System info:
kernel: 3.4.8-1-ARCH
dist: Arch linux
python: 3.2.3

subprocess.Popen() fails if python interpreter is started with closed 0, 1 or 2 descriptor.

Traceback (most recent call last):
  File "<string>", line 14, in <module>
  File "/usr/lib/python3.2/subprocess.py", line 745, in __init__
    restore_signals, start_new_session)
  File "/usr/lib/python3.2/subprocess.py", line 1197, in _execute_child
    restore_signals, start_new_session, preexec_fn)
ValueError: errpipe_write must be >= 3

#10806 seems related.

It's caused by the following check in _posixsubprocess.c:
    if (close_fds && errpipe_write < 3) {  /* precondition */
        PyErr_SetString(PyExc_ValueError, "errpipe_write must be >= 3");
        return NULL;
    }

which was written by Gregory P. Smith in 2010 (adding to nosy list).

I'm not entirely sure why this check is here, presumably its due to the way close_fds=True is handled.

The close fds logic is also hardcoded to close fds from 3 upwards,.

easy enough to reproduce...

$ ./python.exe -c 'import os, subprocess as s; os.close(0); os.close(1); s.Popen(["/bin/true"])'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/Users/gps/python/hg/default/Lib/subprocess.py", line 818, in __init__
    restore_signals, start_new_session)
  File "/Users/gps/python/hg/default/Lib/subprocess.py", line 1363, in _execute_child
    restore_signals, start_new_session, preexec_fn)
ValueError: errpipe_write must be >= 3

Examining the code, it looks like that restriction is to prevent the dup2's for any passed in stdin, stdout or stderr pipes from overwriting errpipe_write in Modules/_posixsubprocess.c's child_exec() function.

First guess at a fix: child_exec() needs to detect this situation and dup(errpipe_write) until it gets a fd not in the 0..2 range before the dup2(...) calls that could otherwise blindly clobber it.  This could possibly be done by the parent process's _create_pipe() in Lib/subprocess.py when allocating the errpipe_read and errpipe_write fds.

Suggested Workaround: for now for any code running into this (Python daemons launching subprocesses?) - Call os.pipe() twice at the start of your program to burn 4 fds.  That'll guarantee 0, 1 and 2 will not be used for this pipe.

The attached patch + test seems to fix the issue.

It's not very elegant.

Yes, something along the lines of that patch is what I was thinking.  BTW, this is only necessary for the errpipe_write fd.  errpipe_read is for the parent process.

I'm going to do it within _create_pipe so that the optimal _posixsubprocess.cloexec_pipe pipe2() based implementation can be used when possible rather than needing to call _set_cloexec() on the dup'ed fd.

There are some recent Linux specific possibilities such as fcntl with F_DUPFD, or better F_DUPFD_CLOEXEC, that would make this a single call. Using that may be overkill for this situation but it looks easy enough while I'm in there.

It may be implemented simplier.
fcntl(fd, F_DUPFD_CLOEXEC, min_fd_number) will allocate new fd at least min_fd_number. So, it is not necessary to do a lot of dup() calls.

F_DUPFD_CLOEXEC appears exclusive to modern Linux kernels.  Any idea how wide spread support for plain F_DUPFD is?  If that is "everywhere" the code I've just whipped up could lose a lot of loops...

Here's my initial fix.

If fcntl(errpipe_write, F_DUPFD, 3) is widely available this could be shrunk a bit to avoid the for loop potentially calling dup a few times and tracking the wasted fds to close later.

Otherwise if it isn't I'd rather not bother with F_DUPFD as this code takes the optimal path when F_DUPFD_CLOEXEC is supported (true on all modern linux systems) and should cause no harm beyond a couple extra dup and close syscalls otherwise.

Note: Linux pipe2() support appears in kernels a few revisions after F_DUPFD_CLOEXEC support so the good behavior when pipe2 exists will be kept in this situation as that also means F_DUPFD_CLOEXEC support should exist.  The code will work regardless of that (incase someone has a frankenkernel, or other OSes choose to implement one but not the other).

I sent a review through on rietveld; I'm attaching a patch with the changes so that it compiles and passes the tests.

I haven't tested Ross's latest patch, but it looks ok to me.

Would it simplify matters to stop treating 0,1,2 specially and just add them to pass_fds instead?

adding {0,1,2} to fds_to_keep (populated from pass_fds) is indeed an alternate approach.  A variant of an alternate patch doing that attached.

This actually simplifies code.  Is there anything this would hurt that i'm not seeing?

I suppose it adds minor overhead to the fork_exec() call by passing more in and lookups into the fds_to_keep list now that it will always contain at least 4 values instead of the previous 1.  I doubt that is matters (I haven't measured anything).

New changeset c4cd891cf167 by Gregory P. Smith in branch '3.3':
Fixes Issue #15798 - subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/c4cd891cf167

New changeset 0387054b2038 by Gregory P. Smith in branch 'default':
Fixes Issue #15798 - subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/0387054b2038

New changeset efcdf2a70f2a by Gregory P. Smith in branch '3.3':
Undo supposed fix for Issue #15798 until I understand why this is
http://hg.python.org/cpython/rev/efcdf2a70f2a

New changeset ddbf9632795b by Gregory P. Smith in branch 'default':
Undo supposed fix for Issue #15798 until I understand why this is
http://hg.python.org/cpython/rev/ddbf9632795b

New changeset 2df5e1f537b0 by Gregory P. Smith in branch 'default':
Fixes issue #15798: subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/2df5e1f537b0

New changeset 07425df887b5 by Gregory P. Smith in branch '3.3':
Fixes issue #15798: subprocess.Popen() no longer fails if file
http://hg.python.org/cpython/rev/07425df887b5

i went with the less invasive in terms of behavior change approach of making sure that the errpipe_write fd is always >= 3.  In Python 3.4 the code change was different and much simpler and on the Python only side as all fd's are opened O_CLOEXEC by default.

I'm not entirely sure why the test_multiprocessing_forkserver and test_multiprocessing_spawn failures happened on 3.4 with the earlier change that attempted to always list 0,1,2 in the fds_to_keep (derived from pass_fds) list so there _may_ be a bug lurking elsewhere there but I suspect the bug is actually that we don't always want to blindly list them in fds_to_keep as some programs may have reused some of them for other non-stdio purposes but still want them closed.

The change has been backported to the python-subprocess32 repo.