@@ -124,8 +124,9 @@ pub fn mark_inherited_descriptors_close_on_exec() -> io::Result<()> {
 /// `sandbox_tgid` is the sandbox PID as visible from its workload namespace.
 /// The filter blocks thread-targeting operations that name the trusted sandbox
 /// leader and blocks process-directed operations with the same target. The
-/// ordinary workload listener additionally mediates `kill`, `tkill`, and
-/// `rt_sigqueueinfo`: Linux accepts nonleader TIDs for these operations, so a
+/// ordinary workload listener additionally mediates `kill`, `tkill`,
+/// `rt_sigqueueinfo`, and `SIGCONT` sent with `tgkill` or
+/// `rt_tgsigqueueinfo`: Linux accepts nonleader TIDs for these operations, so a
 /// static TGID comparison alone cannot protect future sandbox worker threads.
 pub fn prepare(sandbox_tgid: u32) -> io::Result<ChildHardeningProgram> {
     if sandbox_tgid == 0 {
 
@@ -12,6 +12,7 @@
 
 use std::io;
 use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
+use std::sync::atomic::{AtomicBool, Ordering};
 
 use crate::linux::seccomp_notify::{Notification, NotificationListener};
 use crate::linux::task_memory;
@@ -27,7 +28,7 @@ pub fn mediate_process_signal(
     listener: &NotificationListener,
     notification: Notification,
     sandbox_tgid: u32,
-    workload_frozen: bool,
+    workload_frozen: &AtomicBool,
 ) -> io::Result<()> {
     listener.validate_id(notification.id)?;
     let target = scalar_int(notification.args[0]);
@@ -66,6 +67,7 @@ pub fn mediate_process_signal(
         _ => return Err(io::Error::from_raw_os_error(libc::ENOSYS)),
     };
     listener.validate_id(notification.id)?;
+    refuse_resume_while_frozen(signal, workload_frozen)?;
     // SAFETY: retained owns a live pidfd; info is null or a complete trusted
     // copy. The kernel targets that process object, never a reused numeric PID.
     let result = unsafe {
@@ -83,59 +85,57 @@ pub fn mediate_process_signal(
     listener.respond_value(notification.id, 0)
 }
 
-/// Continue a positive-target `tkill` only when the target thread belongs to
-/// an untrusted workload process rather than the sandbox runtime itself.
+/// Continue a thread-directed signal (`tkill`, `tgkill`,
+/// `rt_tgsigqueueinfo`) aimed at an untrusted workload thread.
 ///
 /// Continuing preserves Linux's thread-directed signal semantics, including
-/// the cancellation signal used by musl. A target that exits between the
-/// ownership check and continuation can only be reused inside the same PID
-/// namespace; the static child filter still rejects the sandbox leader.
+/// the cancellation signal used by musl. The static child filter rejects the
+/// sandbox leader as a `tgkill`/`rt_tgsigqueueinfo` group, and the kernel
+/// rejects a thread outside the named group, so those two are notified only
+/// for `SIGCONT`. A `tkill` names a bare thread, so its group is resolved here;
+/// a target reused between this check and continuation stays inside the same
+/// PID namespace.
 pub fn mediate_thread_signal(
     listener: &NotificationListener,
     notification: Notification,
     sandbox_tgid: u32,
-    workload_frozen: bool,
+    workload_frozen: &AtomicBool,
 ) -> io::Result<()> {
     listener.validate_id(notification.id)?;
-    // tkill(tid, sig); tgkill(tgid, tid, sig); rt_tgsigqueueinfo(tgid, tid,
-    // sig, info). The kernel itself validates a queued siginfo's code.
-    let (claimed_group, target, signal) = match i64::from(notification.syscall) {
-        libc::SYS_tkill => (
-            None,
-            scalar_int(notification.args[0]),
-            scalar_int(notification.args[1]),
-        ),
-        libc::SYS_tgkill | libc::SYS_rt_tgsigqueueinfo => (
-            Some(scalar_int(notification.args[0])),
-            scalar_int(notification.args[1]),
-            scalar_int(notification.args[2]),
-        ),
+    let signal = match i64::from(notification.syscall) {
+        libc::SYS_tkill => {
+            let target = scalar_int(notification.args[0]);
+            let signal = scalar_int(notification.args[1]);
+            if target <= 0 {
+                return Err(io::Error::from_raw_os_error(libc::EPERM));
+            }
+            let target =
+                u32::try_from(target).map_err(|_| io::Error::from_raw_os_error(libc::ESRCH))?;
+            let target_group = thread_group_id(target)?;
+            if target_group == sandbox_tgid || target_group == 0 {
+                return Err(io::Error::from_raw_os_error(libc::EPERM));
+            }
+            signal
+        }
+        libc::SYS_tgkill | libc::SYS_rt_tgsigqueueinfo => scalar_int(notification.args[2]),
         _ => return Err(io::Error::from_raw_os_error(libc::ENOSYS)),
     };
-    if target <= 0 || claimed_group.is_some_and(|group| group <= 0) {
-        return Err(io::Error::from_raw_os_error(libc::EPERM));
-    }
     if !(0..=64).contains(&signal) {
         return Err(io::Error::from_raw_os_error(libc::EINVAL));
     }
-    refuse_resume_while_frozen(signal, workload_frozen)?;
-    let target = u32::try_from(target).map_err(|_| io::Error::from_raw_os_error(libc::ESRCH))?;
-    let target_group = thread_group_id(target)?;
-    if target_group == sandbox_tgid || target_group == 0 {
-        return Err(io::Error::from_raw_os_error(libc::EPERM));
-    }
-    if claimed_group.is_some_and(|group| u32::try_from(group).ok() != Some(target_group)) {
-        // The kernel reports a thread outside the named group as missing.
-        return Err(io::Error::from_raw_os_error(libc::ESRCH));
-    }
     listener.validate_id(notification.id)?;
+    refuse_resume_while_frozen(signal, workload_frozen)?;
     listener.respond_continue(notification.id)
 }
 
