fortify: keep external files alive

This should eliminate sporadic failures, like the known double close in "seccomp".

Signed-off-by: Ophestra <cat@gensokyo.uk>

2 files changed, 17 insertions, 2 deletions

diff --git a/helper/proc/pipe.go b/helper/proc/pipe.go
index 92ffe693..838c4ae4 100644
--- a/helper/proc/pipe.go
+++ b/helper/proc/pipe.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"os"
+	"runtime"
 )
 
 // NewWriterTo returns a [File] that receives content from wt on fulfillment.
@@ -25,13 +26,20 @@ func (f *writeToFile) Fulfill(ctx context.Context, dispatchErr func(error)) erro
 	f.Set(r)
 
 	done := make(chan struct{})
-	go func() { _, err = f.wt.WriteTo(w); dispatchErr(err); dispatchErr(w.Close()); close(done) }()
+	go func() {
+		_, err = f.wt.WriteTo(w)
+		dispatchErr(err)
+		dispatchErr(w.Close())
+		close(done)
+		runtime.KeepAlive(r)
+	}()
 	go func() {
 		select {
 		case <-done:
 			dispatchErr(nil)
 		case <-ctx.Done():
 			dispatchErr(w.Close()) // this aborts WriteTo with file already closed
+			runtime.KeepAlive(r)
 		}
 	}()
 
@@ -83,6 +91,7 @@ func (f *statFile) Fulfill(ctx context.Context, dispatchErr func(error)) error {
 		default:
 			panic("unreachable")
 		}
+		runtime.KeepAlive(w)
 	}()
 
 	go func() {
@@ -91,6 +100,7 @@ func (f *statFile) Fulfill(ctx context.Context, dispatchErr func(error)) error {
 			dispatchErr(nil)
 		case <-ctx.Done():
 			dispatchErr(r.Close()) // this aborts Read with file already closed
+			runtime.KeepAlive(w)
 		}
 	}()
 
diff --git a/helper/seccomp/export.go b/helper/seccomp/export.go
index 52ec4144..9efee3b4 100644
--- a/helper/seccomp/export.go
+++ b/helper/seccomp/export.go
@@ -27,7 +27,12 @@ func (e *exporter) prepare() error {
 		}
 
 		ec := make(chan error, 1)
-		go func(fd uintptr) { ec <- exportFilter(fd, e.opts); close(ec); _ = e.closeWrite() }(e.w.Fd())
+		go func(fd uintptr) {
+			ec <- exportFilter(fd, e.opts)
+			close(ec)
+			_ = e.closeWrite()
+			runtime.KeepAlive(e.w)
+		}(e.w.Fd())
 		e.exportErr = ec
 		runtime.SetFinalizer(e, (*exporter).closeWrite)
 	})