From 0a12d456ce5869042dc06c43c360c43cab942d6b Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 17 Mar 2026 14:19:00 +0900 Subject: container: set CLOEXEC via close_range This is guarded behind the close_range build tag for now. Signed-off-by: Ophestra --- container/syscall_range_proc.go | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 container/syscall_range_proc.go (limited to 'container/syscall_range_proc.go') diff --git a/container/syscall_range_proc.go b/container/syscall_range_proc.go new file mode 100644 index 00000000..62b369f0 --- /dev/null +++ b/container/syscall_range_proc.go @@ -0,0 +1,28 @@ +//go:build !close_range + +package container + +import ( + "os" + "strconv" + "syscall" + + "hakurei.app/container/fhs" +) + +// doCloseOnExec implements ensureCloseOnExec by ranging over proc_pid_fd(5). +func doCloseOnExec() error { + entries, err := os.ReadDir(fhs.ProcSelf + "fd/") + if err != nil { + return err + } + + var fd int + for _, ent := range entries { + if fd, err = strconv.Atoi(ent.Name()); err != nil { + return err // not reached + } + syscall.CloseOnExec(fd) + } + return nil +} -- cgit v1.3.1