diff options
Diffstat (limited to 'gnu/build/linux-container.scm')
| -rw-r--r-- | gnu/build/linux-container.scm | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index a0c8174721..72e3a45422 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2015 David Thompson <davet@gnu.org> -;;; Copyright © 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org> +;;; Copyright © 2017-2019, 2022 Ludovic Courtès <ludo@gnu.org> ;;; ;;; This file is part of GNU Guix. ;;; @@ -233,7 +233,7 @@ that host UIDs (respectively GIDs) map to in the namespace." ;; The parent process must initialize the user namespace for the child ;; before it can boot. To negotiate this, a pipe is used such that the ;; child process blocks until the parent writes to it. - (match (socketpair PF_UNIX SOCK_STREAM 0) + (match (socketpair PF_UNIX (logior SOCK_CLOEXEC SOCK_STREAM) 0) ((child . parent) (let ((flags (namespaces->bit-mask namespaces))) (match (clone flags) @@ -442,6 +442,10 @@ return the exit status." "Like 'container-excursion', but return the return value of THUNK." (match (pipe) ((in . out) + ;; Make sure IN and OUT are not inherited if THUNK forks + execs. + (fcntl in F_SETFD FD_CLOEXEC) + (fcntl out F_SETFD FD_CLOEXEC) + (match (container-excursion pid (lambda () (close-port in) |