      if (err)
-        {
-          if (infp)
-            es_fclose (infp);
-          else if (inpipe[1] != -1)
-            close (inpipe[1]);
-          if (inpipe[0] != -1)
-            close (inpipe[0]);
-
-          if (outfp)
-            es_fclose (outfp);
-          else if (outpipe[0] != -1)
-            close (outpipe[0]);
-          if (outpipe[1] != -1)
-            close (outpipe[1]);
-
-          return err;
-        }
-    }
+static void
+pre_syscall (void)
+{
+  if (pre_syscall_func)
+    pre_syscall_func ();
+}
+
+static void
+post_syscall (void)
+{
+  if (post_syscall_func)
+    post_syscall_func ();
+}
 
 
-  *pid = fork ();
-  if (*pid == (pid_t)(-1))
-    {
-      err = my_error_from_syserror ();
-      log_error (_("error forking process: %s\n"), gpg_strerror (err));
-
-      if (infp)
-        es_fclose (infp);
-      else if (inpipe[1] != -1)
-        close (inpipe[1]);
-      if (inpipe[0] != -1)
-        close (inpipe[0]);
-
-      if (outfp)
-        es_fclose (outfp);
-      else if (outpipe[0] != -1)
-        close (outpipe[0]);
-      if (outpipe[1] != -1)
-        close (outpipe[1]);
-
-      if (errfp)
-        es_fclose (errfp);
-      else if (errpipe[0] != -1)
-        close (errpipe[0]);
-      if (errpipe[1] != -1)
-        close (errpipe[1]);
-      return err;
-    }
+static gpg_err_code_t
+do_create_socketpair (int filedes[2])
+{
+  gpg_error_t err = 0;
 
-  if (!*pid)
+  pre_syscall ();
+  if (socketpair (AF_LOCAL, SOCK_STREAM, 0, filedes) == -1)
     {
-      /* This is the child. */
-      gcry_control (GCRYCTL_TERM_SECMEM);
-      es_fclose (infp);
-      es_fclose (outfp);
-      es_fclose (errfp);
-      do_exec (pgmname, argv, inpipe[0], outpipe[1], errpipe[1],
-               except, flags);
-      /*NOTREACHED*/
+      err = gpg_err_code_from_syserror ();
+      filedes[0] = filedes[1] = -1;
     }
+  post_syscall ();
 
-  /* This is the parent. */
-  if (inpipe[0] != -1)
-    close (inpipe[0]);
-  if (outpipe[1] != -1)
-    close (outpipe[1]);
-  if (errpipe[1] != -1)
-    close (errpipe[1]);
+  return err;
+}
 
-  if (r_infp)
-    *r_infp = infp;
-  if (r_outfp)
-    *r_outfp = outfp;
-  if (r_errfp)
-    *r_errfp = errfp;
+static int
+posix_open_null (int for_write)
+{
+  int fd;
 
-  return 0;
+  fd = open ("/dev/null", for_write? O_WRONLY : O_RDONLY);
+  if (fd == -1)
+    log_fatal ("failed to open '/dev/null': %s\n", strerror (errno));
+  return fd;
 }
 
+static void
+call_spawn_cb (struct spawn_cb_arg *sca,
+               int fd_in, int fd_out, int fd_err,
+               void (*spawn_cb) (struct spawn_cb_arg *), void *spawn_cb_arg)
+{
+  sca->fds[0] = fd_in;
+  sca->fds[1] = fd_out;
+  sca->fds[2] = fd_err;
+  sca->except_fds = NULL;
+  sca->arg = spawn_cb_arg;
+  if (spawn_cb)
+    (*spawn_cb) (sca);
+}
 
+static void
+my_exec (const char *pgmname, const char *argv[], struct spawn_cb_arg *sca)
+{
+  int i;
 
-/* Simplified version of gnupg_spawn_process.  This function forks and
-   then execs PGMNAME, while connecting INFD to stdin, OUTFD to stdout
-   and ERRFD to stderr (any of them may be -1 to connect them to
-   /dev/null).  The arguments for the process are expected in the NULL
-   terminated array ARGV.  The program name itself should not be
-   included there.  Calling gnupg_wait_process is required.
+  /* Assign /dev/null to unused FDs.  */
+  for (i = 0; i <= 2; i++)
+    if (sca->fds[i] == -1)
+      sca->fds[i] = posix_open_null (i);
 