 /// While the boundary has stopped the workload for supervisor recovery, a
 /// workload process that was not yet stopped must not resume the others.
-fn refuse_resume_while_frozen(signal: i32, workload_frozen: bool) -> io::Result<()> {
-    if workload_frozen && signal == libc::SIGCONT {
+///
+/// The flag is read immediately before delivery. The freezer does not wait
+/// for in-flight notifications, so a signal already past this check when the
+/// freeze begins can still be delivered.
+fn refuse_resume_while_frozen(signal: i32, workload_frozen: &AtomicBool) -> io::Result<()> {
+    if signal == libc::SIGCONT && workload_frozen.load(Ordering::Acquire) {
         return Err(io::Error::from_raw_os_error(libc::EPERM));
     }
     Ok(())
@@ -205,8 +205,13 @@ mod tests {
             .recv_timeout(std::time::Duration::from_secs(5))
             .unwrap();
         let notification = listener.receive().unwrap();
-        let error =
-            mediate_process_signal(&listener, notification, std::process::id(), false).unwrap_err();
+        let error = mediate_process_signal(
+            &listener,
+            notification,
+            std::process::id(),
+            &AtomicBool::new(false),
+        )
+        .unwrap_err();
         assert_eq!(error.raw_os_error(), Some(libc::EPERM));
         listener
             .respond_errno(notification.id, libc::EPERM)
 
@@ -170,9 +170,10 @@ impl NotificationProbeReport {
 /// Owned listener returned by `SECCOMP_FILTER_FLAG_NEW_LISTENER`.
 ///
 /// The listener is installed without `WAIT_KILLABLE_RECV`, so mediation is the
-/// same on every kernel. A signal can interrupt a notified syscall and the
-/// kernel then restarts it; broker handlers check the notification is still
-/// live before acting and answer a repeated operation as the kernel would.
+/// same on every kernel. A signal can interrupt a notified syscall, which the
+/// kernel then restarts or fails with `EINTR`; broker handlers check the
+/// notification is still live before acting and answer a repeated operation
+/// as the kernel would.
 pub struct NotificationListener {
     fd: OwnedFd,
 }
@@ -705,6 +706,10 @@ fn build_filter(syscalls: &[i64]) -> io::Result<Vec<libc::sock_filter>> {
             append_sendto_filter(&mut program)?;
             continue;
         }
+        if matches!(syscall, libc::SYS_tgkill | libc::SYS_rt_tgsigqueueinfo) {
+            append_resume_signal_filter(&mut program, syscall)?;
+            continue;
+        }
         let syscall = u32::try_from(syscall)
             .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "negative syscall number"))?;
         program.extend([
@@ -745,6 +750,27 @@ fn append_sendto_filter(program: &mut Vec<libc::sock_filter>) -> io::Result<()>
     Ok(())
 }
 
+/// Notify a thread-group signal only when it sends `SIGCONT`, which the broker
+/// refuses while the workload is frozen. Every other signal (for example Go's
+/// preemption signal) stays in the kernel.
+fn append_resume_signal_filter(
+    program: &mut Vec<libc::sock_filter>,
+    syscall: i64,
+) -> io::Result<()> {
+    let syscall = u32::try_from(syscall)
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "negative syscall number"))?;
+    let resume = u32::try_from(libc::SIGCONT)
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "negative signal number"))?;
+    program.extend([
+        jump(BPF_JMP_JEQ_K, syscall, 0, 4),
+        stmt(BPF_LD_W_ABS, argument_word_offset(2, 0)),
+        jump(BPF_JMP_JEQ_K, resume, 0, 1),
+        stmt(BPF_RET_K, SECCOMP_RET_USER_NOTIF),
+        stmt(BPF_RET_K, SECCOMP_RET_ALLOW),
+    ]);
+    Ok(())
+}
+
 const fn argument_word_offset(argument: u32, word: u32) -> u32 {
     SECCOMP_DATA_ARGS_OFFSET + argument * 8 + word * 4
 }