diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2020-04-10 15:46:16 -0700 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-04-10 15:47:23 -0700 |
| commit | 96f914295920404e7c5c97553771e09b31f6900a (patch) | |
| tree | 02738d88b3be86d6ab8acbdaa0811dbd182eef08 /runsc/main.go | |
| parent | ca868e3e384fb1dabec4fd27ff3627f61a3bd54d (diff) | |
Use O_CLOEXEC when dup'ing FDs
The sentry doesn't allow execve, but it's a good defense
in-depth measure.
PiperOrigin-RevId: 305958737
Diffstat (limited to 'runsc/main.go')
| -rw-r--r-- | runsc/main.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/runsc/main.go b/runsc/main.go index c1c78529c..59f624842 100644 --- a/runsc/main.go +++ b/runsc/main.go @@ -291,7 +291,7 @@ func main() { // want with them. Since Docker and Containerd both eat boot's stderr, we // dup our stderr to the provided log FD so that panics will appear in the // logs, rather than just disappear. - if err := syscall.Dup3(fd, int(os.Stderr.Fd()), 0); err != nil { + if err := syscall.Dup3(fd, int(os.Stderr.Fd()), syscall.O_CLOEXEC); err != nil { cmd.Fatalf("error dup'ing fd %d to stderr: %v", fd, err) } } |