Fix potential dirfd leak.

cpuguy83 · cpuguy83 · commit 17fece81870e · 2021-11-19T23:13:25.000Z
Make sure we don't accidentally leak this dir fd by using O_CLOEXEC.

Signed-off-by: Brian Goff &lt;cpuguy83@gmail.com&gt;
diff --git a/v2/manager.go b/v2/manager.go
@@ -658,7 +658,7 @@ func setDevices(path string, devices []specs.LinuxDeviceCgroup) error {
 	if err != nil {
 		return err
 	}
-	dirFD, err := unix.Open(path, unix.O_DIRECTORY|unix.O_RDONLY, 0600)
+	dirFD, err := unix.Open(path, unix.O_DIRECTORY|unix.O_RDONLY|unix.O_CLOEXEC, 0600)
 	if err != nil {
 		return fmt.Errorf("cannot get dir FD for %s", path)
 	}

Original file line number	Diff line number	Diff line change
`@@ -658,7 +658,7 @@ func setDevices(path string, devices []specs.LinuxDeviceCgroup) error {`
`658`	`658`	`if err != nil {`
`659`	`659`	`return err`
`660`	`660`	`}`
`661`		`- dirFD, err := unix.Open(path, unix.O_DIRECTORY\|unix.O_RDONLY, 0600)`
	`661`	`+ dirFD, err := unix.Open(path, unix.O_DIRECTORY\|unix.O_RDONLY\|unix.O_CLOEXEC, 0600)`
`662`	`662`	`if err != nil {`
`663`	`663`	`return fmt.Errorf("cannot get dir FD for %s", path)`
`664`	`664`	`}`