wait up to 10 seconds for sandbox shutdown

3 files changed, 81 insertions, 29 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index c183a7675..bdf960b96 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -132,8 +132,10 @@ static void myexit(int rv) {
 
 static void my_handler(int s){
         EUID_ROOT();
-        if (!arg_quiet)
+        if (!arg_quiet) {
                 printf("\nParent received signal %d, shutting down the child process...\n", s);
+                fflush(0);
+        }
         logsignal(s);
         kill(child, SIGTERM);
         myexit(1);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 4a4956687..3f3564295 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -34,17 +34,45 @@
 #define CLONE_NEWUSER   0x10000000
 #endif
 
-static monitored_pid = 0;
-static void sandbox_handler(int s){
-        if (!arg_quiet)
-                printf("\nChild received signal %d, shutting down the sandbox...\n", s);
+static int monitored_pid = 0;
+static void sandbox_handler(int sig){
+        if (!arg_quiet) {
+                printf("\nChild received signal %d, shutting down the sandbox...\n", sig);
+                fflush(0);
+        }
+
+        // broadcast sigterm to all processes in the group
+        kill(-1, SIGTERM);
+        sleep(1);
+
         if (monitored_pid) {
-                kill(monitored_pid, SIGTERM);
-                sleep(1);
-                kill(monitored_pid, SIGKILL);
+                int monsec = 9;
+                char *monfile;
+                if (asprintf(&monfile, "/proc/%d/cmdline", monitored_pid) == -1)
+                        errExit("asprintf");
+                while (monsec) {
+                        FILE *fp = fopen(monfile, "r");
+                        if (!fp)
+                                break;
+                                
+                        char c;
+                        size_t count = fread(&c, 1, 1, fp);
+                        fclose(fp);
+                        if (count == 0)
+                                break;
+
+                        if (arg_debug)
+                                printf("Waiting on PID %d to finish\n", monitored_pid);
+                        sleep(1);
+                        monsec--;
+                }
+                free(monfile);
+                
         }
-        
-        exit(s);
+
+        // broadcast a SIGKILL
+        kill(-1, SIGKILL);
+        exit(sig);
 }
 
 
@@ -149,13 +177,15 @@ static int monitor_application(pid_t app_pid) {
         signal (SIGTERM, sandbox_handler);
         EUID_USER();
 
-        int status;
+        int status = 0;
         while (monitored_pid) {
                 usleep(20000);
                 char *msg;
                 if (asprintf(&msg, "monitoring pid %d\n", monitored_pid) == -1)
                         errExit("asprintf");
                 logmsg(msg);
+                if (arg_debug)
+                        printf("%s\n", msg);
                 free(msg);
 
                 pid_t rv;
diff --git a/src/firejail/shutdown.c b/src/firejail/shutdown.c
index 94ca0a816..8d8035bfb 100644
--- a/src/firejail/shutdown.c
+++ b/src/firejail/shutdown.c
@@ -77,26 +77,46 @@ void shut(pid_t pid) {
         EUID_ROOT();
         printf("Sending SIGTERM to %u\n", pid);
         kill(pid, SIGTERM);
-        sleep(2);
         
-        // if the process is still running, terminate it using SIGKILL
-        // try to open stat file
-        char *file;
-        if (asprintf(&file, "/proc/%u/status", pid) == -1) {
-                perror("asprintf");
-                exit(1);
+        // wait for not more than 10 seconds
+        sleep(2);
+        int monsec = 8;
+        char *monfile;
+        if (asprintf(&monfile, "/proc/%d/cmdline", pid) == -1)
+                errExit("asprintf");
+        int killdone = 0;
+
+        while (monsec) {
+                FILE *fp = fopen(monfile, "r");
+                if (!fp) {
+                        killdone = 1;
+                        break;
+                }
+                
+                char c;
+                size_t count = fread(&c, 1, 1, fp);
+                fclose(fp);
+                if (count == 0) {
+                        // all done
+                        killdone = 1;
+                        break;
+                }
+
+                sleep(1);
+                monsec--;
         }
-        FILE *fp = fopen(file, "r");
-        if (!fp)
-                return;
-        fclose(fp);
-        
-        // kill the process and also the parent
-        printf("Sending SIGKILL to %u\n", pid);
-        kill(pid, SIGKILL);
-        if (parent != pid) {
-                printf("Sending SIGKILL to %u\n", parent);
-                kill(parent, SIGKILL);
+        free(monfile);
+
+
+        // force SIGKILL
+        if (!killdone) {
+                // kill the process and also the parent
+                printf("Sending SIGKILL to %u\n", pid);
+                kill(pid, SIGKILL);
+                if (parent != pid) {
+                        printf("Sending SIGKILL to %u\n", parent);
+                        kill(parent, SIGKILL);
+                }
         }
         
         clear_run_files(parent);