path: root/netifexec.c

#include <sys/eventfd.h>
#include <sys/prctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/epoll.h>
#include <sys/signalfd.h>
#include <net/if.h>
#include <signal.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <time.h>
#include <mntent.h>
#include <errno.h>
#include <err.h>
#include <string.h>
#include <stdbool.h>
#include <stdarg.h>

#include <bpf.h>
#include <dirent.h>
#include "bpf_insn.h"

#ifndef O_DIRECTORY
# define O_DIRECTORY 0
#endif

#define WAIT_FOR_CHILDREN_TIMEOUT 500 /* [ms] */

#define CHK(funccall, ...)                                              \
	({                                                                  \
	    __auto_type __ret = (funccall);                                 \
	    if ((sizeof(__ret) == sizeof(int64_t) && (int64_t)__ret < 0) || \
	        (sizeof(__ret) == sizeof(int32_t) && (int32_t)__ret < 0) || \
	        (sizeof(__ret) == sizeof(int16_t) && (int16_t)__ret < 0) || \
	        (sizeof(__ret) == sizeof(int8_t) && (int8_t)__ret < 0))     \
	        err(1, __VA_ARGS__);                                        \
	    __ret;                                                          \
	})

#define NCHK(funccall, ...)           \
	({                                \
	    __auto_type ret = (funccall); \
	    if (!ret)                     \
	        err(1, __VA_ARGS__);      \
	    ret;                          \
	})

#define _free __attribute__((__cleanup__(freep)))
#define _fclose __attribute__((__cleanup__(fclosep)))
#define _close __attribute__((__cleanup__(closep)))

enum event_type {
	EVENT_CGROUP,
	EVENT_SIGNAL
};

static void freep(void *p)
{
	if (p)
		free(*(void **)p);
}

static void fclosep(FILE **p)
{
	if (p && *p)
		fclose(*p);
}

static void closep(int *p)
{
	if (p)
		close(*p);
}

typedef union {
	struct bpf_load_program_attr u_load_program_attr;
	char _pad[8*((7+sizeof(struct bpf_load_program_attr))/8)+256]; /* future proofing */
} bpf_load_program_attr_t;

#define pa_prog_type u_load_program_attr.prog_type
#define pa_expected_attach_type u_load_program_attr.expected_attach_type
#define pa_name u_load_program_attr.name
#define pa_insns u_load_program_attr.insns
#define pa_insns_cnt u_load_program_attr.insns_cnt
#define pa_license u_load_program_attr.license
#define pa_log_level u_load_program_attr.log_level

/**
 * Return the cgroup path for a given controller name;
 *
 * @param out The cgroup path (should be ideally of size PATH_MAX)
 * @param len The length of the cgroup path
 * @param name The cgroup to look for (use "" for the unified cgroup)
 * @return The cgroup path or NULL if not found or error (in which case errno is set)
 */
static char *my_cgroup_by_name(char *out, size_t len, const char *name)
{
	FILE *cgroups_file _fclose = NCHK(fopen("/proc/self/cgroup", "r"), "Unable to open cgroup list");
	char *line _free = NULL;
	size_t n = 0;

	errno = 0;
	while (getline(&line, &n, cgroups_file) >= 0) {
		char *firstcolon, *secondcolon;
		size_t linelen = strlen(line);

		if (linelen && line[linelen - 1] == '\n')
			line[linelen - 1] = '\0';
		if ((firstcolon = strchr(line, ':')) && (secondcolon = strchr(firstcolon + 1, ':'))) {
			*secondcolon = '\0';
			if (!strcmp(firstcolon + 1, name)) {
				if (strlen(secondcolon + 1) >= len) {
					errno = EOVERFLOW;
					return NULL;
				}
				return strcpy(out, secondcolon + 1);
			}
		}
		errno = 0;
	}
	if (errno != 0)
		err(1, "Unable to read /proc/self/cgroups");
	return NULL;
}

