container: set CLOEXEC via close_range

This is guarded behind the close_range build tag for now.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 11 insertions, 0 deletions

diff --git a/container/syscall_close_range.go b/container/syscall_close_range.go
new file mode 100644
index 00000000..c4d6a051
--- /dev/null
+++ b/container/syscall_close_range.go
@@ -0,0 +1,11 @@
+//go:build close_range
+
+package container
+
+import "hakurei.app/ext"
+
+// doCloseOnExec implements ensureCloseOnExec by calling CloseRange with
+// CLOSE_RANGE_CLOEXEC.
+func doCloseOnExec() error {
+	return ext.CloseRange(0, ext.MaxUint, ext.CLOSE_RANGE_CLOEXEC)
+}