Hacker News Reader

Comment by int_19h | Hacker News Reader

But in POSIX, they are not, so any module implemented in C is still potentially problematic.

Only if that C-implemented module uses raw C to create file descriptors. And if the module has not gotten an update in the past ten years to fix the problem.

This can help: https://man7.org/linux/man-pages/man2/close_range.2.html

    close_range(3, ~0U, CLOSE_RANGE_UNSHARE);
    execve(....);

...but it's not very portable yet.

I’ve never heard of it before. I work in an embedded environment where kernel version is known beforehand, so portability won’t be an issue. Thanks.

Reply on news.ycombinator.com