From 00d5bb5d7f18555c250b4a6ef0b33b628acc3a3a Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Fri, 23 Sep 2022 22:48:16 +0200 Subject: linux-container: Mark socket pair as SOCK_CLOEXEC. * gnu/build/linux-container.scm (run-container): Pass SOCK_CLOEXEC to 'socketpair'. --- gnu/build/linux-container.scm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'gnu/build') diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 73db127974..72e3a45422 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -233,7 +233,7 @@ that host UIDs (respectively GIDs) map to in the namespace." ;; The parent process must initialize the user namespace for the child ;; before it can boot. To negotiate this, a pipe is used such that the ;; child process blocks until the parent writes to it. - (match (socketpair PF_UNIX SOCK_STREAM 0) + (match (socketpair PF_UNIX (logior SOCK_CLOEXEC SOCK_STREAM) 0) ((child . parent) (let ((flags (namespaces->bit-mask namespaces))) (match (clone flags) -- cgit 1.4.1