GNU bug report logs - #54997
[PATCH 00/12] Add "least authority" program wrapper

Previous Next

Full log

Message #161 received at 54997 <at> debbugs.gnu.org (full text, mbox):

From: Thiago Jung Bauermann <bauermann <at> kolabnow.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 54997 <at> debbugs.gnu.org
Subject: Re: bug#54997: [PATCH 00/12] Add "least authority" program wrapper
Date: Fri, 29 Apr 2022 00:43:59 -0300

Hi Ludo!

Ludovic Courtès <ludo <at> gnu.org> writes:
> Thiago Jung Bauermann <bauermann <at> kolabnow.com> skribis:
>> So to avoid an accumulation of zombie processes and other signal-related
>> problems, I suggest adding a “(init-program ,tini)” parameter to
>> ‘least-authority-wrapper’ and executing ‘program’ as a subprocess of
>> ‘tini’ or whatever was passed as the #:init-program (perhaps #f could
>> mean running ‘program’ directly as PID 1).
>
> Hmm yes.  It’s not great that the choice is between ‘unshare’—efficient
> but the process lives in the parent PID namespace—and ‘clone’—but then
> you have to fork twice.

Yeah, the signals part of the Unix design isn't great.

> But yeah, you’re right.  I’ll try what you suggest and send a v2.

Thank you for making these changes! I had a look at v2 and it looks
great.

>> I mention this because I'm currently dealing with a problem that has
>> exactly this root cause: I'm working on updating the public-inbox
>> package to the latest version, and the testsuite is failing because it
>> tests that lei's daemon process is correctly terminated. But that
>> doesn't work because “guix build” doesn't use a proper init program as
>> PID 1 and thus the daemon process goes to zombie state and the testsuite
>> thinks that it didn't go away. I'm hoping to send a patch to fix that
>> issue.
>
> Now that you mention it, this was discussed before:
>
>   https://issues.guix.gnu.org/30948
>
> I think we should do something about it in gnu-build-system.scm.

Nice! Thank you for the link. The discussion there was very informative.
I'll try to implement your idea of adding a new build phase to install
the appropriate signal handlers. Probably even steal your child reaping
code from the v2 patches.

> Thanks for your feedback!

Thank you for taking it into account!

-- 
Thanks
Thiago

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.