Add a flag to control kill timeout duration.

PiperOrigin-RevId: 794667661
Change-Id: Ib0dce56783109bd587ca452e36d14a0dcb14b9a8

Author: Sandboxed API Team

sandboxed_api/sandbox2/flags.cc

@@ -45,6 +45,10 @@ ABSL_FLAG(absl::Duration, sandbox2_stack_traces_collection_timeout,
           "How much time should be spent on logging threads' stack traces on "
           "monitor shut down. Only relevent when collection of all stack "
           "traces is enabled.");
+ABSL_FLAG(absl::Duration, sandbox2_monitor_ptrace_graceful_kill_timeout,
+          absl::Seconds(1),
+          "Timeout after SIGKILL is sent to the sandboxee until the monitor "
+          "stops and the sandboxee is terminated via PTRACE_O_EXITKILL");
 
 // sandbox2:policy
 ABSL_FLAG(bool, sandbox2_danger_danger_permit_all, false,

sandboxed_api/sandbox2/flags.h

@@ -70,6 +70,8 @@ ABSL_DECLARE_FLAG(bool, sandbox2_log_all_stack_traces);
 ABSL_DECLARE_FLAG(bool, sandbox2_monitor_ptrace_use_deadline_manager);
 ABSL_DECLARE_FLAG(bool, sandbox2_log_unobtainable_stack_traces_errors);
 ABSL_DECLARE_FLAG(absl::Duration, sandbox2_stack_traces_collection_timeout);
+ABSL_DECLARE_FLAG(absl::Duration,
+                  sandbox2_monitor_ptrace_graceful_kill_timeout);
 
 // sandbox2:global_forkserver
 ABSL_DECLARE_FLAG(std::string, sandbox2_forkserver_binary_path);

sandboxed_api/sandbox2/monitor_ptrace.cc

@@ -159,9 +159,10 @@ bool PtraceMonitor::KillSandboxee() {
     SetExitStatusCode(Result::INTERNAL_ERROR, Result::FAILED_KILL);
     return false;
   }
-  constexpr absl::Duration kGracefullKillTimeout = absl::Milliseconds(1000);
   if (hard_deadline_ == absl::InfiniteFuture()) {
-    hard_deadline_ = absl::Now() + kGracefullKillTimeout;
+    hard_deadline_ =
+        absl::Now() +
+        absl::GetFlag(FLAGS_sandbox2_monitor_ptrace_graceful_kill_timeout);
   }
   return true;
 }