syscall(linux): forkAndExecInChild

runtime/internal/lib/syscall/exec_linux.go

@@ -6,7 +6,14 @@
 
 package syscall
 
-import c "github.com/goplus/llgo/runtime/internal/clite"
+import (
+	"runtime"
+	"unsafe"
+
+	c "github.com/goplus/llgo/runtime/internal/clite"
+	"github.com/goplus/llgo/runtime/internal/clite/os"
+	"github.com/goplus/llgo/runtime/internal/clite/syscall"
+)
 
 // Linux unshare/clone/clone2/clone3 flags, architecture-independent,
 // copied from linux/sched.h.
@@ -123,12 +130,14 @@ func runtime_AfterForkInChild()
 //
 // func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err Errno) {
 func forkAndExecInChild(argv0 *c.Char, argv, envv **c.Char, chroot, dir *c.Char, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err Errno) {
-	/* TODO(xsw):
 	// Set up and fork. This returns immediately in the parent or
 	// if there's an error.
-	upid, err, mapPipe, locked := forkAndExecInChild1(argv0, argv, envv, chroot, dir, attr, sys, pipe)
+	upid, err, _, locked := forkAndExecInChild1(argv0, argv, envv, chroot, dir, attr, sys, pipe)
 	if locked {
+		/**
 		runtime_AfterFork()
+		*/
+		panic("todo: syscall.forkAndExecInChild - locked")
 	}
 	if err != 0 {
 		return 0, err
@@ -138,6 +147,7 @@ func forkAndExecInChild(argv0 *c.Char, argv, envv **c.Char, chroot, dir *c.Char,
 	pid = int(upid)
 
 	if sys.UidMappings != nil || sys.GidMappings != nil {
+		/**
 		Close(mapPipe[0])
 		var err2 Errno
 		// uid/gid mappings will be written after fork and unshare(2) for user
@@ -149,11 +159,11 @@ func forkAndExecInChild(argv0 *c.Char, argv, envv **c.Char, chroot, dir *c.Char,
 		}
 		RawSyscall(SYS_WRITE, uintptr(mapPipe[1]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))
 		Close(mapPipe[1])
+		*/
+		panic("todo: syscall.forkAndExecInChild - sys.UidMappings")
 	}
 
 	return pid, 0
-	*/
-	panic("todo: syscall.forkAndExecInChild")
 }
 
 const _LINUX_CAPABILITY_VERSION_3 = 0x20080522
@@ -202,11 +212,12 @@ type cloneArgs struct {
 // This is go:noinline because the point is to keep the stack frames
 // of this and forkAndExecInChild separate.
 //
+// func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid uintptr, err1 Errno, mapPipe [2]int, locked bool) {
+
 //go:noinline
 //go:norace
 //go:nocheckptr
-func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid uintptr, err1 Errno, mapPipe [2]int, locked bool) {
+func forkAndExecInChild1(argv0 *c.Char, argv, envv **c.Char, chroot, dir *c.Char, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid uintptr, err1 Errno, mapPipe [2]int, locked bool) {
-	/* TODO(xsw):
 	// Defined in linux/prctl.h starting with Linux 4.3.
 	const (
 		PR_CAP_AMBIENT       = 0x2f
@@ -240,17 +251,23 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 		dirfd                     int
 		cred                      *Credential
 		ngroups, groups           uintptr
-			c                         uintptr
+		// c                         uintptr
 	)
 
 	rlim, rlimOK := origRlimitNofile.Load().(Rlimit)
 
+	_, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _ = rlim, rlimOK, psetgroups, groups, err2, caps, fd1, uidmap, puid, pgid, gidmap, setgroups, pgrp, dirfd, ngroups, i
+
 	if sys.UidMappings != nil {
+		/*
 			puid = []byte("/proc/self/uid_map\000")
 			uidmap = formatIDMappings(sys.UidMappings)
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.UidMappings")
 	}
 
 	if sys.GidMappings != nil {
+		/*
 			psetgroups = []byte("/proc/self/setgroups\000")
 			pgid = []byte("/proc/self/gid_map\000")
 
