fix: Avoid leaking inode cache file descriptor to executed programs

diff --git a/src/ccache/inodecache.cpp b/src/ccache/inodecache.cpp
index ed9c7f98e2220ad42db1e68269f41ee380be0971..22aef2d1a4a486146ac0a9d218cc1de6eb545137 100644 (file)
--- a/src/ccache/inodecache.cpp
+++ b/src/ccache/inodecache.cpp
@@ -1,4 +1,4 @@
-// Copyright (C) 2020-2025 Joel Rosdahl and other contributors
+// Copyright (C) 2020-2026 Joel Rosdahl and other contributors
 //
 // See doc/authors.adoc for a complete list of contributors.
 //
@@ -266,6 +266,7 @@ InodeCache::mmap_file(const fs::path& path)
     LOG("Failed to open inode cache {}: {}", path, strerror(errno));
     return false;
   }
+  util::set_cloexec_flag(*m_fd);
   if (!fd_is_on_known_to_work_file_system(*m_fd)) {
     return false;
   }