add missing O_CLOEXEC to open calls

The go std os package to will always make sure to use O_CLOEXEC, however
in cases where we directly call unix.Open() we need to pass that flag
explicitly.

I looked at this as there was a report of a leaked fd on the pasta list,
though I am not sure this will address it.

But anyway doing this should be rather safe and avoid leaks into other
processes.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit d20933df02)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>

cmd/rootlessport/main.go

@@ -201,7 +201,7 @@ outer:
 		_ = os.Remove(socketfile)
 		// workaround to bypass the 108 char socket path limit
 		// open the fd and use the path to the fd as bind argument
-		fd, err := unix.Open(socketDir, unix.O_PATH, 0)
+		fd, err := unix.Open(socketDir, unix.O_PATH|unix.O_CLOEXEC, 0)
 		if err != nil {
 			return err
 		}

libpod/oci_conmon_attach_linux.go

@@ -10,7 +10,7 @@ import (
 )
 
 func openUnixSocket(path string) (*net.UnixConn, error) {
-	fd, err := unix.Open(path, unix.O_PATH, 0)
+	fd, err := unix.Open(path, unix.O_PATH|unix.O_CLOEXEC, 0)
 	if err != nil {
 		return nil, err
 	}

pkg/pidhandle/pidhandle_linux.go

@@ -118,7 +118,7 @@ func NewPIDHandleFromString(pid int, pidData string) (PIDHandle, error) {
 			return nil, err
 		}
 		defer unix.Close(fd)
-		pidfd, err := openByHandleAt(fd, fh, 0)
+		pidfd, err := openByHandleAt(fd, fh, unix.O_CLOEXEC)
 		if err != nil {
 			if err == unix.ESTALE {
 				h.normalHandle.pidData = noSuchProcessID

pkg/specgen/generate/config_linux.go

@@ -153,7 +153,7 @@ func addDevice(g *generate.Generator, device string) error {
 	} else if src == "/dev/fuse" {
 		// if the user is asking for fuse inside the container
 		// make sure the module is loaded.
-		f, err := unix.Open(src, unix.O_RDONLY|unix.O_NONBLOCK, 0)
+		f, err := unix.Open(src, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
 		if err == nil {
 			unix.Close(f)
 		}