-   Returns 0 on success or an error code. */
-gpg_error_t
-gnupg_spawn_process_fd (const char *pgmname, const char *argv[],
-                        int infd, int outfd, int errfd, pid_t *pid)
+  /* Connect the standard files.  */
+  for (i = 0; i <= 2; i++)
+    if (sca->fds[i] != i)
+      {
+        if (dup2 (sca->fds[i], i) == -1)
+          log_fatal ("dup2 std%s failed: %s\n",
+                     i==0?"in":i==1?"out":"err", strerror (errno));
+        /*
+         * We don't close sca.fds[i] here, but close them by
+         * close_all_fds.  Note that there may be same one in three of
+         * sca->fds[i].
+         */
+      }
+
+  /* Close all other files.  */
+  close_all_fds (3, sca->except_fds);
+
+  execv (pgmname, (char *const *)argv);
+  /* No way to print anything, as we have may have closed all streams. */
+  _exit (127);
+}
+
+static gpg_err_code_t
+spawn_detached (const char *pgmname, const char *argv[],
+                void (*spawn_cb) (struct spawn_cb_arg *), void *spawn_cb_arg)
 {
-  gpg_error_t err;
+  gpg_err_code_t ec;
+  pid_t pid;
 
-  *pid = fork ();
-  if (*pid == (pid_t)(-1))
+  /* FIXME: Is this GnuPG specific or should we keep it.  */
+  if (getuid() != geteuid())
     {
-      err = my_error_from_syserror ();
-      log_error (_("error forking process: %s\n"), strerror (errno));
-      return err;
+      xfree (argv);
+      return GPG_ERR_BUG;
     }
 
-  if (!*pid)
+  if (access (pgmname, X_OK))
     {
-      gcry_control (GCRYCTL_TERM_SECMEM);
-      /* Run child. */
-      do_exec (pgmname, argv, infd, outfd, errfd, NULL, 0);
-      /*NOTREACHED*/
+      ec = gpg_err_code_from_syserror ();
+      xfree (argv);
+      return ec;
     }
 
-  return 0;
-}
-
-
-
+  pre_syscall ();
+  pid = fork ();
+  post_syscall ();
+  if (pid == (pid_t)(-1))
+    {
+      ec = gpg_err_code_from_syserror ();
+      log_error (_("error forking process: %s\n"), gpg_strerror (ec));
+      xfree (argv);
+      return ec;
+    }
 
-/* Waiting for child processes.
+  if (!pid)
+    {
+      pid_t pid2;
+      struct spawn_cb_arg sca;
 
-   waitpid(2) may return information about terminated children that we
-   did not yet request, and there is no portable way to wait for a
-   specific set of children.
+      if (setsid() == -1 || chdir ("/"))
+        _exit (1);
 
-   As a workaround, we store the results of children for later use.
+      pid2 = fork (); /* Double fork to let init take over the new child. */
+      if (pid2 == (pid_t)(-1))
+        _exit (1);
+      if (pid2)
+        _exit (0);  /* Let the parent exit immediately. */
 
-   XXX: This assumes that PIDs are not reused too quickly.  */
+      call_spawn_cb (&sca, -1, -1, -1, spawn_cb, spawn_cb_arg);
 
-struct terminated_child
-{
-  pid_t pid;
-  int exitcode;
-  struct terminated_child *next;
-};
+      my_exec (pgmname, argv, &sca);
+      /*NOTREACHED*/
+    }
 
-struct terminated_child *terminated_children;
+  pre_syscall ();
+  if (waitpid (pid, NULL, 0) == -1)
+    {
+      post_syscall ();
+      ec = gpg_err_code_from_syserror ();
+      log_error ("waitpid failed in gpgrt_spawn_process_detached: %s",
+                 gpg_strerror (ec));
+      return ec;
+    }
+  else
+    post_syscall ();
 
+  return 0;
+}
 
-static gpg_error_t
-store_result (pid_t pid, int exitcode)
+void
+gnupg_spawn_helper (struct spawn_cb_arg *sca)
 {
-  struct terminated_child *c;
+  int *user_except = sca->arg;
+  sca->except_fds = user_except;
+}
 
