--die-with-parent fails to clean up due to a race condition if the parent bwrap process is killed soon after startup

[artli]

$ cat bwrap_race.sh
echo "BASHPID=$BASHPID"
bwrap --die-with-parent --dev-bind / / --unshare-pid -- sleep 1234 &
BWRAP_PARENT=$!
echo "BWRAP_PARENT=$BWRAP_PARENT"
BWRAP_CHILD=$(ps axo ppid,pid | grep -P "^$BWRAP_PARENT " | awk '{print $2}')
echo "BWRAP_CHILD=$BWRAP_CHILD"
kill $BWRAP_PARENT
while kill -0 $BWRAP_CHILD; do sleep 0.5; done
$ ./bwrap_race.sh 
BASHPID=3552608
BWRAP_PARENT=3552609
BWRAP_CHILD=3552613
./bwrap_race.sh: line 8: 3552609 Terminated              bwrap --die-with-parent --dev-bind / / --unshare-pid -- sleep 1234
<hangs while waiting for BWRAP_CHILD to exit>

I.e. if the parent bwrap process is killed soon after startup, the child bwrap process stops being able to clean up properly. This is probably because the setting of PR_SET_PDEATHSIG in the child doesn't happen immediately and when it does happen, the original parent is already dead, so PR_SET_PDEATHSIG becomes attached to PID 1. (Note: the script above depends on timing and might need to be run in a loop and/or a carefully placed sleep to show this result.)

In a different terminal:

$ ps axo pid,ppid,pgid,cmd | grep 3552608
3552608 3371626 3552608 -bash
3552613       1 3552608 bwrap --die-with-parent --dev-bind / / --unshare-pid -- sleep 1234
3552615 3552613 3552608 sleep 1234
3554357 3552608 3552608 sleep 0.5
3554359 3373029 3554358 grep --color=auto 3552608
$ kill -9 3552608
$ ps axo pid,ppid,pgid,cmd | grep 3552608
3552613       1 3552608 bwrap --die-with-parent --dev-bind / / --unshare-pid -- sleep 1234
3552615 3552613 3552608 sleep 1234
3554915 3373029 3554914 grep --color=auto 3552608
$ kill -9 3552613
$ ps axo pid,ppid,pgid,cmd | grep 3552608
3555757 3373029 3555756 grep --color=auto 3552608
$

See also https://stackoverflow.com/questions/42496478/prctlpr-set-pdeathsig-race-condition for a discussion of this race condition and possible mitigations.