/**
 * Get mount path of a filesystem, which is assumed to be mounted only once.
 *
 * @param out The mount path (should be ideally of size PATH_MAX)
 * @param len The length of the mount path
 * @param fs The filesystem to look for
 * @return The mount path, or NULL in case of error
 */
static char *my_fs_mount_path(char *out, size_t len, const char *fs)
{
	FILE *mounts_file _fclose = NCHK(fopen("/proc/self/mounts", "r"), "Unable to open mounts file");
	struct mntent *mntent;

	errno = 0;
	while ((mntent = getmntent(mounts_file))) {
		if (strcmp(mntent->mnt_fsname, fs) == 0) {
			if (strlen(mntent->mnt_dir) >= len) {
				errno = EOVERFLOW;
				return NULL;
			}
			return strcpy(out, mntent->mnt_dir);
		}
		errno = 0;
	}
	if (errno != 0)
		err(1, "Unable to read mounts file");

	return NULL;
}

/**
 * Select the cgroup we will use based on the interface name.
 * For instance: /user.slice/user-1000.slice/session-3.scope/netifexec/wg0
 *
 * @param ifname The interface name to consider
 * @return The cgroup file descriptor (will close on execve)
 */
static int select_cgroup(const char *ifname)
{
	/* Get cgroup path */
	char cgroup[NAME_MAX];
	if (!my_cgroup_by_name(cgroup, sizeof(cgroup), ""))
		errx(1, "Cgroup not found");
	char cgroup_mount_path[PATH_MAX];
	if (!my_fs_mount_path(cgroup_mount_path, sizeof(cgroup_mount_path), "cgroup2"))
		errx(1, "Cgroup mount path not found");
	char cgroup_path[PATH_MAX];
	if (snprintf(cgroup_path, sizeof(cgroup_path), "%s%s", cgroup_mount_path, cgroup) >= sizeof(cgroup_path))
		errx(1, "Cgroup path too long");

	/* Check if we're already inside our special cgroup */
	char suffix[NAME_MAX + sizeof("netifexec/")];
	if (snprintf(suffix, sizeof(suffix), "netifexec/%s", ifname) >= sizeof(suffix))
		errx(1, "Interface name too long");
	char *actual_cgroup_path;
	if (strlen(suffix) < strlen(cgroup_path) &&
	    !strcmp(cgroup_path + strlen(cgroup_path) - strlen(suffix), suffix)) {
		printf("Already under cgroup\n");
		actual_cgroup_path = cgroup_path;
	} else {
		/* Create the cgroup based off of interface name */
		char new_cgroup_parent_path[PATH_MAX], new_cgroup_path[PATH_MAX];

		if (snprintf(new_cgroup_parent_path, sizeof(new_cgroup_parent_path),
		             "%s/netifexec", cgroup_path) >= sizeof(new_cgroup_parent_path))
			errx(1, "Cgroup mount path name too long");
		if (snprintf(new_cgroup_path, sizeof(new_cgroup_path), "%s/netifexec/%s",
		             cgroup_path, ifname) >= sizeof(new_cgroup_path))
			errx(1, "Interface name too long");

		/* FIXME: have root own the two cgroups so that processes can't escape easily, or use a cgroup ns */
		int ret = mkdir(new_cgroup_parent_path, 0777);
		if (ret < 0 && errno != EEXIST)
			err(1, "Unable to create parent of new cgroup: %s", new_cgroup_parent_path);
		ret = mkdir(new_cgroup_path, 0777);
		if (ret < 0 && errno != EEXIST)
			err(1, "Unable to create new cgroup");
		actual_cgroup_path = new_cgroup_path;
	}

	printf("Cgroup path: '%s'\n", actual_cgroup_path);
	return CHK(open(actual_cgroup_path, O_RDONLY | O_CLOEXEC), "Unable to open new cgroup");
}

