Let SIGTERM cancel a running pass and bound nfs-server's clean-up at 10 s, so a hanging command cannot keep the export file past the stop timeout

modules/nfs-server/cmd/nfs-server/machine.go

@@ -108,6 +108,21 @@ type Machine struct {
 	// clean is when a look below each real path last found no backup repository (LookKept).
 	clean   map[string]time.Time
 	cleanMu sync.Mutex
+	// walk is the running pass's context, which ends the look below a share when the process stops.
+	walk   context.Context
+	walkMu sync.Mutex
+}
+
+func (m *Machine) setWalk(ctx context.Context) {
+	m.walkMu.Lock()
+	m.walk = ctx
+	m.walkMu.Unlock()
+}
+
+func (m *Machine) walking() context.Context {
+	m.walkMu.Lock()
+	defer m.walkMu.Unlock()
+	return m.walk
 }
 
 // Here is the machine this process runs on.
@@ -272,8 +287,17 @@ func (m *Machine) Escalated(name string, args ...string) (string, []string) {
 
 // AsRoot runs what only root may do, and names a refusal by how it failed.
 func (m *Machine) AsRoot(name string, args ...string) (Ran, error) {
+	return m.AsRootWithin(context.Background(), name, args...)
+}
+
+// AsRootWithin is AsRoot ended with its context: the process's pass is cancelled by SIGTERM, and Stopped
+// runs within StopTimeout.
+func (m *Machine) AsRootWithin(ctx context.Context, name string, args ...string) (Ran, error) {
 	program, argv := m.Escalated(name, args...)
-	r := m.Run(context.Background(), program, argv...)
+	r := m.Run(ctx, program, argv...)
+	if err := ctx.Err(); err != nil && r.Code != 0 {
+		return r, fmt.Errorf("%s %s did not finish: %v", name, strings.Join(args, " "), err)
+	}
 	if r.Code != 0 {
 		why := r.Err
 		if why == "" {