Terminate leftover child processes of the entrypoint after bwrap exits

src/lib.rs

@@ -7,6 +7,7 @@ mod errors;
 mod memfd;
 mod persistent_tmp;
 mod preflight;
+mod process_tree;
 mod sandbox;
 mod sandbox_info;
 mod seccomp;
@@ -20,9 +21,12 @@ use std::ffi::OsString;
 use std::fs;
 use std::path::PathBuf;
 use std::process::ExitStatus;
+use std::time::Duration;
 
 use crate::sandbox::Bwrap;
 
+const CLEANUP_GRACE_PERIOD: Duration = Duration::from_secs(5);
+
 pub enum SandboxMode {
     Blacklist,
     Whitelist,
@@ -103,5 +107,8 @@ pub fn run(config: SandboxConfig) -> Result<ExitStatus, SandboxError> {
         return Ok(ExitStatus::default());
     }
 
-    Ok(bwrap.run()?)
+    process_tree::become_subreaper()?;
+    let status = bwrap.run()?;
+    process_tree::terminate_and_reap_all(CLEANUP_GRACE_PERIOD)?;
+    Ok(status)
 }