/**
 * Retrive interface number given an interface nam.
 *
 * @param ifname The interface name
 * @return The interface number
 */
static int ifindex(const char *ifname)
{
	struct ifreq ifreq = { 0 };
	int sockfd _close = CHK(socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0), "Unable to create socket");
	strncpy(ifreq.ifr_name, ifname, sizeof(ifreq.ifr_name) - 1);
	CHK(ioctl(sockfd, SIOCGIFINDEX, &ifreq), "Unable to get interface index");
	return ifreq.ifr_ifindex;
}

/**
 * Check whether an eBPF program is already running on a given unified cgroup.
 *
 * @param cgroupfd The cgroup on which to find the eBPF program
 * @param bpf_name The expect name of the eBPF program
 * @return A boolean that tells whether the eBPF program is effective.
 */
static bool bpf_already_effective(int cgroupfd, int attach_type, const char *bpf_name)
{
	uint32_t bpf_prog_ids[1024];
	uint32_t attach_flags, prog_cnt = sizeof(bpf_prog_ids) / sizeof(*bpf_prog_ids);
	CHK(bpf_prog_query(cgroupfd, attach_type, BPF_F_QUERY_EFFECTIVE,
	                   &attach_flags, bpf_prog_ids, &prog_cnt), "Unable to query bpf programs on cgroup");
	bool has_bpf = false;
	if (prog_cnt > 0) {
		/* Cgroup already attached */
		printf("%u program(s) already attached to the cgroup\n", prog_cnt);

		for (uint32_t i = 0; i < prog_cnt; i++) {
			int bpf_fd _close = CHK(bpf_prog_get_fd_by_id(bpf_prog_ids[i]), "Unable to query bpf program %u fd", bpf_prog_ids[i]);
			struct bpf_prog_info bpf_info = {0};
			uint32_t bpf_info_len = sizeof(bpf_info);
			CHK(bpf_obj_get_info_by_fd(bpf_fd, &bpf_info, &bpf_info_len), "Unable to query bpf program %u info", bpf_prog_ids[i]);
			printf("prog_id=%u, name=%s\n", bpf_prog_ids[i], bpf_info.name);
			if (!strcmp(bpf_name, bpf_info.name)) {
				printf("Already attached to cgroup with id %u\n", bpf_prog_ids[i]);
				has_bpf = true;
			}
		}

		if (!has_bpf) {
			if (attach_flags & BPF_F_ALLOW_OVERRIDE) {
				fprintf(stderr, "WARNING: Overriding pre-existing parent bpf programs, they will not run anymore !\n");
			} else if (attach_flags & BPF_F_ALLOW_MULTI) {
				fprintf(stderr, "INFO: Pre-existing parent bpf programs will keep running.\n");
			} else {
				fprintf(stderr, "ERROR: Parent bpf program does not allow overriding !\n");
			}
		}
	}

	return has_bpf;
}

/**
 * Daemonize the processus.
 *
 * @param nb_fds The number of file descriptors to keep open
 * @param ... All the file descriptors to keep open
 */
static void daemonize(int nb_fds, ...)
{
	/* Get the list of all file descriptors to not close */
	int skip_fds[nb_fds];
	va_list va_skip_fds;
	va_start(va_skip_fds, nb_fds);
	for (int i = 0; i < nb_fds; i++) {
		skip_fds[i] = va_arg(va_skip_fds, int);
	}
	va_end(va_skip_fds);

	/* Change directory to not keep a mount point from closing */
	CHK(chdir("/"), "Unable to change directory");

	/* Reset umask to something */
	CHK(umask(0000), "Unable to change umask");

	/* Do not keep old stdin */
	int devnull = CHK(open("/dev/null", O_RDWR), "Unable to open /dev/null");
	dup2(devnull, STDIN_FILENO);
	close(devnull);

	/* Start a new session to abandon the previous controlling terminal */
	CHK(setsid(), "Unable to start a new session");

