Kir Kolyshkin 5a221f44aa libcontainer: set close-on-exec on all fds we open ...

File descriptors created via the os package are close-on-exec by
default, but the raw syscall wrappers do exactly what they are told,
and a few call sites forgot to ask for it:

 * registerMemoryEventV2 creates an inotify descriptor which is kept
   open for the whole lifetime of the container by the OOM notifier
   goroutine, so it would leak into every "runc exec" process.

 * pivotRoot opens the old root, which is only needed until the
   pivot_root(2) dance is over.

 * readArgString in the seccomp agent opens /proc/PID/mem.

None of these descriptors are meant to be inherited, so set O_CLOEXEC
(IN_CLOEXEC for inotify).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2026-10-25 22:25:58 -07:00

..

cmd

libcontainer: set close-on-exec on all fds we open

2026-10-25 22:25:58 -07:00

dce-canary

Makefile: add verify-dce target, use it in CI

2026-10-03 03:20:56 -07:00

fuzzing

tests/fuzzing: remove user fuzzer package path

2026-08-28 14:20:16 +08:00

integration

Merge pull request #5505 from kolyshkin/kir/strict-spec

2026-10-23 20:32:21 +00:00

podman

ci: add podman tests

2026-10-02 16:59:33 -07:00

rootless.sh

tests/int: run bats with --print-output-on-failure

2026-10-02 14:47:36 -07:00