-  c = xtrymalloc (sizeof *c);
-  if (c == NULL)
-    return gpg_err_code_from_syserror ();
+gpg_err_code_t
+gnupg_process_spawn (const char *pgmname, const char *argv1[],
+                     unsigned int flags,
+                     void (*spawn_cb) (struct spawn_cb_arg *),
+                     void *spawn_cb_arg,
+                     gnupg_process_t *r_process)
+{
+  gpg_err_code_t ec;
+  gnupg_process_t process;
+  int fd_in[2];
+  int fd_out[2];
+  int fd_err[2];
+  pid_t pid;
+  const char **argv;
+  int i, j;
 
-  c->pid = pid;
-  c->exitcode = exitcode;
-  c->next = terminated_children;
-  terminated_children = c;
+  check_syscall_func ();
 
-  return 0;
-}
+  if (r_process)
+    *r_process = NULL;
 
+  /* Create the command line argument array.  */
+  i = 0;
+  if (argv1)
+    while (argv1[i])
+      i++;
+  argv = xtrycalloc (i+2, sizeof *argv);
+  if (!argv)
+    return gpg_err_code_from_syserror ();
+  argv[0] = strrchr (pgmname, '/');
+  if (argv[0])
+    argv[0]++;
+  else
+    argv[0] = pgmname;
 
-static int
-get_result (pid_t pid, int *r_exitcode)
-{
-  struct terminated_child *c, **prevp;
+  if (argv1)
+    for (i=0, j=1; argv1[i]; i++, j++)
+      argv[j] = argv1[i];
 
-  for (prevp = &terminated_children, c = terminated_children;
-       c;
-       prevp = &c->next, c = c->next)
-    if (c->pid == pid)
-      {
-        *prevp = c->next;
-        *r_exitcode = c->exitcode;
-        xfree (c);
-        return 1;
-      }
+  if ((flags & GNUPG_PROCESS_DETACHED))
+    {
+      if ((flags & GNUPG_PROCESS_STDFDS_SETTING))
+        {
+          xfree (argv);
+          return GPG_ERR_INV_FLAG;
+        }
 
-  return 0;
-}
+      /* In detached case, it must be no R_PROCESS.  */
+      if (r_process)
+        {
+          xfree (argv);
+          return GPG_ERR_INV_ARG;
+        }
 
+      return spawn_detached (pgmname, argv, spawn_cb, spawn_cb_arg);
+    }
 
-/* See exechelp.h for a description.  */
-gpg_error_t
-gnupg_wait_process (const char *pgmname, pid_t pid, int hang, int *r_exitcode)
-{
-  gpg_err_code_t ec;
-  int i, status;
+  process = xtrycalloc (1, sizeof (struct gnupg_process));
+  if (process == NULL)
+    {
+      xfree (argv);
+      return gpg_err_code_from_syserror ();
+    }
 
-  if (r_exitcode)
-    *r_exitcode = -1;
+  process->pgmname = pgmname;
+  process->flags = flags;
 
-  if (pid == (pid_t)(-1))
-    return gpg_error (GPG_ERR_INV_VALUE);
+  if ((flags & GNUPG_PROCESS_STDINOUT_SOCKETPAIR))
+    {
+      ec = do_create_socketpair (fd_in);
+      if (ec)
+        {
+          xfree (process);
+          xfree (argv);
+          return ec;
+        }
+      fd_out[0] = dup (fd_in[0]);
+      fd_out[1] = dup (fd_in[1]);
+    }
+  else
+    {
+      if ((flags & GNUPG_PROCESS_STDIN_PIPE))
+        {
+          ec = do_create_pipe (fd_in);
+          if (ec)
+            {
+              xfree (process);
+              xfree (argv);
+              return ec;
+            }
+        }
+      else if ((flags & GNUPG_PROCESS_STDIN_KEEP))
+        {
+          fd_in[0] = 0;
+          fd_in[1] = -1;
+        }
+      else
+        {
+          fd_in[0] = -1;
+          fd_in[1] = -1;
+        }
 
