-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 13 Oct 2026 23:14:50 +0200 Source: newpid Architecture: source Version: 15 Distribution: unstable Urgency: medium Maintainer: Christoph Berg <[email protected]> Changed-By: Christoph Berg <[email protected]> Changes: newpid (15) unstable; urgency=medium . * Start commands in their own process group (setpgid(0, 0)) so that background processes started inside cannot signal the caller's process group, e.g. an invoking shell or test harness. When no standard stream is a terminal, start a new session (setsid(2)) instead, for maximum isolation from the caller's session and host. Interactive use keeps the caller's session and terminal: the command runs in its own process group and claims the foreground terminal group when started as the terminal's foreground process, so shells inside keep full job control. Add -s to force setsid(2) even when a terminal is present. Add a regression test to make check that a kill(0, SIGTERM) issued inside the sandbox cannot reach the test harness. * newpid -N: reject namespace names containing '/', and open them with openat() relative to /var/run/netns instead of building a full path, so a name can only ever refer to a single entry inside that directory and the PATH_MAX buffer on the small clone stack is gone. * newpid: retry waitpid() on EINTR in main() and don't fall back on an uninitialized exit status when it fails. * Forward SIGHUP/SIGINT/SIGQUIT/SIGTERM received by newpid to the command (main() -> run() -> command), so aborting newpid also stops the sandbox, which now runs in its own session/process group and is otherwise unreachable by process-group kills; on a hard kill (SIGKILL) the command is notified via the parent-death signal instead. Add a check-signal regression test to make check. * debian/copyright: DEP-5. Checksums-Sha1: 2192a3b33bcb1e4787cbc1a1171036fced2f4499 1539 newpid_15.dsc d58a130ce2abdb3862c8f15d9b0d3cfc7dc92102 10696 newpid_15.tar.xz Checksums-Sha256: 78ce2a1d09cf0b02b1f1ee585efe382ead25fd54e92163f35b7fc1ad3f81220c 1539 newpid_15.dsc 3c302e39a06798326db604bf9663cbb13f5b6b7c1ebec71e8e90e4df7d3e7112 10696 newpid_15.tar.xz Files: edc686a8f6f971a72cd05b8aded1dbf5 1539 utils optional newpid_15.dsc bb7f61a0cb255ee537feb9636d84b34e 10696 utils optional newpid_15.tar.xz
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmrP4JYACgkQTFprqxLS p665EA/6Ax3TIzt7DCv040x5lkW27bQPU+EUoSnHr68JIX5bSMTJdnt73lpBAql9 Z2+LNLbUlbfy6PrnH1bEoLw12Vzu2uj3zpc4Es/stzKJC8zXgPpPFW+k/GET8DZs lgO/La1yH0XyHgFIU+o8CvALDR5Pu4LBbg4Hf09lJ8O/rlEN2Td4CLdx+Qqp2whK TitOUenAiSAE34wGqZE2MYOTwAg4T+uDYbl5rZRV5uYIREo8+fX42nEmwo26pSzH i3Hr34MnJvpCwhL0fefY7QSIDiMSj0iFuBLr4rk0VbUeg2zb09bDWojPOl9W/JyP RFNpbP7WdQxtmXfcfSsdLst1Y2MKNm8D86Z4XzyHos8FZ7xZW7l40t5y3sToRrQX jC437If5+FdjioTHY/Z7LueSrWK12N5dVjUAUuf9LDGkn3gRn6ZTq4L+I7LBOIQO Nop8EM2HHa/AjykCb874b8dgugUIjO1sQwtqTvK1N3L2cgMTCVNDj7R3rEk8rhj8 bpEuWasifhzUcDYk6deZGvFUZ1SMvXwcM8thC+/JenqWezqwh2/k6mXkDyMmB2TG ywBK8TDwaebXF0jYXg94aWhw5VXLO0YwkRkh5tgGyIqd0pliCYW+JJsoWL3Fsncq Px30N9WOLgTu3T+Chnb5MNjE9ZdarS4Eh0C1AuC3UL3z/ehBs1I= =PofR -----END PGP SIGNATURE-----
pgpue8COTogY8.pgp
Description: PGP signature
