close_range(2) System Calls Manual close_range(2) close_range - (libc -lc) #define _GNU_SOURCE /* feature_test_macros(7) */ #include #include /* Definition of CLOSE_RANGE_* constants */ int close_range(unsigned int first, unsigned int last, int flags); close_range() first last (). . flags 0 : CLOSE_RANGE_CLOEXEC ( 5.11) . CLOSE_RANGE_UNSHARE . close_range() 0. -1 errno . EINVAL flags first last. CLOSE_RANGE_UNSHARE ( ): EMFILE /proc/sys/fs/nr_open ( proc(5)). close_range() CLOSE_RANGE_UNSHARE. ENOMEM . . . 5.9 2.34. ( ) /proc/self/fd/ close(2) . close_range() /proc . /* we don't want anything past stderr here */ close_range(3, ~0U, CLOSE_RANGE_UNSHARE); execve(....); CLOSE_RANGE_UNSHARE unshare(CLONE_FILES); close_range(first, last, 0); : ( last ~0U) first . close(2) . exec . seccomp(2) close_range(): seccomp(2) seccomp close_range() . CLOSE_RANGE_CLOEXEC : seccomp(2) close_range() . ( /proc/PID/fd) close_range() 3 . : $ touch /tmp/a /tmp/b /tmp/c; $ ./a.out /tmp/a /tmp/b /tmp/c; /tmp/a opened as FD 3 /tmp/b opened as FD 4 /tmp/c opened as FD 5 /proc/self/fd/0 ==> /dev/pts/1 /proc/self/fd/1 ==> /dev/pts/1 /proc/self/fd/2 ==> /dev/pts/1 /proc/self/fd/3 ==> /tmp/a /proc/self/fd/4 ==> /tmp/b /proc/self/fd/5 ==> /tmp/c /proc/self/fd/6 ==> /proc/9005/fd ========= About to call close_range() ======= /proc/self/fd/0 ==> /dev/pts/1 /proc/self/fd/1 ==> /dev/pts/1 /proc/self/fd/2 ==> /dev/pts/1 /proc/self/fd/3 ==> /proc/9005/fd /proc/9005/fd opendir(3). #define _GNU_SOURCE #include #include #include #include #include #include #include /* /proc/self/fd */ static void show_fds(void) { DIR *dirp; char path[PATH_MAX], target[PATH_MAX]; ssize_t len; struct dirent *dp; dirp = opendir("/proc/self/fd"); if (dirp == NULL) { perror("opendir"); exit(EXIT_FAILURE); } for (;;) { dp = readdir(dirp); if (dp == NULL) break; if (dp->d_type == DT_LNK) { snprintf(path, sizeof(path), "/proc/self/fd/%s", dp->d_name); len = readlink(path, target, sizeof(target)); printf("%s ==> %.*s\n", path, (int) len, target); } } closedir(dirp); } int main(int argc, char *argv[]) { int fd; for (size_t j = 1; j < argc; j++) { fd = open(argv[j], O_RDONLY); if (fd == -1) { perror(argv[j]); exit(EXIT_FAILURE); } printf("%s opened as FD %d\n", argv[j], fd); } show_fds(); printf("========= About to call close_range() =======\n"); if (close_range(3, ~0U, 0) == -1) { perror("close_range"); exit(EXIT_FAILURE); } show_fds(); exit(EXIT_FAILURE); } close(2) 3 . . : . 6.18 8 2026 close_range(2)