internal/outcome/shim: EOF as exit request fallback

In some cases the signal might be delivered before the signal handler is installed, and synchronising against such a case is too expensive. Instead, use the pipe being closed as a fallback to the regular exit request. This change also moves installation of the signal handler early.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/outcome/dispatcher.go

@@ -32,6 +32,8 @@ type syscallDispatcher interface {
 	// just synchronising access is not enough, as this is for test instrumentation.
 	new(f func(k syscallDispatcher, msg message.Msg))
 
+	// getppid provides [os.Getppid].
+	getppid() int
 	// getpid provides [os.Getpid].
 	getpid() int
 	// getuid provides [os.Getuid].
@@ -108,6 +110,7 @@ type direct struct{ msg message.Msg }
 
 func (k direct) new(f func(k syscallDispatcher, msg message.Msg)) { go f(k, k.msg) }
 
+func (direct) getppid() int                               { return os.Getppid() }
 func (direct) getpid() int                                { return os.Getpid() }
 func (direct) getuid() int                                { return os.Getuid() }
 func (direct) getgid() int                                { return os.Getgid() }

internal/outcome/dispatcher_test.go

@@ -331,9 +331,10 @@ func (k *kstub) new(f func(k syscallDispatcher, msg message.Msg)) {
 	k.New(func(k syscallDispatcher) { f(k, k.(*kstub)) })
 }
 
-func (k *kstub) getpid() int { k.Helper(); return k.Expects("getpid").Ret.(int) }
-func (k *kstub) getuid() int { k.Helper(); return k.Expects("getuid").Ret.(int) }
-func (k *kstub) getgid() int { k.Helper(); return k.Expects("getgid").Ret.(int) }
+func (k *kstub) getppid() int { k.Helper(); return k.Expects("getppid").Ret.(int) }
+func (k *kstub) getpid() int  { k.Helper(); return k.Expects("getpid").Ret.(int) }
+func (k *kstub) getuid() int  { k.Helper(); return k.Expects("getuid").Ret.(int) }
+func (k *kstub) getgid() int  { k.Helper(); return k.Expects("getgid").Ret.(int) }
 func (k *kstub) lookupEnv(key string) (string, bool) {
 	k.Helper()
 	expect := k.Expects("lookupEnv")

internal/outcome/main_test.go

@@ -700,9 +700,10 @@ type stubNixOS struct {
 	panicDispatcher
 }
 
-func (k *stubNixOS) getpid() int { return 0xdeadbeef }
-func (k *stubNixOS) getuid() int { return 1971 }
-func (k *stubNixOS) getgid() int { return 100 }
+func (k *stubNixOS) getppid() int { return 0xbad }
+func (k *stubNixOS) getpid() int  { return 0xdeadbeef }
+func (k *stubNixOS) getuid() int  { return 1971 }
+func (k *stubNixOS) getgid() int  { return 100 }
 
 func (k *stubNixOS) lookupEnv(key string) (string, bool) {
 	switch key {

internal/outcome/shim.go

@@ -96,11 +96,37 @@ func shimEntrypoint(k syscallDispatcher) {
 		k.fatalf("cannot set SUID_DUMP_DISABLE: %v", err)
 	}
 
+	// the Go runtime does not expose siginfo_t so SIGCONT is handled in C to check si_pid
+	ppid := k.getppid()
+	var signalPipe io.ReadCloser
+	if r, wKeepAlive, err := k.setupContSignal(ppid); err != nil {
+		switch {
+		case errors.As(err, new(*os.SyscallError)): // returned by os.Pipe
+			k.fatal(err.Error())
+			return
+
+		case errors.As(err, new(syscall.Errno)): // returned by hakurei_shim_setup_cont_signal
+			k.fatalf("cannot install SIGCONT handler: %v", err)
+			return
+
+		default: // unreachable
+			k.fatalf("cannot set up exit request: %v", err)
+			return
+		}
+	} else {
+		defer wKeepAlive()
+		signalPipe = r
+	}
+
 	var (
 		state      outcomeState
 		closeSetup func() error
 	)
 	if f, err := k.receive(shimEnv, &state, nil); err != nil {
+		if errors.Is(err, io.EOF) {
+			// fallback exit request: signal handler not yet installed
+			k.exit(hst.ExitRequest)
+		}
 		if errors.Is(err, syscall.EBADF) {
 			k.fatal("invalid config descriptor")
 		}
@@ -119,25 +145,8 @@ func shimEntrypoint(k syscallDispatcher) {
 		}
 	}
 
