int set_sandbox_run_file(pid_t pid, pid_t child) {
	char *runfile;
	if (asprintf(&runfile, "%s/%d", RUN_FIREJAIL_SANDBOX_DIR, pid) == -1)
		errExit("asprintf");

	EUID_ROOT();
	// the file is deleted first
	// this file should be opened with O_CLOEXEC set
	int fd = open(runfile, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR);
	if (fd < 0) {
		fprintf(stderr, "Error: cannot create %s\n", runfile);
		exit(1);
	}
	free(runfile);
	EUID_USER();

	char buf[64];
	snprintf(buf, sizeof(buf), "%d\n", child);
	size_t len = strlen(buf);
	size_t done = 0;
	while (done != len) {
		ssize_t rv = write(fd, buf + done, len - done);
		if (rv < 0)
			errExit("write");
		done += rv;
	}

	// set exclusive lock on the file
	// the lock is never inherited, and is released if this process dies ungracefully
	struct flock sandboxlock = {
		.l_type = F_WRLCK,
		.l_whence = SEEK_SET,
		.l_start = 0,
		.l_len = 0,
	};
	if (fcntl(fd, F_SETLK, &sandboxlock) < 0)
		errExit("fcntl");

	return fd;
}
int set_sandbox_run_file(pid_t pid, pid_t child) {
	char *runfile;
	if (asprintf(&runfile, "%s/%d", RUN_FIREJAIL_SANDBOX_DIR, pid) == -1)
		errExit("asprintf");

	EUID_ROOT();
	 
	 
	int fd = open(runfile, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR);
	if (fd < 0) {
		fprintf(stderr, "Error: cannot create %s\n", runfile);
		exit(1);
	}
	free(runfile);
	EUID_USER();

	char buf[64];
	snprintf(buf, sizeof(buf), "%d\n", child);
	size_t len = strlen(buf);
	size_t done = 0;
	while (done != len) {
		ssize_t rv = write(fd, buf + done, len - done);
		if (rv < 0)
			errExit("write");
		done += rv;
	}

	 
	 
	struct flock sandboxlock = {
		.l_type = F_WRLCK,
		.l_whence = SEEK_SET,
		.l_start = 0,
		.l_len = 0,
	};
	if (fcntl(fd, F_SETLK, &sandboxlock) < 0)
		errExit("fcntl");

	return fd;
}