Repeat the process tree walk and spare processes started by signal handlers

src/preflight.rs

@@ -1,13 +1,17 @@
 use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
 use std::process::Command;
 
 use crate::SandboxConfig;
 use crate::errors::SandboxError;
 
+const PROC_CHILDREN: &str = "/proc/thread-self/children";
+
 pub fn check(config: &SandboxConfig) -> Result<(), SandboxError> {
     check_bwrap()?;
     check_command(config)?;
     check_chdir(config)?;
+    check_proc_children(Path::new(PROC_CHILDREN))?;
     Ok(())
 }
 
@@ -36,3 +40,14 @@ fn check_command(config: &SandboxConfig) -> Result<(), SandboxError> {
     }
     Ok(())
 }
+
+fn check_proc_children(path: &Path) -> Result<(), SandboxError> {
+    if !path.exists() {
+        return Err(SandboxError::ProcChildrenMissing);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "../tests/unit/preflight.rs"]
+mod tests;