-	// the Go runtime does not expose siginfo_t so SIGCONT is handled in C to check si_pid
-	var signalPipe io.ReadCloser
-	if r, wKeepAlive, err := k.setupContSignal(state.Shim.PrivPID); err != nil {
-		switch {
-		case errors.As(err, new(*os.SyscallError)): // returned by os.Pipe
-			k.fatal(err.Error())
-			return
-
-		case errors.As(err, new(syscall.Errno)): // returned by hakurei_shim_setup_cont_signal
-			k.fatalf("cannot install SIGCONT handler: %v", err)
-			return
-
-		default: // unreachable
-			k.fatalf("cannot set up exit request: %v", err)
-			return
-		}
-	} else {
-		defer wKeepAlive()
-		signalPipe = r
+	if state.Shim.PrivPID != ppid {
+		k.fatalf("unexpectedly reparented from %d to %d", state.Shim.PrivPID, ppid)
 	}
 
 	// pdeath_signal delivery is checked as if the dying process called kill(2), see kernel/exit.c

internal/outcome/shim_test.go

@@ -142,30 +142,47 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, syscall.EBADF),
 			call("fatal", stub.ExpectArgs{[]any{"invalid config descriptor"}}, nil, nil),
+
+			// deferred
+			call("wKeepAlive", stub.ExpectArgs{}, nil, nil),
 		}}, nil},
 
 		{"receive env", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, container.ErrReceiveEnv),
 			call("fatal", stub.ExpectArgs{[]any{"HAKUREI_SHIM not set"}}, nil, nil),
+
+			// deferred
+			call("wKeepAlive", stub.ExpectArgs{}, nil, nil),
 		}}, nil},
 
 		{"receive strange", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, stub.UniqueError(10)),
 			call("fatalf", stub.ExpectArgs{"cannot receive shim setup params: %v", []any{stub.UniqueError(10)}}, nil, nil),
+
+			// deferred
+			call("wKeepAlive", stub.ExpectArgs{}, nil, nil),
 		}}, nil},
 
 		{"invalid state", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
 				state := templateState
 				state.Shim = newShimParams()
@@ -174,15 +191,16 @@ func TestShimEntrypoint(t *testing.T) {
 			}(), nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("fatal", stub.ExpectArgs{[]any{"impossible outcome state reached\n"}}, nil, nil),
+
+			// deferred
+			call("wKeepAlive", stub.ExpectArgs{}, nil, nil),
 		}}, nil},
 
 		{"sigaction pipe", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
-			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
-			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
-			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, &os.SyscallError{Syscall: "pipe2", Err: stub.UniqueError(9)}),
 			call("fatal", stub.ExpectArgs{[]any{"pipe2: unique error 9 injected by the test suite"}}, nil, nil),
 		}}, nil},
@@ -191,9 +209,7 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
-			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
-			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
-			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, syscall.ENOTRECOVERABLE),
 			call("fatalf", stub.ExpectArgs{"cannot install SIGCONT handler: %v", []any{syscall.ENOTRECOVERABLE}}, nil, nil),
 		}}, nil},
@@ -202,9 +218,7 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
-			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
-			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
-			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, stub.UniqueError(8)),
 			call("fatalf", stub.ExpectArgs{"cannot set up exit request: %v", []any{stub.UniqueError(8)}}, nil, nil),
 		}}, nil},
@@ -213,10 +227,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, stub.UniqueError(7)),
 			call("fatalf", stub.ExpectArgs{"cannot set parent-death signal: %v", []any{stub.UniqueError(7)}}, nil, nil),
 
@@ -228,6 +243,8 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
 				state := templateState
 				state.Shim = newShimParams()
@@ -236,7 +253,6 @@ func TestShimEntrypoint(t *testing.T) {
 			}(), nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("fatal", stub.ExpectArgs{[]any{"cannot create container state: unique error 6 injected by the test suite\n"}}, nil, nil),
 
@@ -248,6 +264,8 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
 				state := templateState
 				state.Shim = newShimParams()
@@ -256,7 +274,6 @@ func TestShimEntrypoint(t *testing.T) {
 			}(), nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("fatal", stub.ExpectArgs{[]any{"invalid container state"}}, nil, nil),
 
@@ -268,10 +285,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -291,10 +309,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -314,10 +333,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -336,10 +356,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -359,10 +380,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, stub.UniqueError(1)),
@@ -385,10 +407,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -411,10 +434,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -436,10 +460,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),
@@ -462,10 +487,11 @@ func TestShimEntrypoint(t *testing.T) {
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
 			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
+			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
 			call("swapVerbose", stub.ExpectArgs{true}, false, nil),
 			call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
-			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("prctl", stub.ExpectArgs{uintptr(syscall.PR_SET_PDEATHSIG), uintptr(syscall.SIGCONT), uintptr(0)}, nil, nil),
 			call("New", stub.ExpectArgs{}, nil, nil),
 			call("closeReceive", stub.ExpectArgs{}, nil, nil),