std::process::Command is a bad citizen on Windows

Say you’re writing a Windows IPC library for Rust, and you want to pass a handle to a child process. Maybe it’s a pipe, maybe it’s a file, maybe it’s a broker process handle. It turns out that there’s no correct way to do so due to Rust’s idiosyncrasies.

WinAPI trivia time! The CreateProcess function, which is used to spawn a process, takes two parameters that determine which handles are inherited by the child process. The possible combinations are:

1. bInheritHandles = FALSE: no handles are inherited, except for stdio.
2. bInheritHandles = TRUE and PROC_THREAD_ATTRIBUTE_HANDLE_LIST is absent: all handles with the “inheritable” flag set are inherited.
3. bInheritHandles = TRUE and PROC_THREAD_ATTRIBUTE_HANDLE_LIST is present: all handles with the “inheritable” flag set that are listed in the handle list attribute are inherited.

As long as every call to CreateProcess in your program follows (1) or (3), everything is fine: handles are allow-listed and no handle can be inherited by accident.