From 9dec9dbc4bbd09a59cf35f4000d26794b42edcfc Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 11 Nov 2025 07:18:43 +0900 Subject: container/init: close setup pipe early This prevents leaking the setup pipe. Signed-off-by: Ophestra --- test/sandbox/test.py | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'test/sandbox/test.py') diff --git a/test/sandbox/test.py b/test/sandbox/test.py index bce493b4..24fd1d3a 100644 --- a/test/sandbox/test.py +++ b/test/sandbox/test.py @@ -45,6 +45,12 @@ machine.wait_for_file("/tmp/sway-ipc.sock") swaymsg("exec hakurei run cat") check_filter(0, "pdlike", "cat") +# Check fd leak: +swaymsg("exec hakurei -v run sleep infinity") +pd_identity0_sleep_pid = int(machine.wait_until_succeeds("pgrep -U 10000 -x sleep", timeout=60)) +print(machine.succeed(f"hakurei-test fd {pd_identity0_sleep_pid}")) +machine.succeed(f"kill -INT {pd_identity0_sleep_pid}") + # Verify capabilities/securebits in user namespace: print(machine.succeed("sudo -u alice -i hakurei run capsh --print")) print(machine.succeed("sudo -u alice -i hakurei run capsh --has-no-new-privs")) -- cgit v1.3.1