From a071f9d7b633e25ade39316c3c3c19a202bb4d62 Mon Sep 17 00:00:00 2001
From: Daniel Cazares <daniel.cazares@gmail.com>
Date: Sun, 22 Feb 2026 22:01:19 -0800
Subject: [PATCH] fix(bwrap): close pdeathsig parent race

Capture parent pid before PR_SET_PDEATHSIG and exit if parent changed after prctl.
---
 bubblewrap.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/bubblewrap.c b/bubblewrap.c
index 69d319b7..09b40ebe 100644
--- a/bubblewrap.c
+++ b/bubblewrap.c
@@ -383,8 +383,21 @@ usage (int ecode, FILE *out)
 static void
 handle_die_with_parent (void)
 {
-  if (opt_die_with_parent && prctl (PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0)
+  pid_t ppid;
+
+  if (!opt_die_with_parent)
+    return;
+
+  ppid = getppid ();
+  if (prctl (PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0)
     die_with_error ("prctl");
+
+  /* Close the race where our parent exits before PR_SET_PDEATHSIG takes effect. */
+  if (getppid () != ppid)
+    {
+      (void) kill (getpid (), SIGKILL);
+      _exit (1);
+    }
 }
 
 static void