fix parent death signal

turns out the parent death signal is reset every time the effective uid
changes, hence moving the prctl call to the earliest place where the setting
is persistent.

2 files changed, 4 insertions, 7 deletions

diff --git a/src/firejail/join.c b/src/firejail/join.c
index 9cc4cd75d..4259644f7 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -365,8 +365,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
                                 printf("changing root to %s\n", rootdir);
                 }
 
-                prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
-
                 EUID_USER();
                 if (chdir("/") < 0)
                         errExit("chdir");
@@ -460,6 +458,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 }
 
                 drop_privs(arg_nogroups);
+                prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
                 start_application(0, NULL);
 
                 // it will never get here!!!
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 6a9977455..475779f47 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -984,8 +984,6 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // set application environment
         //****************************
-        prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
-
         EUID_USER();
         int cwd = 0;
         if (cfg.cwd) {
@@ -1153,6 +1151,7 @@ int sandbox(void* sandbox_arg) {
         // drop privileges, fork the application and monitor it
         //****************************************
         drop_privs(arg_nogroups);
+        prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
         pid_t app_pid = fork();
         if (app_pid == -1)
                 errExit("fork");
@@ -1172,9 +1171,8 @@ int sandbox(void* sandbox_arg) {
 #endif
                 // set rlimits
                 set_rlimits();
-
-                prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); // kill the child in case the parent died
-                start_application(0, fp);       // start app
+                // start app
+                start_application(0, fp);
         }
 
         fclose(fp);