	/* Reset signal handlers and signal mask */
	sigset_t emptyset;
	sigemptyset(&emptyset);
	struct sigaction default_action = {.sa_handler = SIG_DFL, .sa_mask = emptyset, .sa_flags = SA_RESTART};
	for (int sig = 0; sig < _NSIG; sig++)
		sigaction(sig, &default_action, NULL);
	sigprocmask(SIG_SETMASK, &emptyset, NULL);

	/* Close useless file descriptors */
	int fdsfd = open("/proc/self/fd", O_DIRECTORY | O_CLOEXEC);
	DIR *fds = NCHK(fdopendir(fdsfd), "Unable to open directories of file decriptors");
	struct dirent *dirent;
	while ((dirent = readdir(fds))) {
		if (dirent->d_name[0] == '.')
			continue;
		int fd = atoi(dirent->d_name);
		if (fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO || fd == fdsfd)
			continue;
		bool needs_continue = false;
		for (int i = 0; i < nb_fds; i++)
			if (fd == skip_fds[i])
				needs_continue = true;
		if (needs_continue)
			continue;
		close(fd);
	}
	closedir(fds);
}

/**
 * Return a signalfd to poll to be notified when parent process dies.
 *
 * @param signum The signal to use as parent death signal
 * @return The signalfd to poll and read from
 */
static int parent_death_signalfd(int signum)
{
	/* Get signal when parent dies */
	CHK(prctl(PR_SET_PDEATHSIG, signum), "Unable to set parent death signal");
	/* Block SIGUSR1 signal to not get killed by it */
	sigset_t deathsig;
	sigemptyset(&deathsig);
	sigaddset(&deathsig, signum);
	sigprocmask(SIG_BLOCK, &deathsig, NULL);
	return CHK(signalfd(-1, &deathsig, SFD_CLOEXEC), "Unable to create signalfd");
}

/**
 * Move a process into a cgroup.
 *
 * @param cgroupfd The cgroup in which to move the process
 * @param pid The pid of the process to move
 */
static void move_process_to_cgroup(int cgroupfd, int pid)
{
	int procsfd _close = CHK(openat(cgroupfd, "cgroup.procs", O_RDWR | O_CLOEXEC), "Unable to open cgroup process list");
	char procrepr[32] = {0}; /* Let's say 32 digits is enough to represent a PID. */
	int pidlen = snprintf(procrepr, sizeof(procrepr),"%d\n", pid);
	CHK(write(procsfd, procrepr, pidlen), "Unable to move parent process to cgroup");
}

/**
 * Log buffer for eBPF loading errors.
 */
static char bpf_log[BPF_LOG_BUF_SIZE];

/**
 * Hook the socket() creation of the wrapped program.
 *
 * @param cgroupfd The cgroup on which to attach the BPF program
 * @param iface The interface name to force the newly created socket to use
 */
static void hook_sock_create(int cgroupfd, char *iface)
{
	char bpf_name[BPF_OBJ_NAME_LEN];
	if (snprintf(bpf_name, sizeof(bpf_name), "netifexec_%s", iface) >= sizeof(bpf_name))
		errx(1, "Interface name too long");

	if (bpf_already_effective(cgroupfd, BPF_CGROUP_INET_SOCK_CREATE, bpf_name))
		return;

	int index = ifindex(iface);

	/*
	 * 0: (b7) r2 = 1073741824
	 * 1: (63) *(u32 *)(r1 +452) = r2
	 * 2: (b7) r2 = 38
	 * 3: (63) *(u32 *)(r1 +20) = r2
	 * 4: (b7) r0 = 1
	 * 5: (95) exit
	 */

	struct bpf_insn bpf_program[] = {
			BPF_MOV64_IMM(BPF_REG_2, 0x40000000), /* use r2 as scratch */
			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2, offsetof(struct bpf_sock, mark)), /* load r2 into r1 */
			BPF_MOV64_IMM(BPF_REG_2, index), /* set bound interface */
			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2, offsetof(struct bpf_sock, bound_dev_if)),
			BPF_MOV64_IMM(BPF_REG_0, 1), /* verdict */
			BPF_EXIT_INSN()
	};

