aristanetworks / bst

A one-stop shop for process isolation
MIT License
101 stars 9 forks source link

cgroup,native: ensure we start the cleaner before creating cgroup #93

Closed Snaipe closed 9 months ago

Snaipe commented 9 months ago

Some callers of bst would send it a SIGKILL as soon as the underlying operation would get canceled. The problem is that it was possible to race the cgroup initialization code of the native driver, such that the SIGKILL would be received after mkdirat of the cgroup directory, but before the cgroup cleaner has any chance at starting.

This commit fixes this issue by reordering the operations. The cgroup cleaner is now started before mkdirat, and waits on a blocked pipe read until the parent process (which is the outer helper) dies. This ensures that the cleaner is started first and foremost, and that it waits until the cgroup has been initialized by the helper.