Module exit_dependencies 

Descriptors that would make a guest the server another guest’s exit waits for, refused while process exits complete asynchronously.

With BackendCapabilities::process_exits_complete_asynchronously, Detcore selects no turn between a process’s exit grant and its physical exit. A native exit that needs another guest to act therefore never completes. Coord rulings A and D.1 (dev-hermit ai_docs/transient/liteinst-inguest-exit-control-design-20261006.md) refuse, by name, the two descriptors that make a guest such a server:

• a FUSE or CUSE device (/dev/fuse or /dev/cuse): the exiting guest’s close of a file that guest serves sends a synchronous flush to it. Recognised by the character device’s number (misc major 10, minors 229 and 203), never by path. A plain file on a FUSE filesystem is not refused: when no guest holds the device, the server is outside the guest set.
• a seccomp user-notification listener: an exit-time system call the listener’s filter traps waits for the listener’s reply. Recognised by the descriptor’s anon inode, anon_inode:seccomp notify, never by a name. Creating one (SECCOMP_FILTER_FLAG_NEW_LISTENER) is already refused, because guests cannot install filters; an inherited filter with no guest-held listener stays allowed.

A descriptor is checked where it arrives: from an open, through SCM_RIGHTS (recvmsg, recvmmsg) or through pidfd_getfd (Detcore::refuse_exit_dependencies). The in-guest runtime checks the descriptors a process starts with (descriptor_exit_dependency on /proc/self/fd). userfaultfd is not refused (ruling D.2): the reference backend supports it, and a stuck exit is caught by the backend’s watchdog.

Detcore’s refusal names the capability and the descriptor, never a backend. The backend layer, which knows which backend runs and what to try instead, adds that through set_backend_advice.

Constants

SECCOMP_NOTIFY_LINK

What readlink reports for a seccomp user-notification listener.

Functions

descriptor_exit_dependency

What the descriptor at fd_link, a /proc/<pid>/fd/<n> entry, would make its holder serve, or None. A descriptor that cannot be read is not refused.

device_exit_dependency

What a character device numbered rdev would make its holder serve, or None.

held_exit_dependency

The first descriptor listed in fd_directory (a /proc/<pid>/fd directory) that would make its holder serve another guest’s exit: its name in the directory and what it is. The in-guest runtime checks /proc/self/fd with it before installing Detcore. A directory that cannot be listed is an error, never a pass. Listed with crate::util::find_in_directory: this runs inside the guest, where std::fs::read_dir would leave the listing in the guest’s heap.

set_backend_advice

Sets the sentence a refusal ends with: which backend refused, and what to run instead. The backend layer calls it once, before Detcore runs; a later call is ignored.