-#ifdef USE_NPTH
-  i = npth_waitpid (pid, &status, hang? 0:WNOHANG);
-#else
-  while ((i=waitpid (pid, &status, hang? 0:WNOHANG)) == (pid_t)(-1)
-	 && errno == EINTR);
-#endif
+      if ((flags & GNUPG_PROCESS_STDOUT_PIPE))
+        {
+          ec = do_create_pipe (fd_out);
+          if (ec)
+            {
+              if (fd_in[0] >= 0 && fd_in[0] != 0)
+                close (fd_in[0]);
+              if (fd_in[1] >= 0)
+                close (fd_in[1]);
+              xfree (process);
+              xfree (argv);
+              return ec;
+            }
+        }
+      else if ((flags & GNUPG_PROCESS_STDOUT_KEEP))
+        {
+          fd_out[0] = -1;
+          fd_out[1] = 1;
+        }
+      else
+        {
+          fd_out[0] = -1;
+          fd_out[1] = -1;
+        }
+    }
 
-  if (i == (pid_t)(-1))
+  if ((flags & GNUPG_PROCESS_STDERR_PIPE))
     {
-      ec = gpg_err_code_from_errno (errno);
-      log_error (_("waiting for process %d to terminate failed: %s\n"),
-                 (int)pid, strerror (errno));
+      ec = do_create_pipe (fd_err);
+      if (ec)
+        {
+          if (fd_in[0] >= 0 && fd_in[0] != 0)
+            close (fd_in[0]);
+          if (fd_in[1] >= 0)
+            close (fd_in[1]);
+          if (fd_out[0] >= 0)
+            close (fd_out[0]);
+          if (fd_out[1] >= 0 && fd_out[1] != 1)
+            close (fd_out[1]);
+          xfree (process);
+          xfree (argv);
+          return ec;
+        }
     }
-  else if (!i)
+  else if ((flags & GNUPG_PROCESS_STDERR_KEEP))
     {
-      ec = GPG_ERR_TIMEOUT; /* Still running.  */
+      fd_err[0] = -1;
+      fd_err[1] = 2;
     }
-  else if (WIFEXITED (status) && WEXITSTATUS (status) == 127)
+  else
     {
-      log_error (_("error running '%s': probably not installed\n"), pgmname);
-      ec = GPG_ERR_CONFIGURATION;
+      fd_err[0] = -1;
+      fd_err[1] = -1;
     }
-  else if (WIFEXITED (status) && WEXITSTATUS (status))
+
+  pre_syscall ();
+  pid = fork ();
+  post_syscall ();
+  if (pid == (pid_t)(-1))
     {
-      if (!r_exitcode)
-        log_error (_("error running '%s': exit status %d\n"), pgmname,
-                   WEXITSTATUS (status));
-      else
-        *r_exitcode = WEXITSTATUS (status);
-      ec = GPG_ERR_GENERAL;
+      ec = gpg_err_code_from_syserror ();
+      log_error (_("error forking process: %s\n"), gpg_strerror (ec));
+      if (fd_in[0] >= 0 && fd_in[0] != 0)
+        close (fd_in[0]);
+      if (fd_in[1] >= 0)
+        close (fd_in[1]);
+      if (fd_out[0] >= 0)
+        close (fd_out[0]);
+      if (fd_out[1] >= 0 && fd_out[1] != 1)
+        close (fd_out[1]);
+      if (fd_err[0] >= 0)
+        close (fd_err[0]);
+      if (fd_err[1] >= 0 && fd_err[1] != 2)
+        close (fd_err[1]);
+      xfree (process);
+      xfree (argv);
+      return ec;
     }
-  else if (!WIFEXITED (status))
+
+  if (!pid)
     {
-      log_error (_("error running '%s': terminated\n"), pgmname);
-      ec = GPG_ERR_GENERAL;
+      struct spawn_cb_arg sca;
+
+      if (fd_in[1] >= 0)
+        close (fd_in[1]);
+      if (fd_out[0] >= 0)
+        close (fd_out[0]);
+      if (fd_err[0] >= 0)
+        close (fd_err[0]);
+
+      call_spawn_cb (&sca, fd_in[0], fd_out[1], fd_err[1],
+                     spawn_cb, spawn_cb_arg);
+
+      /* Run child. */
+      my_exec (pgmname, argv, &sca);
+      /*NOTREACHED*/
     }
-  else
+
+  xfree (argv);
+  process->pid = pid;
+
+  if (fd_in[0] >= 0 && fd_in[0] != 0)
+    close (fd_in[0]);
+  if (fd_out[1] >= 0 && fd_out[1] != 1)
+    close (fd_out[1]);
+  if (fd_err[1] >= 0 && fd_err[1] != 2)
+    close (fd_err[1]);
+  process->fd_in = fd_in[1];
+  process->fd_out = fd_out[0];
+  process->fd_err = fd_err[0];
+  process->wstatus = -1;
+  process->terminated = 0;
+
+  if (r_process == NULL)
     {
-      if (r_exitcode)
-        *r_exitcode = 0;
-      ec = 0;
+      ec = gnupg_process_wait (process, 1);
+      gnupg_process_release (process);
+      return ec;
     }
 
