4c253ed1ca
This adds a new safe_fork() wrapper around fork() and makes use of it everywhere. The new wrapper does a couple of things we previously did manually and separately in a safer, more correct and automatic way: 1. Optionally resets signal handlers/mask in the child 2. Sets a name on all processes we fork off right after forking off (and the patch assigns useful names for all processes we fork off now, following a systematic naming scheme: always enclosed in () – in order to indicate that these are not proper, exec()ed processes, but only forked off children, and if the process is long-running with only our own code, without execve()'ing something else, it gets am "sd-" prefix.) 3. Optionally closes all file descriptors in the child 4. Optionally sets a PR_SET_DEATHSIG to SIGTERM in the child, in a safe way so that the parent dying before this happens being handled safely. 5. Optionally reopens the logs 6. Optionally connects stdin/stdout/stderr to /dev/null 7. Debug logs about the forked off processes. |
||
---|---|---|
.. | ||
meson.build | ||
nspawn-cgroup.c | ||
nspawn-cgroup.h | ||
nspawn-def.h | ||
nspawn-expose-ports.c | ||
nspawn-expose-ports.h | ||
nspawn-gperf.gperf | ||
nspawn-mount.c | ||
nspawn-mount.h | ||
nspawn-network.c | ||
nspawn-network.h | ||
nspawn-patch-uid.c | ||
nspawn-patch-uid.h | ||
nspawn-register.c | ||
nspawn-register.h | ||
nspawn-seccomp.c | ||
nspawn-seccomp.h | ||
nspawn-settings.c | ||
nspawn-settings.h | ||
nspawn-setuid.c | ||
nspawn-setuid.h | ||
nspawn-stub-pid1.c | ||
nspawn-stub-pid1.h | ||
nspawn.c | ||
test-patch-uid.c |