@@ -260,10 +277,14 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 				setgroups = []byte("deny\000")
 			}
 			gidmap = formatIDMappings(sys.GidMappings)
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.GidMappings")
 	}
 
 	// Record parent PID so child can test if it has died.
-		ppid, _ := rawSyscallNoError(SYS_GETPID, 0, 0, 0)
+	/**
+	ppid, _ := rawSyscallNoError(syscall.SYS_GETPID, 0, 0, 0)
+	*/
 
 	// Guard against side effects of shuffling fds below.
 	// Make sure that nextfd is beyond any currently open files so
@@ -281,10 +302,13 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 	// Allocate another pipe for parent to child communication for
 	// synchronizing writing of User ID/Group ID mappings.
 	if sys.UidMappings != nil || sys.GidMappings != nil {
+		/*
 			if err := forkExecPipe(mapPipe[:]); err != nil {
 				err1 = err.(Errno)
 				return
 			}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.UidMappings")
 	}
 
 	flags = sys.Cloneflags
@@ -295,29 +319,45 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 	if sys.UseCgroupFD {
 		clone3 = &cloneArgs{
 			flags:      uint64(flags) | CLONE_INTO_CGROUP,
-				exitSignal: uint64(SIGCHLD),
+			exitSignal: uint64(syscall.SIGCHLD),
 			cgroup:     uint64(sys.CgroupFD),
 		}
 	} else if flags&CLONE_NEWTIME != 0 {
 		clone3 = &cloneArgs{
 			flags:      uint64(flags),
-				exitSignal: uint64(SIGCHLD),
+			exitSignal: uint64(syscall.SIGCHLD),
 		}
 	}
 
 	// About to call fork.
 	// No more allocation or calls of non-assembly functions.
-		runtime_BeforeFork()
+	// runtime_BeforeFork()
+	var r1 uintptr
+	r1, err1 = fork()
+	if err1 != 0 {
+		// runtime_AfterFork()
+		return 0, err1, mapPipe, locked
+	}
+
+	if r1 != 0 {
+		// parent; return PID
+		// runtime_AfterFork()
+		return r1, 0, mapPipe, locked
+	}
+
 	locked = true
 	if clone3 != nil {
+		/**
 		pid, err1 = rawVforkSyscall(_SYS_clone3, uintptr(unsafe.Pointer(clone3)), unsafe.Sizeof(*clone3))
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - clone3 != nil")
 	} else {
-			flags |= uintptr(SIGCHLD)
+		flags |= uintptr(syscall.SIGCHLD)
 		if runtime.GOARCH == "s390x" {
 			// On Linux/s390, the first two arguments of clone(2) are swapped.
-				pid, err1 = rawVforkSyscall(SYS_CLONE, 0, flags)
+			// pid, err1 = rawVforkSyscall(syscall.SYS_CLONE, 0, flags)
 		} else {
-				pid, err1 = rawVforkSyscall(SYS_CLONE, flags, 0)
+			// pid, err1 = rawVforkSyscall(syscall.SYS_CLONE, flags, 0)
 		}
 	}
 	if err1 != 0 || pid != 0 {
@@ -334,109 +374,125 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 
 	// Enable the "keep capabilities" flag to set ambient capabilities later.
 	if len(sys.AmbientCaps) > 0 {
-			_, _, err1 = RawSyscall6(SYS_PRCTL, PR_SET_KEEPCAPS, 1, 0, 0, 0, 0)
+		/**
+		_, _, err1 = RawSyscall6(syscall.SYS_PRCTL, syscall.PR_SET_KEEPCAPS, 1, 0, 0, 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.AmbientCaps")
 	}
 
