exec deadline containment: setsid/background children survive deadline (blocks process:exec live runs) #181

Activity

1. howlcipher commented on Oct 22, 2026

   

   howlcipher

   on Oct 22, 2026

   OwnerAuthor

   More actions

   Closing against this issue's own criterion (Owner decision E, 2026-10-22): setsid and background exec children no longer survive the deadline, fixed by #209 with a child-subreaper supervisor (Linux), before any live run grants process:exec.

   Covered by internal/vm/exec_containment_linux_test.go:

   • TestExecKillsBackgroundAndSessionEscapedDescendantsOnNormalExit
   • TestExecDeadlineKillsEveryDescendant
   • TestExecOutputLimitKillsEveryDescendant

   These were independently verified in the #209 review and run in CI.

   This is runaway-process containment only. Not covered, and tracked separately:

   • hostile code that kills its own supervisor: exec containment: hostile code that kills its own supervisor can leave detached descendants #216
   • macOS/BSD session escape and Windows descendants: exec containment on macOS/BSD and Windows: session-escaped descendants are not contained #217

   HowlFrame is not an OS sandbox and does not claim to isolate hostile code.
2. howlcipher

   closed this as completedon Oct 22, 2026