	bpf_load_program_attr_t load_program_attr;
	memset(&load_program_attr, 0, sizeof(load_program_attr));

	load_program_attr.pa_prog_type = BPF_PROG_TYPE_CGROUP_SOCK;
	load_program_attr.pa_expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE;
	load_program_attr.pa_name = bpf_name;
	load_program_attr.pa_insns = bpf_program;
	load_program_attr.pa_insns_cnt = sizeof(bpf_program) / sizeof(*bpf_program);
	load_program_attr.pa_license = "GPL";
	load_program_attr.pa_log_level = 7;

	int progfd _close = CHK(bpf_load_program_xattr((struct bpf_load_program_attr *) &load_program_attr,
	                                               bpf_log, sizeof(bpf_log)),
	                        "Unable to load bpf program: %s", bpf_log);
	CHK(bpf_prog_attach(progfd, cgroupfd, BPF_CGROUP_INET_SOCK_CREATE, BPF_F_ALLOW_MULTI),
	    "Unable to attach bpf program");
}

/**
 * Hook setsockopt() to make sure the wrapped program doesn't escape.
 *
 * @param cgroupfd The cgroup on which to attach the BPF program
 * @param iface The interface name to force the newly created socket to use
 */
static void hook_setsockopt(int cgroupfd, char *iface)
{
	char bpf_name[BPF_OBJ_NAME_LEN];
	if (snprintf(bpf_name, sizeof(bpf_name), "sopt_%s", iface) >= sizeof(bpf_name))
		errx(1, "Interface name too long");

	if (bpf_already_effective(cgroupfd, BPF_CGROUP_SETSOCKOPT, bpf_name))
		return;

	/*
     * 0: (b7) r0 = 1
     * 1: (61) r2 = *(u32 *)(r1 +24)
     * 2: (55) if r2 != 0x1 goto pc+5
     * 3: (61) r2 = *(u32 *)(r1 +28)
     * 4: (15) if r2 == 0x19 goto pc+2
     * 5: (15) if r2 == 0x24 goto pc+1
     * 6: (05) goto pc+1
     * 7: (b7) r0 = 0
     * 8: (95) exit
	 */

	struct bpf_insn bpf_program[] = {
			BPF_MOV64_IMM(BPF_REG_0, SK_PASS),
			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct bpf_sockopt, level)),
			BPF_JMP_IMM(BPF_AND, BPF_REG_2, SOL_SOCKET, 5),
			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct bpf_sockopt, optname)),
			BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, SO_BINDTODEVICE, 2),
			BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, SO_MARK, 1),
			BPF_JMP_IMM(BPF_JA, 0, 0, 1),
			BPF_MOV64_IMM(BPF_REG_0, SK_DROP),
			BPF_EXIT_INSN()
	};

	bpf_load_program_attr_t load_program_attr;
	memset(&load_program_attr, 0, sizeof(load_program_attr));

	load_program_attr.pa_prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;
	load_program_attr.pa_expected_attach_type = BPF_CGROUP_SETSOCKOPT;
	load_program_attr.pa_name = bpf_name;
	load_program_attr.pa_insns = bpf_program;
	load_program_attr.pa_insns_cnt = sizeof(bpf_program) / sizeof(*bpf_program);
	load_program_attr.pa_license = "GPL";
	load_program_attr.pa_log_level = 7;

	int progfd _close = CHK(bpf_load_program_xattr((struct bpf_load_program_attr *) &load_program_attr,
	                                               bpf_log, sizeof(bpf_log)),
	                        "Unable to load bpf program %s: %s", bpf_name, bpf_log);
	CHK(bpf_prog_attach(progfd, cgroupfd, BPF_CGROUP_SETSOCKOPT, BPF_F_ALLOW_MULTI),
	    "Unable to attach bpf program %s", bpf_name);
}

int main(int argc, char *argv[])
{
	/* FIXME: fix punctuation */

	/* XXX: When the interface goes down, we should prevent the application from makign new sockets.
	 *  Are existing sockets affected too? */