 	// Wait for User ID/Group ID mappings to be written.
 	if sys.UidMappings != nil || sys.GidMappings != nil {
-			if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(mapPipe[1]), 0, 0); err1 != 0 {
+		/**
+		if _, _, err1 = RawSyscall(syscall.SYS_CLOSE, uintptr(mapPipe[1]), 0, 0); err1 != 0 {
 			goto childerror
 		}
-			pid, _, err1 = RawSyscall(SYS_READ, uintptr(mapPipe[0]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))
+		pid, _, err1 = RawSyscall(syscall.SYS_READ, uintptr(mapPipe[0]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))
 		if err1 != 0 {
 			goto childerror
 		}
 		if pid != unsafe.Sizeof(err2) {
-				err1 = EINVAL
+			err1 = syscall.EINVAL
 			goto childerror
 		}
 		if err2 != 0 {
 			err1 = err2
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.UidMappings")
 	}
 
 	// Session ID
 	if sys.Setsid {
-			_, _, err1 = RawSyscall(SYS_SETSID, 0, 0, 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_SETSID, 0, 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Setsid")
 	}
 
 	// Set process group
 	if sys.Setpgid || sys.Foreground {
 		// Place child in process group.
-			_, _, err1 = RawSyscall(SYS_SETPGID, 0, uintptr(sys.Pgid), 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_SETPGID, 0, uintptr(sys.Pgid), 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Setpgid")
 	}
 
 	if sys.Foreground {
+		/**
 		pgrp = int32(sys.Pgid)
 		if pgrp == 0 {
-				pid, _ = rawSyscallNoError(SYS_GETPID, 0, 0, 0)
+			pid, _ = rawSyscallNoError(syscall.SYS_GETPID, 0, 0, 0)
 
 			pgrp = int32(pid)
 		}
 
 		// Place process group in foreground.
-			_, _, err1 = RawSyscall(SYS_IOCTL, uintptr(sys.Ctty), uintptr(TIOCSPGRP), uintptr(unsafe.Pointer(&pgrp)))
+		_, _, err1 = RawSyscall(syscall.SYS_IOCTL, uintptr(sys.Ctty), uintptr(syscall.TIOCSPGRP), uintptr(unsafe.Pointer(&pgrp)))
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Foreground")
 	}
 
 	// Restore the signal mask. We do this after TIOCSPGRP to avoid
 	// having the kernel send a SIGTTOU signal to the process group.
-		runtime_AfterForkInChild()
+	// runtime_AfterForkInChild()
 
 	// Unshare
 	if sys.Unshareflags != 0 {
-			_, _, err1 = RawSyscall(SYS_UNSHARE, sys.Unshareflags, 0, 0)
+		/**
+		 _, _, err1 = RawSyscall(syscall.SYS_UNSHARE, sys.Unshareflags, 0, 0)
 		 if err1 != 0 {
 		 	goto childerror
 		 }
 
 		 if sys.Unshareflags&CLONE_NEWUSER != 0 && sys.GidMappings != nil {
-				dirfd = int(_AT_FDCWD)
+		 	dirfd = int(syscall.AT_FDCWD)
-				if fd1, _, err1 = RawSyscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&psetgroups[0])), uintptr(O_WRONLY), 0, 0, 0); err1 != 0 {
+		 	if fd1, _, err1 = RawSyscall6(syscall.SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&psetgroups[0])), uintptr(syscall.O_WRO∂∂∂NLY), 0, 0, 0); err1 != 0 {
 		 		goto childerror
 		 	}
-				pid, _, err1 = RawSyscall(SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&setgroups[0])), uintptr(len(setgroups)))
+		 	pid, _, err1 = RawSyscall(syscall.SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&setgroups[0])), uintptr(len(setgroups)))
 		 	if err1 != 0 {
 		 		goto childerror
 		 	}
-				if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
+		 	if _, _, err1 = RawSyscall(syscall.SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
 		 		goto childerror
 		 	}
 