-  return gpg_err_make (GPG_ERR_SOURCE_DEFAULT, ec);
+  *r_process = process;
+  return 0;
 }
 
-/* See exechelp.h for a description.  */
-gpg_error_t
-gnupg_wait_processes (const char **pgmnames, pid_t *pids, size_t count,
-                      int hang, int *r_exitcodes)
+static gpg_err_code_t
+process_kill (gnupg_process_t process, int sig)
 {
   gpg_err_code_t ec = 0;
-  size_t i, left;
-  int *dummy = NULL;
+  pid_t pid = process->pid;
 
-  if (r_exitcodes == NULL)
+  pre_syscall ();
+  if (kill (pid, sig) < 0)
+    ec = gpg_err_code_from_syserror ();
+  post_syscall ();
+  return ec;
+}
+
+gpg_err_code_t
+gnupg_process_terminate (gnupg_process_t process)
+{
+  return process_kill (process, SIGTERM);
+}
+
+gpg_err_code_t
+gnupg_process_get_fds (gnupg_process_t process, unsigned int flags,
+                       int *r_fd_in, int *r_fd_out, int *r_fd_err)
+{
+  (void)flags;
+  if (r_fd_in)
     {
-      dummy = r_exitcodes = xtrymalloc (sizeof *r_exitcodes * count);
-      if (dummy == NULL)
-        return gpg_err_code_from_syserror ();
+      *r_fd_in = process->fd_in;
+      process->fd_in = -1;
     }
-
-  for (i = 0, left = count; i < count; i++)
+  if (r_fd_out)
     {
-      int status = -1;
+      *r_fd_out = process->fd_out;
+      process->fd_out = -1;
+    }
+  if (r_fd_err)
+    {
+      *r_fd_err = process->fd_err;
+      process->fd_err = -1;
+    }
 
-      /* Skip invalid PID.  */
-      if (pids[i] == (pid_t)(-1))
-        {
-          r_exitcodes[i] = -1;
-          left -= 1;
-          continue;
-        }
+  return 0;
+}
 
-      /* See if there was a previously stored result for this pid.  */
-      if (get_result (pids[i], &status))
-        left -= 1;
+gpg_err_code_t
+gnupg_process_get_streams (gnupg_process_t process, unsigned int flags,
+                           gpgrt_stream_t *r_fp_in, gpgrt_stream_t *r_fp_out,
+                           gpgrt_stream_t *r_fp_err)
+{
+  int nonblock = (flags & GNUPG_PROCESS_STREAM_NONBLOCK)? 1: 0;
 
-      r_exitcodes[i] = status;
+  if (r_fp_in)
+    {
+      *r_fp_in = es_fdopen (process->fd_in, nonblock? "w,nonblock" : "w");
+      process->fd_in = -1;
+    }
+  if (r_fp_out)
+    {
+      *r_fp_out = es_fdopen (process->fd_out, nonblock? "r,nonblock" : "r");
+      process->fd_out = -1;
+    }
+  if (r_fp_err)
+    {
+      *r_fp_err = es_fdopen (process->fd_err, nonblock? "r,nonblock" : "r");
+      process->fd_err = -1;
     }
+  return 0;
+}
 
-  while (left > 0)
+static gpg_err_code_t
+process_vctl (gnupg_process_t process, unsigned int request, va_list arg_ptr)
+{
+  switch (request)
     {
-      pid_t pid;
-      int status;
+    case GNUPG_PROCESS_NOP:
+      return 0;
 
-#ifdef USE_NPTH
-      pid = npth_waitpid (-1, &status, hang ? 0 : WNOHANG);
-#else
-      while ((pid = waitpid (-1, &status, hang ? 0 : WNOHANG)) == (pid_t)(-1)
-             && errno == EINTR);
-#endif
+    case GNUPG_PROCESS_GET_PROC_ID:
+      {
+        int *r_id = va_arg (arg_ptr, int *);
 
