waitpid() on the child process when changing namespaces

src/platform/minijail/env.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 // Some portions Copyright (c) 2009 The Chromium Authors.
 //
 // Default implementation of the Env interface.
 
 #include "minijail/env.h"
 
 #include <asm/unistd.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <grp.h>
 #include <pwd.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/capability.h>
 #include <sys/mount.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
 #include <base/logging.h>
 
 // prctl constants that are still missing in the headers.
 #define PR_GET_KEEPCAPS    7
 #define PR_SET_KEEPCAPS    8
 #define PR_CAPBSET_READ   23
 #define PR_CAPBSET_DROP   24
 #define PR_GET_SECUREBITS 27
@@ skipping 156 matching lines @@
   }
   DLOG(INFO) << "Entering namespaces " << namespaces;
   // TODO(wad) support namespace args
   const pid_t pid = syscall(
       __NR_clone, namespaces | CLONE_VFORK | SIGCHLD, 0, 0, 0);
   if (pid == -1) {
     PLOG(FATAL) << "Could not use PID namespacing";
     return false;
   }
   if (pid) {
+    // We want to wait on the child pid to ensure that pid-tracking code
+    // isn't completely broken.
+    int status = 0;
+    waitpid(pid, &status, 0);
     // Kill the original process without atexit handlers.
-    DLOG(INFO) << "original process death:" << pid;
-    _exit(0);
+    DLOG(INFO) << "jailed process death:" << pid;
+    if (WIFEXITED(status)) {
+      _exit(WEXITSTATUS(status));
+    }
+    if (WIFSIGNALED(status)) {
+      _exit(WTERMSIG(status));
+    }
+    DLOG(INFO) << "unknown terminal condition for child";
+    _exit(1);
   }
   DLOG(INFO) << "Success: " << getpid();
   return true;
 }
 
 bool Env::Mount() const {
   DLOG(INFO) << "Attempting to mount /proc RO.";
   if (mount("proc",
             "/proc",
             "proc",
@@ skipping 11 matching lines @@
   for (char * const* arg = argv; *arg; ++arg) {
     DLOG(INFO) << "-> " << *arg;
   }
   execve(path, argv, envp);
   PLOG(FATAL) << "failed to execute " << path;
   return false;
 }
 
 }  // namespace minijail
 }  // namespace chromeos