-				if fd1, _, err1 = RawSyscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&pgid[0])), uintptr(O_WRONLY), 0, 0, 0); err1 != 0 {
+		 	if fd1, _, err1 = RawSyscall6(syscall.SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&pgid[0])), uintptr(syscall.O_WRONLY), 0, 0, 0); err1 != 0 {
 		 		goto childerror
 			}
-				pid, _, err1 = RawSyscall(SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&gidmap[0])), uintptr(len(gidmap)))
+			pid, _, err1 = RawSyscall(syscall.SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&gidmap[0])), uintptr(len(gidmap)))
 		 	if err1 != 0 {
 				goto childerror
 		 	}
-				if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
+		 	if _, _, err1 = RawSyscall(syscall.SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
 		 		goto childerror
 		 	}
 		}
 
 		if sys.Unshareflags&CLONE_NEWUSER != 0 && sys.UidMappings != nil {
-				dirfd = int(_AT_FDCWD)
+			dirfd = int(syscall._AT_FDCWD)
-				if fd1, _, err1 = RawSyscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&puid[0])), uintptr(O_WRONLY), 0, 0, 0); err1 != 0 {
+			if fd1, _, err1 = RawSyscall6(syscall.SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(&puid[0])), uintptr(syscall.O_WRONLY), 0, 0, 0); err1 != 0 {
 				goto childerror
 			}
-				pid, _, err1 = RawSyscall(SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&uidmap[0])), uintptr(len(uidmap)))
+			pid, _, err1 = RawSyscall(syscall.SYS_WRITE, uintptr(fd1), uintptr(unsafe.Pointer(&uidmap[0])), uintptr(len(uidmap)))
 			if err1 != 0 {
 				goto childerror
 			}
-				if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
+			if _, _, err1 = RawSyscall(syscall.SYS_CLOSE, uintptr(fd1), 0, 0); err1 != 0 {
 				goto childerror
 			}
 		}
@@ -449,23 +505,29 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 		// To make this model work we must further mark / as MS_PRIVATE.
 		// This is what the standard unshare command does.
 		if sys.Unshareflags&CLONE_NEWNS == CLONE_NEWNS {
-				_, _, err1 = RawSyscall6(SYS_MOUNT, uintptr(unsafe.Pointer(&none[0])), uintptr(unsafe.Pointer(&slash[0])), 0, MS_REC|MS_PRIVATE, 0, 0)
+			_, _, err1 = RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&none[0])), uintptr(unsafe.Pointer(&slash[0])), 0, syscall.MS_REC|syscall.MS_PRIVATE, 0, 0)
 			if err1 != 0 {
 				goto childerror
 			}
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Unshareflags")
 	}
 
 	// Chroot
 	if chroot != nil {
-			_, _, err1 = RawSyscall(SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - chroot")
 	}
 
 	// User and groups
 	if cred = sys.Credential; cred != nil {
+		/**
 		ngroups = uintptr(len(cred.Groups))
 		groups = uintptr(0)
 		if ngroups > 0 {
@@ -477,22 +539,25 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 				goto childerror
 			}
 		}
-			_, _, err1 = RawSyscall(sys_SETGID, uintptr(cred.Gid), 0, 0)
+		_, _, err1 = RawSyscall(syscall.SYS_SETUID, uintptr(cred.Gid), 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
-			_, _, err1 = RawSyscall(sys_SETUID, uintptr(cred.Uid), 0, 0)
+		_, _, err1 = RawSyscall(syscall.SYS_SETUID, uintptr(cred.Uid), 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - chroot")
 	}
 
 	if len(sys.AmbientCaps) != 0 {
 		// Ambient capabilities were added in the 4.3 kernel,
 		// so it is safe to always use _LINUX_CAPABILITY_VERSION_3.
+		/**
 		caps.hdr.version = _LINUX_CAPABILITY_VERSION_3
 
-			if _, _, err1 = RawSyscall(SYS_CAPGET, uintptr(unsafe.Pointer(&caps.hdr)), uintptr(unsafe.Pointer(&caps.data[0])), 0); err1 != 0 {
+		if _, _, err1 = RawSyscall(syscall.SYS_CAPGET, uintptr(unsafe.Pointer(&caps.hdr)), uintptr(unsafe.Pointer(&caps.data[0])), 0); err1 != 0 {
 			goto childerror
 		}
 
@@ -503,29 +568,35 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 			caps.data[capToIndex(c)].inheritable |= capToMask(c)
 		}
 
