deterministic-shutdown option

[smitsohu]

Sometimes sandboxed apps are outlived by their child processes which prevents the sandbox from shutting down.

Add a new option to deal with this situation.

Probably there are better names for the option, I just needed a placeholder. kill-remains was suggested by @msva.

Tracked in #4440
Closes #928
Closes #3042

[rusty-snake]

Voting against noorphans because the no prefix suggests that it is an hardening option. Maybe deterministic-shutdown? Does it terminate/kill child-child processes or does it exit will the child-child processes are still running?

---

Reminder:

If you add a new command, here's the checklist:

• Update manpages: firejail(1) and firejail-profile(5)
• Update shell completions
• Update vim syntax files
• Update --help

[smitsohu]

It forcefully shuts down the sandbox if the oldest child in the sandbox dies. Or in other words, it forcefully shuts down the sandbox if the first program, the one that was started by Firejail, dies.

The sandbox is shut down even if another process has joined the sandbox, which is a bit of an inconsistency but difficult to avoid.

Reminder:

Will do, but it will take a while, I'm very slow on these things.

[smitsohu]

The sandbox is shut down even if another process has joined the sandbox, which is a bit of an inconsistency but difficult to avoid.

Now that I'm writing this down it dawns on me that this is not playing nice with join-or-start.

[smitsohu]

Now that I'm writing this down it dawns on me that this is not playing nice with join-or-start.

On the other hand nothing bad will happen. Maybe there is even a use case for
"join-or-start into one sandbox, but kill everything if first app dies"
so documenting should be enough.

[smitsohu]

I guess I like deterministic-shutdown.

It is less violent than everything I came up with (kill-children, drop-orphans, ...)

[kmk3]

@smitsohu commented on Oct 26:

I guess I like deterministic-shutdown.

It is less violent than everything I came up with (kill-children,
drop-orphans, ...)

A few that had come to mind were kill-all-<x> and kill-<x>-on-exit, though
they don't sound very nice either.

drop-orphans takes the cake though; I can only imagine it being used out of
context:

Firejail is not closing for some reason.

Did you remember to drop-orphans?

[smitsohu]

Ok, I added a stub to the man pages. I still need to think about if or how to expand it.

resolved

[netblue30]

all in!

[KOLANICH]

Thanks for implementing it.