https://nalar.dev/tags/process-isolation/ Recent content in Process Isolation on Nalar Hugo en-us Thu, 17 Sep 2026 00:00:00 +0000 https://nalar.dev/close-on-exec-makes-descriptor-inheritance-an-explicit-boundary/ Thu, 17 Sep 2026 00:00:00 +0000 https://nalar.dev/close-on-exec-makes-descriptor-inheritance-an-explicit-boundary/ <p>A service opens a privileged socket, starts helper programs, and expects those helpers to receive only standard input, output, and error. One descriptor created without close-on-exec can quietly violate that boundary. If it remains present when a new program image is installed, the helper inherits access to the kernel object even when its own credentials could never have opened that object.</p> <p>Linux treats this as descriptor inheritance, not a new authorization event. The security decision made when the object was opened is embodied in the descriptor. <code>FD_CLOEXEC</code> controls whether that established authority crosses a successful <code>execve()</code>.</p>