Repository navigation
BOX exec follow-ups from T31's review (#2874): group-kill test, pidfd session kill, non-tty descendants, attached exec ids #2978
Description
Follow-ups from the maintainer's pre-merge review of T31 (#2874, BOX-150..153). None of them blocks T31.
stop_exec_ends_process_groupproves less than its name (crates/minimald/src/exec/tests.rs~3790). The script's own trap runskill -TERM 0, and the daemon side only SIGTERMs the leader throughTokioProcess::shim'sstart_kill. So the "group member gone" assertion passes even with no group signal. Make the test rely on the daemon's group kill.- PID reuse in
signal_session(crates/minimald/src/nsenter.rs~1237–1253). It reads/proc/<pid>/statand then callskill(pid). A member that exits and whose pid is recycled between the scan and the kill gets someone else's signal. Usepidfd_open, re-check the session, thenpidfd_send_signal. - Non-tty execs only get the group kill. A child of an attached or detached exec that calls
setpgidwithoutsetsidsurvives a stop. That is looser than architecture.md line 497 ("children it did not detach into their own session"). Enumerating by session isn't safe here, because these execs share the shim's session. Track the exec's descendants (a cgroup or a pid list) instead. - The gate fails open on a wrongly typed value.
stored_spec_disables_exec(exec/process.rs~1151) treatsexec_enabled: "false",0, or a non-objectioas enabled. BOX: add [io] exec_enabled to mfile's IoSpec so a box can turn exec off (BOX-153 residual of T31) #2973 makes the field a bool, so this closes with it, but the gate can fail closed now. - Attached exec ids:
- attaching says "Read its output with min://exec/output", but no transcript exists for an attached exec;
- every attached exec keeps an
EXECSentry and anexecs/dir until the box is reaped, which grows on a long-lived box.
- Test gaps:
exec_disabled_refuses_exit5leaves out tty mode, and the detached half ofpty_or_detached_exec_survives_client_lossnever drops a client. - Pre-existing:
Shell/Argvexecs get an exec id but write noexec_started/exec_exitedevents and can't be stopped. - Detached exec descendants get SIGPIPE after the 1 s drain and
pump.abort()(exec/process.rs~1346). This trade-off is accepted, but architecture.md says "a setsid'd process survives the exec", so note it there.
Activity
mitodrummer commentedon Nov 4, 2026
isatty(stdin)(nsenter.rs~815). Any caller that starts the shim with a terminal on stdin gets setsid,TIOCSCTTYand the session-wide kill. Pass an explicit shim argument instead (from minimal-review on T31 — Keep terminal and detached execs past a client loss, stop one exec, and honour exec_enabled #2874).