code: func systemSpecificLaunch(c context.Context, ve *venv.Env, cl *python.CommandLine, env environ.Env, dir string) error {
  	return Exec(c, ve.Interpreter(), cl, env, dir, func() error {
  		// Store our lock file descriptor as FD #3 (after #2, STDERR).
  		lockFD := ve.LockHandle.LockFile().Fd()
  		if lockFD == 3 {
  			// "dup2" doesn't change flags if the source and destination file
  			// descriptors are the same. Explicitly remove the close-on-exec flag, which
  			// Go enables by default.
  			if _, _, err := unix.Syscall(unix.SYS_FCNTL, lockFD, unix.F_SETFD, 0); err != 0 {
  				return errors.Annotate(err, "could not remove close-on-exec for lock file").Err()
  			}
  		} else {
  			// Use "dup2" to copy the file descriptor to #3 slot. This will also clear
  			// its flags, including close-on-exec.
  			if err := unix.Dup2(int(lockFD), 3); err != nil {
  				return errors.Annotate(err, "could not dup2 lock file").Err()
  			}
  		}
  		return nil
  	})
  }
docs: // systemSpecificLaunch launches the process described by "cmd" while ensuring
  // that the VirtualEnv lock is held throughout its duration (best effort).
  //
  // On Linux/Mac, we use "execve" to *become* the target process. We need to
  // continue to hold the lock for that process, though. We do this by passing it
  // as an open file handle to the subprocess.
  //
  // This can be error-prone, as it places the burden on the subprocess to
  // manage the file descriptor.