container/init: close setup pipe early

This prevents leaking the setup pipe.

Signed-off-by: Ophestra <cat@gensokyo.uk>

test/sandbox/test.py

@@ -45,6 +45,12 @@ machine.wait_for_file("/tmp/sway-ipc.sock")
 swaymsg("exec hakurei run cat")
 check_filter(0, "pdlike", "cat")
 
+# Check fd leak:
+swaymsg("exec hakurei -v run sleep infinity")
+pd_identity0_sleep_pid = int(machine.wait_until_succeeds("pgrep -U 10000 -x sleep", timeout=60))
+print(machine.succeed(f"hakurei-test fd {pd_identity0_sleep_pid}"))
+machine.succeed(f"kill -INT {pd_identity0_sleep_pid}")
+
 # Verify capabilities/securebits in user namespace:
 print(machine.succeed("sudo -u alice -i hakurei run capsh --print"))
 print(machine.succeed("sudo -u alice -i hakurei run capsh --has-no-new-privs"))

test/sandbox/tool/main.go

@@ -67,6 +67,39 @@ func main() {
 	case "hash": // this eases the pain of passing the hash to python
 		fmt.Print(flagBpfHash)
 
+	case "fd":
+		if len(args) != 2 {
+			log.Fatal("invalid argument")
+		}
+		prefix := fmt.Sprintf("/proc/%s/fd/", args[1])
+
+		var fail bool
+		if entries, err := os.ReadDir(prefix); err != nil {
+			log.Fatal(err.Error())
+		} else {
+			for _, ent := range entries {
+				var fd int
+				if fd, err = strconv.Atoi(ent.Name()); err != nil {
+					log.Fatal(err.Error())
+				}
+
+				// skip standard streams
+				if fd <= 2 {
+					continue
+				}
+				fail = true
+
+				var d string
+				if d, err = os.Readlink(prefix + ent.Name()); err != nil {
+					log.Fatal(err.Error())
+				}
+				log.Printf("[FAIL] extra fd %d -> %s", fd, d)
+			}
+		}
+		if fail {
+			log.Fatal("[FAIL] file descriptors leaked")
+		}
+
 	default:
 		log.Fatal("invalid argument")
 	}