-      if (pid == (pid_t)(-1))
-        {
-          ec = gpg_err_code_from_errno (errno);
-          log_error (_("waiting for processes to terminate failed: %s\n"),
-                     strerror (errno));
-          break;
-        }
-      else if (!pid)
-        {
-          ec = GPG_ERR_TIMEOUT; /* Still running.  */
-          break;
-        }
-      else
-        {
-          for (i = 0; i < count; i++)
-            if (pid == pids[i])
-              break;
+        if (r_id == NULL)
+          return GPG_ERR_INV_VALUE;
 
-          if (i == count)
-            {
-              /* No match, store this result.  */
-              ec = store_result (pid, status);
-              if (ec)
-                break;
-              continue;
-            }
+        *r_id = (int)process->pid;
+        return 0;
+      }
 
-          /* Process PIDS[i] died.  */
-          if (r_exitcodes[i] != (pid_t) -1)
-            {
-              log_error ("PID %d was reused", pid);
-              ec = GPG_ERR_GENERAL;
-              break;
-            }
+    case GNUPG_PROCESS_GET_EXIT_ID:
+      {
+        int status = process->wstatus;
+        int *r_exit_status = va_arg (arg_ptr, int *);
 
-          left -= 1;
-          r_exitcodes[i] = status;
-        }
-    }
+        if (!process->terminated)
+          return GPG_ERR_UNFINISHED;
 
-  for (i = 0; i < count; i++)
-    {
-      if (r_exitcodes[i] == -1)
-        continue;
+        if (WIFEXITED (status))
+          {
+            if (r_exit_status)
+              *r_exit_status = WEXITSTATUS (status);
+          }
+        else
+          *r_exit_status = -1;
 
-      if (WIFEXITED (r_exitcodes[i]) && WEXITSTATUS (r_exitcodes[i]) == 127)
-        {
-          log_error (_("error running '%s': probably not installed\n"),
-                     pgmnames[i]);
-          ec = GPG_ERR_CONFIGURATION;
-        }
-      else if (WIFEXITED (r_exitcodes[i]) && WEXITSTATUS (r_exitcodes[i]))
-        {
-          if (dummy)
-            log_error (_("error running '%s': exit status %d\n"),
-                       pgmnames[i], WEXITSTATUS (r_exitcodes[i]));
-          else
-            r_exitcodes[i] = WEXITSTATUS (r_exitcodes[i]);
-          ec = GPG_ERR_GENERAL;
-        }
-      else if (!WIFEXITED (r_exitcodes[i]))
-        {
-          log_error (_("error running '%s': terminated\n"), pgmnames[i]);
-          ec = GPG_ERR_GENERAL;
-        }
+        return 0;
+      }
+
+    case GNUPG_PROCESS_GET_PID:
+      {
+        pid_t *r_pid = va_arg (arg_ptr, pid_t *);
+
+        if (r_pid == NULL)
+          return GPG_ERR_INV_VALUE;
+
+        *r_pid = process->pid;
+        return 0;
+      }
+
+    case GNUPG_PROCESS_GET_WSTATUS:
+      {
+        int status = process->wstatus;
+        int *r_if_exited = va_arg (arg_ptr, int *);
+        int *r_if_signaled = va_arg (arg_ptr, int *);
+        int *r_exit_status = va_arg (arg_ptr, int *);
+        int *r_termsig = va_arg (arg_ptr, int *);
+
+        if (!process->terminated)
+          return GPG_ERR_UNFINISHED;
+
+        if (WIFEXITED (status))
+          {
+            if (r_if_exited)
+              *r_if_exited = 1;
+            if (r_if_signaled)
+              *r_if_signaled = 0;
+            if (r_exit_status)
+              *r_exit_status = WEXITSTATUS (status);
+            if (r_termsig)
+              *r_termsig = 0;
+          }
+        else if (WIFSIGNALED (status))
+          {
+            if (r_if_exited)
+              *r_if_exited = 0;
+            if (r_if_signaled)
+              *r_if_signaled = 1;
+            if (r_exit_status)
+              *r_exit_status = 0;
+            if (r_termsig)
+              *r_termsig = WTERMSIG (status);
+          }
+
+        return 0;
+      }
+
+    case GNUPG_PROCESS_KILL:
+      {
+        int sig = va_arg (arg_ptr, int);
+
+        return process_kill (process, sig);
+      }
+
+    default:
+      break;
     }
 
