Add fail-closed Linux process and descriptor primitives

crates/lazaret-linux/src/bin/lazaret-launch-wrapper.rs

@@ -0,0 +1,34 @@
+use std::ffi::OsString;
+use std::process::ExitCode;
+
+use lazaret_linux::process::{
+    BarrierWait, arm_parent_death_and_recheck, exec_target, parse_wrapper_arguments,
+};
+use rustix::process::Signal;
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("lazaret launch wrapper refused: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> std::io::Result<()> {
+    let arguments = std::env::args_os().skip(1).collect::<Vec<OsString>>();
+    if arguments == [OsString::from("--trace-self-test")] {
+        let (release, wait) = lazaret_linux::process::launch_barrier()?;
+        release.release()?;
+        wait.wait()?;
+        return Err(exec_target(lazaret_linux::process::TargetCommand::new(
+            "/bin/true",
+        )));
+    }
+    let (expected_parent, target) = parse_wrapper_arguments(arguments)?;
+    BarrierWait::from_stdin()?.wait()?;
+    rustix::io::fcntl_setfd(std::io::stdin(), rustix::io::FdFlags::CLOEXEC)?;
+    arm_parent_death_and_recheck(Signal::KILL, expected_parent)?;
+    Err(exec_target(target))
+}