	/*
	 * XXX: Should we pin the bpf program?
	 *  - no, because we lose atomic delete
	 *  - yes, because using the name (15 characters) is lousy
	 *  Should we have only one running instance of the daemon ?
	 *  Should we use a global lock for that ?
	 *  - probably
	 */
	if (argc < 3)
		errx(1, "Usage: %s INTERFACE PROGRAM...", argv[0]);

	int cgroupfd = select_cgroup(argv[1]);

	/* Attach the sock_create hook */
	hook_sock_create(cgroupfd, argv[1]);
	hook_setsockopt(cgroupfd, argv[1]); /* FIXME: make this one facultative */

	int child_ready_evfd = CHK(eventfd(0, EFD_CLOEXEC), "Unable to create eventfd");
	uint64_t child_ready_evfd_value;
	pid_t parent = getpid();
	pid_t child = CHK(fork(), "Unable to fork");
	if (child == 0) {
		/* Become a daemon, but not too much */
		daemonize(2, child_ready_evfd, cgroupfd);

		/* FIXME: verify that this process (the control process) is not in the cgroup:
		 *  That could happen with nested invocations. */

		int epfd = CHK(epoll_create1(EPOLL_CLOEXEC), "Unable to create epoll set");
		struct epoll_event cgroup_event = {
				.events = EPOLLERR | EPOLLPRI,
				.data = {.u32 = EVENT_CGROUP}
		}, signal_event = {
				.events = EPOLLIN,
				.data = {.u32 = EVENT_SIGNAL}
		};
		int sigfd = parent_death_signalfd(SIGUSR1);
		CHK(epoll_ctl(epfd, EPOLL_CTL_ADD, sigfd, &signal_event), "Unable to wait for signals");
		int cgroup_events_fd = CHK(openat(cgroupfd, "cgroup.events", O_RDONLY | O_CLOEXEC), "Unable to open cgroup events file");
		CHK(epoll_ctl(epfd, EPOLL_CTL_ADD, cgroup_events_fd, &cgroup_event), "Unable to wait for events on cgroup");
		FILE *cgroup_events_file _fclose = fdopen(cgroup_events_fd, "r");

		/* Put parent in the cgroup */
		move_process_to_cgroup(cgroupfd, parent);

		/* Get some file descriptors for later while we know the cgroup is alive and well */
		int cgroupparentfd = CHK(openat(cgroupfd, "..", O_DIRECTORY | O_CLOEXEC), "Can't find parent of cgroup");
		int cgroupparent2fd = CHK(openat(cgroupparentfd, "..", O_DIRECTORY | O_CLOEXEC), "Can't find parent of parent of cgroup");

		/* Notify readiness to parent */
		child_ready_evfd_value = 1;
		CHK(write(child_ready_evfd, &child_ready_evfd_value, sizeof(child_ready_evfd_value)),
		    "Unable to notify readiness to parent");

