1.1.11 — graceful jail stop via new signal_jail verb#206
Merged
Conversation
lib/lifecycle.cpp sent SIGTERM/SIGKILL to jail processes via `jexec <jid> /bin/kill`. Under 1.0.0+ rootless those EACCES'd, the SIGTERM never landed, and every `crate stop` waited the full stopTimeout before forced destroy_jail — a 1s graceful stop became a 10s hang. New SignalJail verb wraps `jexec <jid> /bin/kill -<signal> -1`. Signal whitelisted to TERM/KILL/HUP/INT (rejects numbers, SIG-prefix, STOP). Wire taxonomy grows 28 -> 29. Both kill sites in stopCrate route through the verb when socket detected; legacy jexec preserved. Tests: signal_jail_minimal. Suite grows 1316 -> 1317. Remaining bare-shell (chroot run-hooks, zfs send) need design decisions (path-ownership enforcement, streaming transport) — tracked for 1.2.0, documented in CHANGELOG.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a
crate stopUX regression under rootless.lib/lifecycle.cppsent SIGTERM (then SIGKILL after timeout) to jail processes viajexec <jid> /bin/kill. Under 1.0.0+ rootless those EACCES'd, the SIGTERM never landed, and every stop waited the FULLstopTimeoutbefore falling through to forceddestroy_jail— turning a 1-second graceful stop into a 10-second (default) hang.New verb:
signal_jailWraps
jexec <jid> /bin/kill -<signal> -1. Signal whitelisted toTERM,KILL,HUP,INT— rejects numbers,SIG-prefix, and dangerous signals likeSTOP. Wire taxonomy grows from 28 to 29 verbs.Behaviour restored
crate stopgraceful pathRemaining bare-shell calls — flagged for 1.2.0 design pass
Two remain, both needing a design decision (not just verb-wiring):
chroot run-hooks (
lib/run.cpp:732,1752) —chroot <jailPath> /bin/sh -c <operator-cmd>. A verb here is "run arbitrary command as root in this chroot" — acceptable only if the daemon enforces<jailPath>belongs to the getpeereid uid (else alice execs into bob's jail). Needs path-ownership checking.zfs send (
lib/backup.cpp:86,lib/replicate.cpp:101) — streams a multi-GB dataset. The request/response wire protocol isn't built for streaming; needs fd-passing or a different transport.zfs snapshot(cheap half) could be a verb today but shipping it withoutzfs sendleavescrate backuphalf-rootless.Audit chain status
Tests
signal_jail_minimalcovers all 4 whitelisted signals + jid=0/STOP/number/SIG-prefix/empty rejection.dispatch_covers_every_verbextended. Suite grows from 1316 to 1317.Test plan
crate runa jail with a slow-to-exit process,crate stop— verify it exits promptly on SIGTERM instead of waiting the full timeoutGenerated by Claude Code