From: Daan De Meyer <daan@amutable.com>
Date: Sat, 14 Feb 2026 13:40:18 +0000 (+0100)
Subject: sandbox: Make sure eventfd is CLOEXEC
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4b18ea8395e9cc2b1d247be93944f5539affe964;p=thirdparty%2Fmkosi.git

sandbox: Make sure eventfd is CLOEXEC
---

diff --git a/mkosi/sandbox.py b/mkosi/sandbox.py
index 684c2dfb4..bfe26c2c9 100755
--- a/mkosi/sandbox.py
+++ b/mkosi/sandbox.py
@@ -46,6 +46,7 @@ CLONE_NEWNET = 0x40000000
 CLONE_NEWNS = 0x00020000
 CLONE_NEWUSER = 0x10000000
 EBADF = 9
+EFD_CLOEXEC = 0x80000
 ENAMETOOLONG = 36
 EPERM = 1
 ENOENT = 2
@@ -605,7 +606,7 @@ def become_user(uid: int, gid: int) -> None:
 
     ppid = os.getpid()
 
-    event = libc.eventfd(0, 0)
+    event = libc.eventfd(0, EFD_CLOEXEC)
     if event < 0:
         oserror("eventfd")