From ac3463589035394bedbedb15a323298251ed2c14 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Wed, 12 Nov 2025 00:18:11 +0900
Subject: container: set FD_CLOEXEC on all open files

While fd created from this side always has the FD_CLOEXEC flag, the same is not true for files left open by the parent. This change prevents those files from leaking into the container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 test/sandbox/test.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/sandbox/test.py b/test/sandbox/test.py
index 24fd1d3a..ad38e73c 100644
--- a/test/sandbox/test.py
+++ b/test/sandbox/test.py
@@ -46,7 +46,7 @@ swaymsg("exec hakurei run cat")
 check_filter(0, "pdlike", "cat")
 
 # Check fd leak:
-swaymsg("exec hakurei -v run sleep infinity")
+swaymsg("exec exec 127</proc/cmdline && hakurei -v run sleep infinity")
 pd_identity0_sleep_pid = int(machine.wait_until_succeeds("pgrep -U 10000 -x sleep", timeout=60))
 print(machine.succeed(f"hakurei-test fd {pd_identity0_sleep_pid}"))
 machine.succeed(f"kill -INT {pd_identity0_sleep_pid}")
-- 
cgit v1.3.1