DerivationBuilder: Preserve death signal across setuid,setgid

[xokdvium]

It's apparently a common footgun in Linux that the death signal isn't preserved across calls to setuid/setgid. If nix-build gets SIGKILL-ed while a build is running that would lead to a runaway build process that would get reparented to init/systemd.

This is pretty easy to reproduce with the following derivation:

derivation {
  name = "pdeathsig-repro";
  system = builtins.currentSystem;
  builder = "/bin/sh";
  args = [
    "-c"
    ''
      while :; do :; done
    ''
  ];
}

And the reproduction script:

sudo nix-build repro.nix &
sleep 3
BUILDER=$(pgrep -u nixbld1)
sudo kill -9 $(pgrep -f 'nix-build.*repro')
sleep 1
ps -p $BUILDER -o pid,ppid,user,comm

To address this we have to restore the death signal after all the calls to setuid/setgid. This is done in a helper function preserveDeathSignal that takes a callback to avoid code duplication.

See: golang/go#9686

Motivation

Context

---

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[xokdvium]

@edolstra, could you review this one, since you are the most familiar with the sandboxing setup?

[xokdvium]

I'm pretty sure that I saw this happen in a real-world scenario with some build system.

[arromanoff]

This real-world scenario happened to me and I confirm that I can no longer reproduce it with this patch. Thanks!