pythongh-103911: Add exec_timeout parameter to subprocess.Popen

Add a new exec_timeout parameter to subprocess.Popen (POSIX only) that allows
setting a timeout for the child process to execute (exec() to succeed). This
addresses the issue where Popen can hang indefinitely while waiting for the
child process errpipe_read, which can happen when exec() is delayed by
ptrace tools, high-latency filesystems, or other system-level interference.

The implementation uses the selectors module with non-blocking I/O on
errpipe_read to wait for data with a timeout. If the timeout expires,
TimeoutExpired is raised and the child process is killed with SIGKILL.

https://claude.ai/code/session_01Bn3z7ZV4zehn77WPEZ9kuL

Author: claude

Lib/subprocess.py

@@ -807,6 +807,12 @@ class Popen:
       encoding and errors: Text mode encoding and error handling to use for
           file objects stdin, stdout and stderr.
 
+      exec_timeout (POSIX only): Maximum time in seconds to wait for the
+          child process to execute (i.e., for exec() to succeed). If the
+          timeout expires, TimeoutExpired is raised and the child process
+          is killed. This is useful in environments where exec() can be
+          delayed by system tools like ptrace or high-latency filesystems.
+
     Attributes:
         stdin, stdout, stderr, pid, returncode
     """
@@ -820,7 +826,7 @@ def __init__(self, args, bufsize=-1, executable=None,
                  restore_signals=True, start_new_session=False,
                  pass_fds=(), *, user=None, group=None, extra_groups=None,
                  encoding=None, errors=None, text=None, umask=-1, pipesize=-1,
-                 process_group=None):
+                 process_group=None, exec_timeout=None):
         """Create new Popen instance."""
         if not _can_fork_exec:
             raise OSError(
@@ -866,6 +872,16 @@ def __init__(self, args, bufsize=-1, executable=None,
                 raise ValueError("creationflags is only supported on Windows "
                                  "platforms")
 
+        if _mswindows and exec_timeout is not None:
+            raise ValueError("exec_timeout is not supported on Windows "
+                             "platforms")
+
+        if exec_timeout is not None:
+            if not isinstance(exec_timeout, (int, float)):
+                raise TypeError("exec_timeout must be a number or None")
+            if exec_timeout < 0:
+                raise ValueError("exec_timeout must be non-negative")
+
         self.args = args
         self.stdin = None
         self.stdout = None
@@ -1042,7 +1058,8 @@ def __init__(self, args, bufsize=-1, executable=None,
                                 errread, errwrite,
                                 restore_signals,
                                 gid, gids, uid, umask,
-                                start_new_session, process_group)
+                                start_new_session, process_group,
+                                exec_timeout)
         except:
             # Cleanup if the child failed starting.
             for f in filter(None, (self.stdin, self.stdout, self.stderr)):
@@ -1455,7 +1472,8 @@ def _execute_child(self, args, executable, preexec_fn, close_fds,
                            unused_restore_signals,
                            unused_gid, unused_gids, unused_uid,
                            unused_umask,
-                           unused_start_new_session, unused_process_group):
+                           unused_start_new_session, unused_process_group,
+                           unused_exec_timeout):
             """Execute program (MS Windows version)"""
 
             assert not pass_fds, "pass_fds not supported on Windows."
@@ -1829,7 +1847,8 @@ def _execute_child(self, args, executable, preexec_fn, close_fds,
                            errread, errwrite,
                            restore_signals,
                            gid, gids, uid, umask,
-                           start_new_session, process_group):
+                           start_new_session, process_group,
+                           exec_timeout):
             """Execute program (POSIX version)"""
 
