rexec: mark all fds as close-on-exec if possible

src/lxc/macro.h

@@ -672,4 +672,6 @@ enum {
 
 #define ENOCGROUP2 ENOMEDIUM
 
+#define MAX_FILENO ~0U
+
 #endif /* __LXC_MACRO_H */

src/lxc/rexec.c

@@ -162,6 +162,9 @@ static void lxc_rexec_as_memfd(char **argv, char **envp, const char *memfd_name)
 	if (execfd < 0)
 		return;
 
+	ret = close_range(STDERR_FILENO, MAX_FILENO, CLOSE_RANGE_CLOEXEC);
+	if (ret && (errno != ENOSYS && errno != EINVAL))
+		fprintf(stderr, "%m - Failed to mark all file descriptors as close-on-exec\n");
 	fexecve(execfd, argv, envp);
 }