Spawn bwrap and mirror its exit status instead of exec'ing into it

tests/e2e/main.rs

@@ -7,3 +7,4 @@ mod mounts;
 mod namespaces;
 mod sandbox_info;
 mod seccomp;
+mod signals;

tests/e2e/signals.rs

@@ -0,0 +1,33 @@
+use std::os::unix::process::ExitStatusExt;
+
+use crate::common::*;
+
+#[test]
+fn exit_code_of_entrypoint_is_returned() {
+    let status = Sandbox::new(&[])
+        .args(["--", "sh", "-c", "exit 42"])
+        .status()
+        .expect("agent-sandbox binary failed to execute");
+
+    assert_eq!(status.code(), Some(42));
+}
+
+#[test]
+fn signal_death_of_entrypoint_becomes_exit_code() {
+    let status = Sandbox::new(&[])
+        .args(["--", "sh", "-c", "kill -TERM $$"])
+        .status()
+        .expect("agent-sandbox binary failed to execute");
+
+    assert_eq!(status.code(), Some(128 + libc::SIGTERM));
+}
+
+#[test]
+fn signal_death_of_bwrap_is_mirrored() {
+    let status = Sandbox::new(&["--blacklist"])
+        .args(["--", "sh", "-c", "kill -KILL $PPID; sleep 5"])
+        .status()
+        .expect("agent-sandbox binary failed to execute");
+
+    assert_eq!(status.signal(), Some(libc::SIGKILL));
+}