[alvarosth]

Describe your changes

PAM helpers now die when the shell's end of a dedicated pipe closes, covering shell death and an in-place crash relaunch. Helpers reset inherited signal handlers as exec would, so a PAM module crash no longer relaunches the shell. This replaces the parent-death signal and PPID check.

Fixes #1249

Details and decisions

• A pipe handles Quickshell's crash handler relaunching in the same process, where the PPID never changes.
• Linux uses F_SETSIG with SIGKILL, which a PAM module cannot block or catch.
• The helper arms the pipe before closing its own write end. If the shell is already gone, that close fires the signal, so no race check is needed.
• FreeBSD uses a SIGIO handler because it has no F_SETSIG and ignores SIGIO by default.

Open concerns

• After a crash, the helper dies only once the coredump child finishes writing the core: up to 0.7 seconds in tests, potentially seconds with systemd-coredump.
• Signalling on the pipe's last close is kernel source behaviour, not documented behaviour.
• The FreeBSD branch has not been built on FreeBSD.

Participation

I'll follow up on review feedback.

[outfoxxed]

Crash/restart intentionally does not change PPID. Better approaches might be to

• Have some resource that triggers a signal when destroyed.
• Kill the subprocess via some kind of destruction hook in the parent.

Then just unset the signal handlers from the parent process to get rid of crash handling in the subprocess.

[alvarosth]

@outfoxxed You were right; I reproduced the GUI-thread crash case. I went with your first suggestion: a dedicated pipe whose last write end closing signals the helper. The handler reset follows exec's rules: caught signals return to default, ignored signals stay ignored. The destructor's existing kill stays.