Ignore SIGINT in chroot #95360
Ignore SIGINT in chroot #95360
Conversation
|
Rebase on top of master or unstable, your patch isn't what's causing the mass rebuild and doesn't need to go into staging. Have you tried whether your use-case works with #94442? Result of 3 packages failed to build:- houdini - quartus-prime-lite - steam-run-native 53 packages built:- Sylk - android-studio - androidStudioPackages.beta - androidStudioPackages.canary - androidStudioPackages.dev - appimage-run - arduino-cli - bitscope.chart - bitscope.console - bitscope.display - bitscope.dso - bitscope.logic - bitscope.meter - bitscope.proto - bitscope.server - conda - deltachat-electron - devdocs-desktop - dropbox - dropbox-cli - esphome - fahclient (foldingathome) - flutter - flutterPackages.beta - flutterPackages.dev - irccloud - joplin-desktop - kodiPlugins.steam-launcher - ledger-live-desktop - lightworks - lutris - lutris-free - marktext - mate.caja-dropbox - minetime - mist - notable - obsidian - platformio - plex - plexamp - runwayml - sidequest - ssb-patchwork - standardnotes - station - steam - steam-run - steamcmd - tusk - unityhub - wootility - zulip |
ef892d9 to
0adf0c7
Compare
|
Moved to master. I thought it would have more dependencies than it did... I just did a quick test with bwrap, and it seems to have the same problem with ctrl-c. I'll set up a test and investigate a bit. |
|
Here's how I tested it:
Without this change, ctrl-c terminates chrootenv, and leaves gdb running (at least briefly). With this change, ctrl-c gets sent only to gdb, and works as expected. For bubblewrap:
ctrl-c appears to terminate both gdb and bwrap instantly. Looks like there's actually an issue about it: |
| @@ -145,6 +145,8 @@ int main(gint argc, gchar **argv) { | |||
| else { | |||
| int status; | |||
|
|
|||
| fail_if(signal(SIGINT, SIG_IGN) == SIG_ERR); | |||
There was a problem hiding this comment.
I would rather make the child the forground process like this: tcsetpgrp in the child and block SIGTTOU signal in the parent. Than all signals are only forwarded to the child.
There was a problem hiding this comment.
I played around with this a bit, but I couldn't find a way to do it that doesn't break ^Z.
There was a problem hiding this comment.
It seems to work for me, with or without this PR, under zsh.
There was a problem hiding this comment.
The issue so is that you can no longer stop chrootenv with ctrl-c, which also seems a problem.
There was a problem hiding this comment.
setpgid might be also required: https://www.gnu.org/software/libc/manual/html_node/Launching-Jobs.html
There was a problem hiding this comment.
Yeah, I needed setpgid, but I still couldn't get ^Z to work.
As for ^C, is there any reason chrootenv should deal with it? It seems like if it's just a wrapper, the child process should be responsible.
There was a problem hiding this comment.
It's not like it should deal with it. But it should be the child that receive those rather than the parent - Is this still the case? The way I read the code is that the parent is ignoring sigint and the child won't receive it.
Here is an alternative approach that is used in systemd:
systemd/systemd-stable@6f9c8af#diff-986d1d7b30d37ed34cd2d166891190eb817018b0a2e485e0b455486c56746f31R58
parent does ioctl(STDIN_FILENO, TIOCNOTTY) and child does setsid. According to the comments this seems to be cleaner? Regarding ctrl-z: from my understanding it should send SIGSTOP to the process that controls the terminal. Than waitpid would return WIFSIGNALED(status) == 1 and the wrapper would do a SIGSTOP on its own pid.
Here is how I handle that in cntr: https://github.com/Mic92/cntr/blob/b529dc67e27a3e1840afa6e65fd404c97e8b7321/src/attach/parent.rs#L39
This might be the more correct version because it also does SIGCONT after resuming.
This comment was marked as spam.
This comment was marked as spam.
0adf0c7 to
0f31237
Compare
0f31237 to
39a21b7
Compare
bc57697 to
52c170f
Compare
52c170f to
dce454c
Compare
|
I'm still carrying this patch in my local nixpkgs, so I decided to take a look at the state of things chrootenv and bwrap. The bubblewrap issue is still open: containers/bubblewrap#369, and there's been a lot of discussion in the referenced PRs. Someone on there suggested running The most promising fix seems to be: containers/bubblewrap#586. |
This allows child processes (e.g. gdb) to be use ctrl-c in a chrootenv without chrootenv being terminated.
dce454c to
dd1db5c
Compare
Motivation for this change
I was unable to break using ctrl-c in gdb when running under chrootenv.
Things done
Ignore SIGINT in chroot after the child process is started. chrootenv is waiting for the child process, which will still receive the signal.
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)