From 3bdcd7b04d8f276cd6109854c12a4c28bc103211 Mon Sep 17 00:00:00 2001
From: bjorn3 <17426603+bjorn3@users.noreply.github.com>
Date: Mon, 8 Dec 2025 20:38:30 +0100
Subject: [PATCH] bootstrap: Open things with O_CLOEXEC where possible

---
 bootstrap/src/exec.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/bootstrap/src/exec.rs b/bootstrap/src/exec.rs
index f1c01ed647..de7a5f899b 100644
--- a/bootstrap/src/exec.rs
+++ b/bootstrap/src/exec.rs
@@ -40,7 +40,8 @@ pub fn main() -> ! {
 
     let mut env_bytes = [0_u8; 4096];
     let envs = {
-        let fd = FdGuard::open("/scheme/sys/env", O_RDONLY).expect("bootstrap: failed to open env");
+        let fd = FdGuard::open("/scheme/sys/env", O_RDONLY | O_CLOEXEC)
+            .expect("bootstrap: failed to open env");
         let bytes_read = fd
             .read(&mut env_bytes)
             .expect("bootstrap: failed to read env");
@@ -102,11 +103,11 @@ pub fn main() -> ! {
 
     let path = "/scheme/initfs/bin/init";
 
-    let image_file = FdGuard::open(path, O_RDONLY)
+    let image_file = FdGuard::open(path, O_RDONLY | O_CLOEXEC)
         .expect("failed to open init")
         .to_upper()
         .unwrap();
-    let memory = FdGuard::open("/scheme/memory", 0)
+    let memory = FdGuard::open("/scheme/memory", O_CLOEXEC)
         .expect("failed to open memory")
         .to_upper()
         .unwrap();