Corral is a Linux utility that runs a command with a wall-clock time limit and guarantees no descendant process remains alive when it returns. It achieves this by controlling the full process tree: in enforced mode it places the job in a delegated cgroup v2 and can atomically kill the group; in fallback mode it becomes a child subreaper, discovers orphaned processes via /proc, and signals them using pidfds. Runs end when the command itself exits (not when pipes close), and corral verifies no processes remain - if it cannot prove that, it exits with code 120. It supports limits for time, memory, number of PIDs, and combined stdout/stderr size, emits a JSON audit record, and requires Linux 5.11+ (5.14+ for enforced mode). It is explicitly not a security sandbox.
Benchmarks test ten fault programs against corral (enforced/fallback), a timeout tool, and a naive Python runner. Corral left no processes alive in any test and enforced mode enforced memory limits (e.g., stopped a 256 MiB test at 64 MiB quickly), while other runners sometimes left daemons or large numbers of children running. Measured overheads are small (single-digit ms to tens of ms). Limitations include inability to control work started outside the process tree (systemd-run, D-Bus, at), possible group escape if a process manipulates cgroupfs, fallback inability to signal setuid children, no PTY or CPU-time limits, and Linux-only operation. Licensed MIT.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A U.S. immigration advocate sued the government after a border agent searched his phone without a warrant and copied data. He believes the government targeted him due to his activism and political work on immigration rights. (arstechnica.com)
Over 44,000 legal objections have been filed against Palantir's NHS data platform, demanding it be blocked from handling medical data. The campaign follows backlash over the company's involvement with the Israeli military and US immigration enforcement. (theguardian.com)
OpenAI claims that a Chinese AI model stole its intellectual property. The company alleges that it had previously appropriated IP from other sources. (theregister.com)
Android developers face new requirements to publish apps, including a $25 verification fee and identity verification, even for small-scale projects. These policies have caused frustration among developers who want to share their apps freely without extensive registration processes. (twitter.com)
Christa Pike, the only woman on Tennessee's death row, was reportedly still alive after receiving two lethal injections. Her lawyers are seeking to halt her execution, citing that she remained conscious and had a heartbeat despite the injections. (nbcnews.com)
Sandboxing alone may not be enough to contain rogue agents, as advanced attackers can find ways to bypass these security measures. Additional cryptographic and security strategies are necessary to effectively limit malicious activities. (blog.cryptographyengineering.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.