             if isinstance(args, (str, bytes)):
@@ -1937,11 +1956,36 @@ def _execute_child(self, args, executable, preexec_fn, close_fds,
                 # Wait for exec to fail or succeed; possibly raising an
                 # exception (limited in size)
                 errpipe_data = bytearray()
-                while True:
-                    part = os.read(errpipe_read, 50000)
-                    errpipe_data += part
-                    if not part or len(errpipe_data) > 50000:
-                        break
+                if exec_timeout is not None:
+                    endtime = _time() + exec_timeout
+                    # Use non-blocking reads with select for timeout support
+                    os.set_blocking(errpipe_read, False)
+                    with _PopenSelector() as selector:
+                        selector.register(errpipe_read, selectors.EVENT_READ)
+                        while True:
+                            timeout = endtime - _time()
+                            if timeout <= 0:
+                                # Timeout expired - kill the child and raise
+                                try:
+                                    os.kill(self.pid, signal.SIGKILL)
+                                except ProcessLookupError:
+                                    pass  # Child already exited
+                                raise TimeoutExpired(self.args, exec_timeout)
+                            ready = selector.select(timeout)
+                            if ready:
+                                try:
+                                    part = os.read(errpipe_read, 50000)
+                                except BlockingIOError:
+                                    continue  # No data yet, select again
+                                errpipe_data += part
+                                if not part or len(errpipe_data) > 50000:
+                                    break
+                else:
+                    while True:
+                        part = os.read(errpipe_read, 50000)
+                        errpipe_data += part
+                        if not part or len(errpipe_data) > 50000:
+                            break
             finally:
                 # be sure the FD is closed no matter what
                 os.close(errpipe_read)

Lib/test/test_subprocess.py

@@ -3628,6 +3628,28 @@ def test_vfork_used_when_expected(self):
                 # Ensure neither vfork() or clone(..., flags=...|CLONE_VFORK|...).
                 self.assertNotRegex(non_vfork_result.event_bytes, br"(?i)vfork")
 
+    def test_exec_timeout_basic(self):
+        """Test that exec_timeout doesn't interfere with normal operation."""
+        # A generous timeout should not affect a quick command
+        p = subprocess.Popen([sys.executable, "-c", "pass"],
+                             exec_timeout=60)
+        p.wait()
+        self.assertEqual(p.returncode, 0)
+
+    def test_exec_timeout_invalid_type(self):
+        """Test that exec_timeout raises TypeError for invalid types."""
+        with self.assertRaises(TypeError) as cm:
+            subprocess.Popen([sys.executable, "-c", "pass"],
+                             exec_timeout="invalid")
+        self.assertIn("exec_timeout must be a number", str(cm.exception))
+
+    def test_exec_timeout_negative(self):
+        """Test that exec_timeout raises ValueError for negative values."""
+        with self.assertRaises(ValueError) as cm:
+            subprocess.Popen([sys.executable, "-c", "pass"],
+                             exec_timeout=-1)
+        self.assertIn("exec_timeout must be non-negative", str(cm.exception))
+
 
 @unittest.skipUnless(mswindows, "Windows specific tests")
 class Win32ProcessTestCase(BaseTestCase):
@@ -3883,6 +3905,14 @@ def test_kill_dead(self):
     def test_terminate_dead(self):
         self._kill_dead_process('terminate')
 
+    def test_exec_timeout_not_supported(self):
+        """Test that exec_timeout raises ValueError on Windows."""
+        with self.assertRaises(ValueError) as cm:
+            subprocess.Popen([sys.executable, "-c", "pass"],
+                             exec_timeout=60)
+        self.assertIn("exec_timeout is not supported on Windows",
+                      str(cm.exception))
+
 class MiscTests(unittest.TestCase):
 
     class RecordingPopen(subprocess.Popen):

Misc/NEWS.d/next/Library/2026-02-04-06-59-58.gh-issue-103911.exec_to.rst

@@ -0,0 +1,5 @@
+Add ``exec_timeout`` parameter to :class:`subprocess.Popen` (POSIX only).
+This allows setting a timeout for the child process to execute (exec() to
+succeed). If the timeout expires, :exc:`subprocess.TimeoutExpired` is raised
+and the child process is killed. This is useful in environments where exec()
+can be delayed by system tools like ptrace or high-latency filesystems.