-			if _, _, err1 = RawSyscall(SYS_CAPSET, uintptr(unsafe.Pointer(&caps.hdr)), uintptr(unsafe.Pointer(&caps.data[0])), 0); err1 != 0 {
+		if _, _, err1 = RawSyscall(syscall.SYS_CAPSET, uintptr(unsafe.Pointer(&caps.hdr)), uintptr(unsafe.Pointer(&caps.data[0])), 0); err1 != 0 {
 			goto childerror
 		}
 
 		for _, c = range sys.AmbientCaps {
-				_, _, err1 = RawSyscall6(SYS_PRCTL, PR_CAP_AMBIENT, uintptr(PR_CAP_AMBIENT_RAISE), c, 0, 0, 0)
+			_, _, err1 = RawSyscall6(syscall.SYS_PRCTL, PR_CAP_AMBIENT, uintptr(PR_CAP_AMBIENT_RAISE), c, 0, 0, 0)
 			if err1 != 0 {
 				goto childerror
 			}
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - chroot")
 	}
 
 	// Chdir
 	if dir != nil {
-			_, _, err1 = RawSyscall(SYS_CHDIR, uintptr(unsafe.Pointer(dir)), 0, 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_CHDIR, uintptr(unsafe.Pointer(dir)), 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - dir")
 	}
 
 	// Parent death signal
 	if sys.Pdeathsig != 0 {
-			_, _, err1 = RawSyscall6(SYS_PRCTL, PR_SET_PDEATHSIG, uintptr(sys.Pdeathsig), 0, 0, 0, 0)
+		/**
+		_, _, err1 = RawSyscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(sys.Pdeathsig), 0, 0, 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
@@ -533,33 +604,39 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 		// Signal self if parent is already dead. This might cause a
 		// duplicate signal in rare cases, but it won't matter when
 		// using SIGKILL.
-			pid, _ = rawSyscallNoError(SYS_GETPPID, 0, 0, 0)
+		pid, _ = rawSyscallNoError(syscall.SYS_GETPPID, 0, 0, 0)
 		if pid != ppid {
-				pid, _ = rawSyscallNoError(SYS_GETPID, 0, 0, 0)
+			pid, _ = rawSyscallNoError(syscall.SYS_GETPID, 0, 0, 0)
-				_, _, err1 = RawSyscall(SYS_KILL, pid, uintptr(sys.Pdeathsig), 0)
+			_, _, err1 = RawSyscall(syscall.SYS_KILL, pid, uintptr(sys.Pdeathsig), 0)
 			if err1 != 0 {
 				goto childerror
 			}
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Pdeathsig")
 	}
 
 	// Pass 1: look for fd[i] < i and move those up above len(fd)
 	// so that pass 2 won't stomp on an fd it needs later.
 	if pipe < nextfd {
-			_, _, err1 = RawSyscall(SYS_DUP3, uintptr(pipe), uintptr(nextfd), O_CLOEXEC)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_DUP3, uintptr(pipe), uintptr(nextfd), syscall.O_CLOEXEC)
 		if err1 != 0 {
 			goto childerror
 		}
 		pipe = nextfd
 		nextfd++
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - pipe < nextfd")
 	}
+
 	for i = 0; i < len(fd); i++ {
 		if fd[i] >= 0 && fd[i] < i {
 			if nextfd == pipe { // don't stomp on pipe
 				nextfd++
 			}
-				_, _, err1 = RawSyscall(SYS_DUP3, uintptr(fd[i]), uintptr(nextfd), O_CLOEXEC)
+			if ret := os.Dup3(c.Int(fd[i]), c.Int(nextfd), syscall.O_CLOEXEC); ret < 0 {
-				if err1 != 0 {
+				err1 = Errno(os.Errno())
 				goto childerror
 			}
 			fd[i] = nextfd
@@ -570,22 +647,22 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 	// Pass 2: dup fd[i] down onto i.
 	for i = 0; i < len(fd); i++ {
 		if fd[i] == -1 {
-				RawSyscall(SYS_CLOSE, uintptr(i), 0, 0)
+			os.Close(c.Int(i))
 			continue
 		}
 		if fd[i] == i {
 			// dup2(i, i) won't clear close-on-exec flag on Linux,
 			// probably not elsewhere either.
-				_, _, err1 = RawSyscall(fcntl64Syscall, uintptr(fd[i]), F_SETFD, 0)
+			if ret := os.Fcntl(c.Int(fd[i]), syscall.F_SETFD, 0); ret < 0 {
-				if err1 != 0 {
+				err1 = Errno(os.Errno())
 				goto childerror
 			}
 			continue
 		}
 		// The new fd is created NOT close-on-exec,
 		// which is exactly what we want.
-			_, _, err1 = RawSyscall(SYS_DUP3, uintptr(fd[i]), uintptr(i), 0)
+		if ret := os.Dup3(c.Int(fd[i]), c.Int(i), 0); ret < 0 {
-			if err1 != 0 {
+			err1 = Errno(os.Errno())
 			goto childerror
 		}
 	}
@@ -594,55 +671,67 @@ func forkAndExecInChild1(argv0 *byte, argv, envv []*byte, chroot, dir *byte, att
 	// started with, so if len(fd) < 3, close 0, 1, 2 as needed.
 	// Programs that know they inherit fds >= 3 will need
 	// to set them close-on-exec.
+	/**
 	for i = len(fd); i < 3; i++ {
-			RawSyscall(SYS_CLOSE, uintptr(i), 0, 0)
+		RawSyscall(syscall.SYS_CLOSE, uintptr(i), 0, 0)
 	}
+	*/
 
