Kir Kolyshkin b70fd68171 libcontainer: inline ExecutableMemfd into exeseal.Memfd ...

ExecutableMemfd has a single caller (exeseal.Memfd), which always passes
MFD_ALLOW_SEALING|MFD_CLOEXEC, and it has been this way ever since the
function was added. Move it into exeseal.Memfd, hardcoding the flags.

This also makes sure the descriptor is always close-on-exec, which is in
line with the Go convention, and an executable memfd is never something
we want to leak across an execve.

Suggested-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2026-10-26 01:36:07 -07:00

..

kernelversion

lint/revive: add package doc comments

2025-10-03 15:17:43 +10:00

doc.go

lint/revive: add package doc comments

2025-10-03 15:17:43 +10:00

linux.go

libcontainer: inline ExecutableMemfd into exeseal.Memfd

2026-10-26 01:36:07 -07:00

proc_test.go

libct/system.Stat: fix/improve/speedup

2021-08-19 19:48:39 -07:00

proc.go

libct/system: use securejoin for /proc/$pid/stat

2025-11-01 21:24:05 +11:00

rlimit_linux.go

libct/sys/rlimit_linux: drop go:build tag

2025-08-27 19:09:58 -07:00