fix(execd): init-mode signal forwarding + execd-init e2e coverage (OSEP-0018) - #1546
Merged
hittyt merged 5 commits intoAug 17, 2026
Merged
Conversation
In init mode, runCommand/runBackgroundCommand still subscribed forwardSignals and forwarded HUP/USR1/USR2/WINCH to the running /command process group, stacking with forwardInitSignals: an in-namespace 'kill -HUP 1' leaked the signal into the active /command and killed it. The signal subscription is now skipped when init mode is active (initModeActive); classic mode keeps today's behavior unchanged. Also extends the execd-init e2e suite (test_execd_init_e2e.py) with the Phase-1 contract gaps: application-signal forwarding to the entrypoint (which reproduces the bug above), entrypoint exit-code propagation to the runtime, in-namespace 'kill 1' interim behavior pin (OSEP-0018 R-a), fork-heavy bounded process table, and the signal_shield field on the capabilities endpoint.
The vmlinux_6_14_0*.h files are kernel BTF dumps (~353k lines) used only at bpf2go generation time; the generated bytecode is already embedded in the audit_bpf*.go bindings, so builds, tests, and the execd-ebpf variant never need them. Removed from the repo and ignored via .gitignore; audit.bpf.c documents how to regenerate (bpftool btf dump).
github-actions
Bot
added
component/execd
size/XXL
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53ca5a644a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
The kubernetes-mini-e2e changes matcher did not cover the execd init path, so the nightly workflow's Execd-Init E2E job never ran on PRs touching components/execd/ or tests/python/tests/test_execd_init_e2e.py.
lucadeg
pushed a commit
to lucadeg/OpenSandbox
that referenced
this pull request
Aug 18, 2026
…EP-0018) (opensandbox-group#1546) * fix(execd): gate command signal forwarding off in init mode (OSEP-0018) In init mode, runCommand/runBackgroundCommand still subscribed forwardSignals and forwarded HUP/USR1/USR2/WINCH to the running /command process group, stacking with forwardInitSignals: an in-namespace 'kill -HUP 1' leaked the signal into the active /command and killed it. The signal subscription is now skipped when init mode is active (initModeActive); classic mode keeps today's behavior unchanged. Also extends the execd-init e2e suite (test_execd_init_e2e.py) with the Phase-1 contract gaps: application-signal forwarding to the entrypoint (which reproduces the bug above), entrypoint exit-code propagation to the runtime, in-namespace 'kill 1' interim behavior pin (OSEP-0018 R-a), fork-heavy bounded process table, and the signal_shield field on the capabilities endpoint. * chore(execd): drop committed vmlinux BTF dump headers (OSEP-0018) The vmlinux_6_14_0*.h files are kernel BTF dumps (~353k lines) used only at bpf2go generation time; the generated bytecode is already embedded in the audit_bpf*.go bindings, so builds, tests, and the execd-ebpf variant never need them. Removed from the repo and ignored via .gitignore; audit.bpf.c documents how to regenerate (bpftool btf dump). * chore(execd): move vmlinux BTF dump ignore rule to root .gitignore * fix(execd): extract command signal subscription helper to satisfy gocognit * ci: run k8s Execd-Init E2E when execd or its e2e tests change The kubernetes-mini-e2e changes matcher did not cover the execd init path, so the nightly workflow's Execd-Init E2E job never ran on PRs touching components/execd/ or tests/python/tests/test_execd_init_e2e.py.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase-1 (OSEP-0018) e2e coverage plus one real fix the new tests exposed.
1. Bug fix: in-namespace application signals leaked into /command
In init mode,
runCommand/runBackgroundCommandstill subscribedforwardSignalsand forwarded HUP/USR1/USR2/WINCH to the running /commandprocess group, stacking with
forwardInitSignals. An in-namespacekill -HUP 1therefore leaked the signal into whatever /command was runningand killed it (
signal: hangup).Fix: skip the subscription when init mode is active (
initModeActive());signals are owned by
forwardInitSignals(forwarded to the entrypoint group,SIGTERM triggers the shutdown sequence). Classic mode unchanged.
2. execd-init e2e additions (
tests/python/tests/test_execd_init_e2e.py)test_application_signal_forwarded_to_entrypoint— HUP reaches theentrypoint (reproduces the bug above; fails on old code)
test_entrypoint_exit_code_propagates—exit 42observed on the dockerbridge status (
exited with code 42); k8s asserts state onlytest_in_namespace_sigterm_kill1_stops_sandbox— interim-behavior pin(OSEP-0018 §3, R-a): in-namespace
kill 1still stops the sandbox; commentmarks it to flip once the trusted out-of-band stop channel lands
test_fork_heavy_keeps_process_table_bounded— 20 fork-churn rounds, nozombies, bounded process count
test_hardening_reports_pid1extended to assertsignal_shield: true3. chore: drop committed vmlinux BTF dump headers (-353k lines)
vmlinux_6_14_0*.hare kernel BTF dumps needed only at bpf2go generationtime; the generated bytecode is already embedded in the
audit_bpf*.gobindings, so builds/tests/execd-ebpf never touch them. Removed, gitignored,
regeneration documented in
audit.bpf.c.Verification
go build ./...,go vet,CGO_ENABLED=1 go test -tags ebpf ./pkg/ebpf/,go test ./pkg/runtime/all greenTestMergedViewfailures inpkg/isolationare pre-existing (verified bystashing this branch's changes) and unrelated
Out of scope
tests cover
terminateInit)