Spawn bwrap and mirror its exit status instead of exec'ing into it

src/lib.rs

@@ -11,12 +11,15 @@ mod sandbox;
 mod sandbox_info;
 mod seccomp;
 mod session_key;
+mod signals;
 
 pub use errors::SandboxError;
+pub use signals::exit_with_status;
 
 use std::ffi::OsString;
 use std::fs;
 use std::path::PathBuf;
+use std::process::ExitStatus;
 
 use crate::sandbox::Bwrap;
 
@@ -90,15 +93,15 @@ fn resolve_run_user_from_proc() -> Option<String> {
     None
 }
 
-pub fn run(config: SandboxConfig) -> Result<(), SandboxError> {
+pub fn run(config: SandboxConfig) -> Result<ExitStatus, SandboxError> {
     preflight::check(&config)?;
 
     let bwrap = Bwrap::build(&config)?;
 
     if config.dry_run {
         println!("{}", bwrap.shell_quoted());
-        return Ok(());
+        return Ok(ExitStatus::default());
     }
 
-    Err(SandboxError::Io(bwrap.exec()))
+    Ok(bwrap.run()?)
 }

src/main.rs

@@ -17,8 +17,9 @@ fn main() {
 
     let config = config::build(args, file_config).unwrap_or_else(|e| exit_err(&e));
 
-    if let Err(e) = agent_sandbox::run(config) {
-        exit_err(&e);
+    match agent_sandbox::run(config) {
+        Ok(status) => agent_sandbox::exit_with_status(status),
+        Err(e) => exit_err(&e),
     }
 }
 

src/sandbox.rs

@@ -1,7 +1,6 @@
 use std::io;
-use std::os::unix::process::CommandExt;
 use std::path::{Path, PathBuf};
-use std::process::Command;
+use std::process::{Command, ExitStatus};
 
 use crate::agents;
 use crate::blacklist;
@@ -23,8 +22,8 @@ impl Bwrap {
         Ok(bwrap)
     }
 
-    pub fn exec(mut self) -> io::Error {
-        self.command.exec()
+    pub fn run(mut self) -> io::Result<ExitStatus> {
+        self.command.status()
     }
 
     pub fn shell_quoted(&self) -> String {

src/signals.rs

@@ -0,0 +1,23 @@
+use std::os::unix::process::ExitStatusExt;
+use std::process::{self, ExitStatus};
+
+use nix::sys::prctl;
+use nix::sys::signal::{self, SigHandler, SigSet, Signal};
+
+pub fn exit_with_status(status: ExitStatus) -> ! {
+    match status.signal() {
+        Some(number) => kill_self_with(number),
+        None => process::exit(status.code().unwrap_or(1)),
+    }
+}
+
+fn kill_self_with(number: i32) -> ! {
+    if let Ok(signal) = Signal::try_from(number) {
+        let _ = prctl::set_dumpable(false);
+        let _ = unsafe { signal::signal(signal, SigHandler::SigDfl) };
+        let _ = SigSet::from(signal).thread_unblock();
+        let _ = signal::raise(signal);
+    }
+
+    process::exit(128 + number)
+}