diff --git a/doc/manual/change-authors.yml b/doc/manual/change-authors.yml index f58bb1fc5..51e2a11be 100644 --- a/doc/manual/change-authors.yml +++ b/doc/manual/change-authors.yml @@ -153,6 +153,10 @@ roberth: display_name: Robert Hensing github: roberth +teofilc: + forgejo: teofilc + github: TeofilC + thufschmitt: display_name: Théophane Hufschmitt github: thufschmitt diff --git a/doc/manual/rl-next/avoid-killing-build-user.md b/doc/manual/rl-next/avoid-killing-build-user.md new file mode 100644 index 000000000..b28933a15 --- /dev/null +++ b/doc/manual/rl-next/avoid-killing-build-user.md @@ -0,0 +1,13 @@ +--- +synopsis: Avoid unnecessarily killing processes for the build user's UID +issues: [9142, fj#667] +cls: [] +category: Fixes +credits: [teofilc] +--- + +We no longer kill all processes under the build user's UID before and after +builds on Linux with sandboxes enabled. + +This avoids unrelated processes being killed. This might happen for instance, +if the user is running Lix inside a container, wherein the build users use the same UIDs as the daemon's. diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc index 5600f0d46..2c62df2db 100644 --- a/lix/libstore/platform/linux.cc +++ b/lix/libstore/platform/linux.cc @@ -1003,7 +1003,10 @@ void LinuxLocalDerivationGoal::killSandbox(bool getStats) buildResult.cpuUser = stats.cpuUser; buildResult.cpuSystem = stats.cpuSystem; } - } else { + } else if (!useChroot) { + /* Linux sandboxes use PID namespaces, which ensure that processes cannot escape from a build. + Therefore, we don't need to kill all processes belonging to the build user. + This avoids processes unrelated to the build being killed, thus avoiding: https://git.lix.systems/lix-project/lix/issues/667 */ LocalDerivationGoal::killSandbox(getStats); } }