{"record":{"id":"9472d87aa1515475","repo":"xai-org/grok-build","slug":"process-group-setup-failed-e","errorCode":null,"errorMessage":"process group setup failed: {e}","messagePattern":"process group setup failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/auth_provider.rs","lineNumber":293,"sourceCode":"///\n/// On timeout the child's entire process group is killed. The helper is a group\n/// leader (`detach_command`'s `setsid`), so a compound `sh -c` helper's\n/// grandchildren -- and the `GROK_AUTH_PROVIDER_*` credentials in their env --\n/// do not outlive the reported timeout; `kill_on_drop` alone would reap only the\n/// direct child.\nasync fn run_capped(\n    cmd: &mut tokio::process::Command,\n    timeout: std::time::Duration,\n) -> anyhow::Result<std::process::Output> {\n    #[allow(clippy::disallowed_methods)] // killed at the timeout this call reports\n    let mut child = cmd\n        .spawn()\n        .map_err(|e| anyhow::anyhow!(\"command failed to start: {e}\"))?;\n    // Enroll the child's process group so the timeout path can tear down the\n    // whole tree. Best-effort: if enrollment fails, `kill_on_drop` still reaps\n    // the direct child.\n    let mut group = xai_grok_tools::util::ProcessGroup::new()\n        .map_err(|e| anyhow::anyhow!(\"process group setup failed: {e}\"))?;\n    if let Err(e) = group.attach(&child) {\n        tracing::debug!(error = %e, \"auth provider: could not enroll helper process group\");\n    }\n    let stdout = child.stdout.take().expect(\"stdout is piped\");\n    let stderr = child.stderr.take().expect(\"stderr is piped\");\n    let mut out_buf = Vec::new();\n    let mut err_buf = Vec::new();\n\n    // One extra stdout byte so an over-cap write is detectable, not truncated.\n    // The stderr read is advisory (it only feeds the failure log), so only\n    // stdout governs the mint.\n    let capture = async {\n        let (out_res, err_res) = tokio::join!(\n            read_capped(stdout, PROVIDER_STDOUT_CAP_BYTES + 1, &mut out_buf),\n            read_capped(stderr, PROVIDER_STDERR_CAP_BYTES, &mut err_buf),\n        );\n        if let Err(e) = err_res {\n            tracing::debug!(error = %e, \"auth provider: stderr capture failed (advisory)\");","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/auth_provider.rs#L275-L311","documentation":"After spawning the helper, run_capped creates a process group via xai_grok_tools::util::ProcessGroup::new so the timeout path can kill the whole tree. If group creation fails this error is thrown and the operation aborts.","triggerScenarios":"ProcessGroup::new failing — typically setpgid/setsid resource or permission issues, e.g. hitting the process/thread limit (RLIMIT_NPROC) or running in a restricted sandbox that forbids the syscall.","commonSituations":"Hardened containers/seccomp profiles blocking setpgid, exhausted PID limits under heavy load, or security software blocking process-group creation.","solutions":["Check system process limits (ulimit -u) and raise if exhausted","Review container/seccomp policy to allow setpgid/setrlimit syscalls","Retry after load subsides if it was a transient resource limit"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match mint_provider_token().await {\n    Err(e) if e.to_string().contains(\"process group setup failed\") => {\n        eprintln!(\"environment blocks process-group creation: {e}\");\n        // fall back to a non-grouped execution path or surface to ops\n    }\n    other => other?,\n}","preventionTips":["Verify seccomp/sandbox profiles allow setpgid/setrlimit","Monitor RLIMIT_NPROC under load","Test auth flows inside the actual container hardening config before deploy"],"tags":["process","unix","process-group"],"backgroundTag":"process-group-setup-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}