memfd: always create our memfds with CLOEXEC set

We really shouldn't create fds ever that have the flag unset.

src/libsystemd/sd-bus/bus-kernel.c

@@ -1129,7 +1129,7 @@ int bus_kernel_pop_memfd(sd_bus *bus, void **address, size_t *mapped, size_t *al
                 if (!g)
                         return -ENOMEM;
 
-                r = memfd_create(g, MFD_ALLOW_SEALING);
+                r = memfd_create(g, MFD_ALLOW_SEALING|MFD_CLOEXEC);
                 if (r < 0)
                         return -errno;
 

src/shared/memfd.c

@@ -65,7 +65,7 @@ int memfd_new(const char *name) {
                 }
         }
 
-        fd = memfd_create(name, MFD_ALLOW_SEALING);
+        fd = memfd_create(name, MFD_ALLOW_SEALING | MFD_CLOEXEC);
         if (fd < 0)
                 return -errno;
 

src/shared/missing.h

@@ -74,7 +74,11 @@
 #endif
 
 #ifndef MFD_ALLOW_SEALING
-#define MFD_ALLOW_SEALING 0x0002ULL
+#define MFD_ALLOW_SEALING 0x0002U
+#endif
+
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
 #endif
 
 #ifndef IP_FREEBIND