From 79cd166c85bf01024995c71d98aca736bb2c2506 Mon Sep 17 00:00:00 2001
From: Ian Littman <iansltx@gmail.com>
Date: Wed, 31 Dec 2025 12:16:35 -0600
Subject: [PATCH] =?UTF-8?q?=F0=9F=A4=96=20Move=20child=20process=20to=20se?=
 =?UTF-8?q?parate=20cgroup=20for=20Linux=20uninstall=20script=20(#37131)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For #36619. Zed + Opus 4.5, prompt was just "fix
https://github.com/fleetdm/fleet/issues/36619"

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

No changes file as this isn't in a Fleet release.

## Testing

- [ ] QA'd all new/changed functionality manually

---------

Co-authored-by: Allen Houchins <allenhouchins@mac.com>
---
 .../linux/scripts/uninstall-fleetd-linux.sh   | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh b/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
index a8d9ffeefc..46e156785d 100755
--- a/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
+++ b/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
@@ -11,20 +11,22 @@ function remove_fleet {
     systemctl stop orbit.service || true
     systemctl disable orbit.service || true
     rm -rf /var/lib/orbit /opt/orbit /var/log/orbit /usr/local/bin/orbit /etc/default/orbit /usr/lib/systemd/system/orbit.service
-    
+
     # Remove any package references
     if command -v dpkg > /dev/null; then
         dpkg --purge fleet-osquery || true
     elif command -v rpm > /dev/null; then
         rpm -e fleet-osquery || true
+    elif command -v pacman > /dev/null; then
+        pacman -Rns --noconfirm fleet-osquery || true
     fi
-    
+
     # Kill any running Fleet processes
     pkill -f fleet-desktop || true
-    
+
     # Reload systemd configuration
     systemctl daemon-reload
-    
+
     echo "Fleetd has been successfully removed from the system."
 }
 
@@ -33,14 +35,22 @@ if [ "$1" = "remove" ]; then
     # Give the parent process time to report the success before removing
     echo "inside remove process" >>/tmp/fleet_remove_log.txt
     sleep 15
-    
+
     # We are root
     remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
 else
     # We are in the parent shell, start the detached child and return success
     echo "Removing fleetd, system will be unenrolled in 15 seconds..."
     echo "Executing detached child process"
-    
+
     # We are root
-    bash -c "bash $0 remove >/dev/null 2>/dev/null </dev/null &"
+    # Use systemd-run to spawn the removal process in a separate transient unit.
+    # This ensures the process escapes the orbit.service cgroup, so when
+    # orbit.service is stopped, the removal script continues running.
+    if command -v systemd-run > /dev/null; then
+        systemd-run --quiet bash "$0" remove
+    else
+        # Fallback for non-systemd systems (rare for modern Linux)
+        bash -c "bash $0 remove >/dev/null 2>/dev/null </dev/null &"
+    fi
 fi