		struct epoll_event events[16];
		bool cgroup_is_empty = false, parent_is_dead = false;
		int timeout = -1;
		struct timespec wait_from;
		for (;;) {
			/*
			 * XXX: When parent_is_dead but not cgroup_is_empty, child processes are lingering.
			 *    Do we kill them ? No, we can't because we don't know which ones really are our grandchildren.
			 *  .
			 *    When the cgroup is empty, all instances of netifexec will rush to delete the cgroup.
			 *  Should we only let the first netifexec instance (the one that created the bpf program) do so ?
			 *    It could fail because a new netifexec instance moved in processes into the cgroup between the
			 *  "unpopulated" notification and the deletion.
			 *    So all netifexec instances should rush to delete the cgroup, the ones that fail just exit right away,
			 *  at least one will succeed.
			 *  .
			 *    When cgroup_is_empty but not parent_is_dead, the parent process somehow moved out of the
			 *  cgroup, our job is done but something fishy happened.
			 *    We could counteract this with a cgroup namespace (sufficiently privileged programs will be able to
			 *  escape anyway).
			 *  .
			 *    We should have one leaf cgroup per invocation, otherwise one long-lasting invocation creates lots of
			 *  lingering daemons.
			 */
			int nfds = epoll_wait(epfd, events, sizeof(events) / sizeof(events[0]), timeout);
			if (nfds < 0) {
				if (errno == EINTR) {
					if (timeout != -1) {
						struct timespec cur_time;
						CHK(clock_gettime(CLOCK_MONOTONIC, &cur_time), "Unable to get time");
						long spent_time_ms = (1000 * cur_time.tv_sec + (cur_time.tv_nsec + 999999) / 1000000) -
						                     (1000 * wait_from.tv_sec + wait_from.tv_nsec / 1000000);
						if ((timeout = WAIT_FOR_CHILDREN_TIMEOUT - (int)spent_time_ms) < 0)
							timeout = 0;
					}
					continue;
				}
				err(1, "Unable to wait for events");
			} else if (nfds == 0) {
				fprintf(stderr, "The cgroup is empty, giving up on waiting on the wrapped process "
				                "death after %d ms\n", WAIT_FOR_CHILDREN_TIMEOUT);
				break;
			}
			for  (int i = 0; i < nfds; i++) {
				if (events[i].data.u32 == EVENT_CGROUP) {
					rewind(cgroup_events_file);
					char *line _free = NULL;
					size_t linesize = 0;
					for (;;) {
						errno = 0;
						ssize_t n = getline(&line, &linesize, cgroup_events_file);
						if (n < 0) {
							if (errno != 0)
								err(1, "Can't read line from cgroup events file");
							break; /* EOF */
						}
						cgroup_is_empty |= (strcmp("populated 0\n", line) == 0);
						/* We need to consume the whole file descriptor so we don't break here */
					}
					if (cgroup_is_empty)
						epoll_ctl(epfd, EPOLL_CTL_DEL, cgroup_events_fd, NULL);
				} else if (events[i].data.u32 == EVENT_SIGNAL) {
					struct signalfd_siginfo siginfo;
					CHK(read(sigfd, &siginfo, sizeof(siginfo)), "Unable to read signal info");
					parent_is_dead = (siginfo.ssi_signo == SIGUSR1);
				} else
					errx(127, "wtf");
			}
			if (cgroup_is_empty || parent_is_dead) {
				if (cgroup_is_empty && parent_is_dead)
					break;
				else if (cgroup_is_empty) {
					/* We want to wait until the parent dies for at most 500ms, then we just break */
					timeout = 500;
					CHK(clock_gettime(CLOCK_MONOTONIC, &wait_from), "Unable to get time");
				}
			}
		}

		if (!parent_is_dead)
			fprintf(stderr, "The wrapped process escaped the cgroup!!\n");

		/* The cgroup is empty at this point, let's just delete it, but remember we could be in a nested invocation. */
		/* FIXME: fix the race condition in the following code (or don't fix it, and make other code resilient) */
		CHK(unlinkat(cgroupparentfd, "wg0", AT_REMOVEDIR), "Unable to remove cgroup");
		CHK(unlinkat(cgroupparent2fd, "netifexec", AT_REMOVEDIR), "Unable to remove parent of cgroup");
	} else {
		/* Wait for readiness of child */
		CHK(read(child_ready_evfd, &child_ready_evfd_value, sizeof(child_ready_evfd_value)),
		    "Unable to wait for readiness of child");
		CHK(execvp(argv[2], argv+2), "Unable to execute %s", argv[2]);
	}
	return 0;
}