Function install_pre_exec

crates/openshell-supervisor-process/src/ssh.rs:1104–1137

(
        cmd: &mut Command,
        policy: SandboxPolicy,
        _workdir: Option<String>,
        slave_fd: RawFd,
        netns_fd: Option<RawFd>,
        #[cfg(target_os = "linux")] prepared: cr

        )
    )]
    pub fn install_pre_exec(
        cmd: &mut Command,
        policy: SandboxPolicy,
        _workdir: Option<String>,
        slave_fd: RawFd,
        netns_fd: Option<RawFd>,
        #[cfg(target_os = "linux")] prepared: crate::sandbox::linux::PreparedSandbox,
    ) -> anyhow::Result<()> {
        // Wrap in Option so we can .take() it out of the FnMut closure.
        // pre_exec is only called once (after fork, before exec).
        #[cfg(target_os = "linux")]
        let mut prepared = Some(prepared);
        #[cfg(target_os = "linux")]
        let supervisor_identity_mount = crate::process::supervisor_identity_mount_from_env()
            .map_err(|err| {
                anyhow::anyhow!("failed to prepare supervisor identity isolation: {err}")
            })?;
        unsafe {
            cmd.pre_exec(move || {
                setsid().map_err(|err| std::io::Error::other(err.to_string()))?;
                set_controlling_tty(slave_fd)?;

                enter_netns_and_sandbox(
                    netns_fd,
                    &policy,
                    #[cfg(target_os = "linux")]
                    supervisor_identity_mount,
                    #[cfg(target_os = "linux")]
                    prepared.take(),
                )
            });
        }
        Ok(())
    }

    /// Pre-exec hook for pipe-based (non-PTY) exec.
    ///