diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2020-03-12 12:31:16 -0700 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-03-12 12:32:26 -0700 |
| commit | f2e4b5ab932a3816e4957171b303db645fd04a94 (patch) | |
| tree | 85d2401478caeee9265cee3d9dfe11ed188593a8 /runsc/specutils | |
| parent | 035f7434e978f3f246ae05e9c748e8ca7d8d7fd1 (diff) | |
Kill sandbox process when parent process terminates
When the sandbox runs in attached more, e.g. runsc do, runsc run, the
sandbox lifetime is controlled by the parent process. This wasn't working
in all cases because PR_GET_PDEATHSIG doesn't propagate through execve
when the process changes uid/gid. So it was getting dropped when the
sandbox execve's to change to user nobody.
PiperOrigin-RevId: 300601247
Diffstat (limited to 'runsc/specutils')
| -rw-r--r-- | runsc/specutils/namespace.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/runsc/specutils/namespace.go b/runsc/specutils/namespace.go index c7dd3051c..60bb7b7ee 100644 --- a/runsc/specutils/namespace.go +++ b/runsc/specutils/namespace.go @@ -252,6 +252,9 @@ func MaybeRunAsRoot() error { }, Credential: &syscall.Credential{Uid: 0, Gid: 0}, GidMappingsEnableSetgroups: false, + + // Make sure child is killed when the parent terminates. + Pdeathsig: syscall.SIGKILL, } cmd.Env = os.Environ() |