-  xfree (dummy);
-  return gpg_err_make (GPG_ERR_SOURCE_DEFAULT, ec);
+  return GPG_ERR_UNKNOWN_COMMAND;
 }
 
-
-
-void
-gnupg_release_process (pid_t pid)
+gpg_err_code_t
+gnupg_process_ctl (gnupg_process_t process, unsigned int request, ...)
 {
-  (void)pid;
-}
+  va_list arg_ptr;
+  gpg_err_code_t ec;
 
+  va_start (arg_ptr, request);
+  ec = process_vctl (process, request, arg_ptr);
+  va_end (arg_ptr);
+  return ec;
+}
 
-/* Spawn a new process and immediately detach from it.  The name of
-   the program to exec is PGMNAME and its arguments are in ARGV (the
-   programname is automatically passed as first argument).
-   Environment strings in ENVP are set.  An error is returned if
-   pgmname is not executable; to make this work it is necessary to
-   provide an absolute file name.  All standard file descriptors are
-   connected to /dev/null. */
-gpg_error_t
-gnupg_spawn_process_detached (const char *pgmname, const char *argv[],
-                              const char *envp[] )
+gpg_err_code_t
+gnupg_process_wait (gnupg_process_t process, int hang)
 {
   gpg_err_code_t ec;
+  int status;
   pid_t pid;
-  int i;
 
-  if (getuid() != geteuid())
-    return my_error (GPG_ERR_BUG);
+  if (process->terminated)
+    /* Already terminated.  */
+    return 0;
 
-  if ((ec = gnupg_access (pgmname, X_OK)))
-    return gpg_err_make (default_errsource, ec);
+  pre_syscall ();
+  while ((pid = waitpid (process->pid, &status, hang? 0: WNOHANG))
+         == (pid_t)(-1) && errno == EINTR);
+  post_syscall ();
 
-  pid = fork ();
   if (pid == (pid_t)(-1))
     {
-      log_error (_("error forking process: %s\n"), strerror (errno));
-      return my_error_from_syserror ();
+      ec = gpg_err_code_from_syserror ();
+      log_error (_("waiting for process %d to terminate failed: %s\n"),
+                        (int)pid, gpg_strerror (ec));
     }
-  if (!pid)
+  else if (!pid)
     {
-      pid_t pid2;
-
-      gcry_control (GCRYCTL_TERM_SECMEM);
-      if (setsid() == -1 || chdir ("/"))
-        _exit (1);
-
-      pid2 = fork (); /* Double fork to let init take over the new child. */
-      if (pid2 == (pid_t)(-1))
-        _exit (1);
-      if (pid2)
-        _exit (0);  /* Let the parent exit immediately. */
+      ec = GPG_ERR_TIMEOUT; /* Still running.  */
+    }
+  else
+    {
+      process->terminated = 1;
+      process->wstatus = status;
+      ec = 0;
+    }
 
-      if (envp)
-        for (i=0; envp[i]; i++)
-          putenv (xstrdup (envp[i]));
+  return ec;
+}
 
-      do_exec (pgmname, argv, -1, -1, -1, NULL, 0);
+void
+gnupg_process_release (gnupg_process_t process)
+{
+  if (!process)
+    return;
 
-      /*NOTREACHED*/
+  if (process->terminated)
+    {
+      gnupg_process_terminate (process);
+      gnupg_process_wait (process, 1);
     }
 
-  if (waitpid (pid, NULL, 0) == -1)
-    log_error ("waitpid failed in gnupg_spawn_process_detached: %s",
-               strerror (errno));
-
-  return 0;
+  xfree (process);
 }
 
-
-/* Kill a process; that is send an appropriate signal to the process.
-   gnupg_wait_process must be called to actually remove the process
-   from the system.  An invalid PID is ignored.  */
-void
-gnupg_kill_process (pid_t pid)
+gpg_err_code_t
+gnupg_process_wait_list (gnupg_process_t *process_list, int count, int hang)
 {
-  if (pid != (pid_t)(-1))
+  gpg_err_code_t ec = 0;
+  int i;
+
+  for (i = 0; i < count; i++)
     {
-      kill (pid, SIGTERM);
+      if (process_list[i]->terminated)
+        continue;
+
+      ec = gnupg_process_wait (process_list[i], hang);
+      if (ec)
+        break;
     }
+
+  return ec;
 }