Merge "Avoid lix daemon killing unrelated processes when using sandboxes under Linux" into main

doc/manual/change-authors.yml

@@ -153,6 +153,10 @@ roberth:
   display_name: Robert Hensing
   github: roberth
 
+teofilc:
+  forgejo: teofilc
+  github: TeofilC
+
 thufschmitt:
   display_name: Théophane Hufschmitt
   github: thufschmitt

doc/manual/rl-next/avoid-killing-build-user.md

@@ -0,0 +1,13 @@
+---
+synopsis: Avoid unnecessarily killing processes for the build user's UID
+issues: [9142, fj#667]
+cls: []
+category: Fixes
+credits: [teofilc]
+---
+
+We no longer kill all processes under the build user's UID before and after
+builds on Linux with sandboxes enabled.
+
+This avoids unrelated processes being killed. This might happen for instance,
+if the user is running Lix inside a container, wherein the build users use the same UIDs as the daemon's.

lix/libstore/platform/linux.cc

@@ -1003,7 +1003,10 @@ void LinuxLocalDerivationGoal::killSandbox(bool getStats)
             buildResult.cpuUser = stats.cpuUser;
             buildResult.cpuSystem = stats.cpuSystem;
         }
-    } else {
+    } else if (!useChroot) {
+        /* Linux sandboxes use PID namespaces, which ensure that processes cannot escape from a build.
+           Therefore, we don't need to kill all processes belonging to the build user.
+           This avoids processes unrelated to the build being killed, thus avoiding: https://git.lix.systems/lix-project/lix/issues/667 */
         LocalDerivationGoal::killSandbox(getStats);
     }
 }