 	// Detach fd 0 from tty
 	if sys.Noctty {
-			_, _, err1 = RawSyscall(SYS_IOCTL, 0, uintptr(TIOCNOTTY), 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_IOCTL, 0, uintptr(syscall.TIOCNOTTY), 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Noctty")
 	}
 
 	// Set the controlling TTY to Ctty
 	if sys.Setctty {
-			_, _, err1 = RawSyscall(SYS_IOCTL, uintptr(sys.Ctty), uintptr(TIOCSCTTY), 1)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_IOCTL, uintptr(sys.Ctty), uintptr(syscall.TIOCSCTTY), 1)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Setctty")
 	}
 
 	// Restore original rlimit.
 	if rlimOK && rlim.Cur != 0 {
-			rawSetrlimit(RLIMIT_NOFILE, &rlim)
+		os.Setrlimit(syscall.RLIMIT_NOFILE, (*syscall.Rlimit)(&rlim))
 	}
 
 	// Enable tracing if requested.
 	// Do this right before exec so that we don't unnecessarily trace the runtime
 	// setting up after the fork. See issue #21428.
 	if sys.Ptrace {
-			_, _, err1 = RawSyscall(SYS_PTRACE, uintptr(PTRACE_TRACEME), 0, 0)
+		/**
+		_, _, err1 = RawSyscall(syscall.SYS_PTRACE, uintptr(syscall.PTRACE_TRACEME), 0, 0)
 		if err1 != 0 {
 			goto childerror
 		}
+		*/
+		panic("todo: syscall.forkAndExecInChild1 - sys.Ptrace")
 	}
 
 	// Time to exec.
+	os.Execve(argv0, argv, envv)
+	/**
 	_, _, err1 = RawSyscall(SYS_EXECVE,
 		uintptr(unsafe.Pointer(argv0)),
 		uintptr(unsafe.Pointer(&argv[0])),
 		uintptr(unsafe.Pointer(&envv[0])))
-
-	childerror:
-		// send error code on pipe
-		RawSyscall(SYS_WRITE, uintptr(pipe), uintptr(unsafe.Pointer(&err1)), unsafe.Sizeof(err1))
-		for {
-			RawSyscall(SYS_EXIT, 253, 0, 0)
-		}
 	*/
-	panic("todo: syscall.forkAndExecInChild1")
+
+childerror:
+	// send error code on pipe
+	os.Write(c.Int(pipe), unsafe.Pointer(&err1), unsafe.Sizeof(err1))
+	for {
+		os.Exit(253)
+	}
 }
 
 func formatIDMappings(idMap []SysProcIDMap) []byte {