Use unshare() instead of clone()
Use unshare() instead of clone()

It turns out that using clone() to start a child process is unsafe in
a multithreaded program. It can cause the initialisation of a build
child process to hang in setgroups(), as seen several times in the
build farm:

The reason is that Glibc thinks that the other threads of the parent
exist in the child, so in setxid_mark_thread() it tries to get a futex
that has been acquired by another thread just before the clone(). With
fork(), Glibc runs pthread_atfork() handlers that take care of this
(in particular, __reclaim_stacks()). But clone() doesn't do that.

Fortunately, we can use fork()+unshare() instead of clone() to set up
private namespaces.

See also https://www.mail-archive.com/lxc-devel@lists.linuxcontainers.org/msg03434.html.

ehmry/nix,ttuegel/nix,rowhit/nix,NixOS/nix,dtzWill/nix,gridaphobe/nix,layus/nix,dezgeg/nix,dtzWill/nix,NixOS/nix,vcunat/nix,zimbatm/nix,dtzWill/nix,rowhit/nix,nbp/nix,nbp/nix,tchajed/nix,bjornfor/nix,garbas/nix,dezgeg/nix,ehmry/nix,joelmo/nix,rycee/nix,ysangkok/nix,layus/nix,pikajude/nix,pikajude/nix,bjornfor/nix,vcunat/nix,bennofs/nix,zimbatm/nix,puffnfresh/nix,vizanto/nix,bennofs/nix,acowley/nix,zimbatm/nix,bjornfor/nix,tchajed/nix,gridaphobe/nix,peti/nix,peti/nix,offlinehacker/nix,wmertens/nix,layus/nix,ttuegel/nix,acowley/nix,tchajed/nix,garbas/nix,jcumming/nix,garbas/nix,bjornfor/nix,joelmo/nix,jcumming/nix,rycee/nix,ysangkok/nix,rycee/nix,shlevy/nix,bennofs/nix,jcumming/nix,peti/nix,pikajude/nix,ttuegel/nix,garbas/nix,peti/nix,rowhit/nix,rycee/nix,offlinehacker/nix,ysangkok/nix,offlinehacker/nix,joelmo/nix,puffnfresh/nix,ehmry/nix,jcumming/nix,vizanto/nix,wmertens/nix,offlinehacker/nix,vcunat/nix,shlevy/nix,acowley/nix,wmertens/nix,NixOS/nix,aucampia/nix,nbp/nix,shlevy/nix,peti/nix,dezgeg/nix,acowley/nix,gebner/nix,dezgeg/nix,gridaphobe/nix,bennofs/nix,zimbatm/nix,joelmo/nix,ehmry/nix,dtzWill/nix,gridaphobe/nix,wmertens/nix,dtzWill/nix,ehmry/nix,aucampia/nix,rycee/nix,gebner/nix,aucampia/nix,layus/nix,puffnfresh/nix,vizanto/nix,gebner/nix,NixOS/nix,vcunat/nix,gebner/nix,shlevy/nix,garbas/nix,vizanto/nix,ehmry/nix,tchajed/nix,aucampia/nix,layus/nix,puffnfresh/nix,nbp/nix,NixOS/nix,rowhit/nix,dezgeg/nix,ttuegel/nix,shlevy/nix