sys: fix pidfd leak in UnshareAfterEnterUserns

jfernandez · fuweid · commit 5bec0a33297a · 2025-08-07T12:14:56.000-04:00
UnshareAfterEnterUserns() creates a pidfd via os.StartProcess() with CLONE_PIDFD but fails to close the file descriptor in any code path, resulting in a file descriptor leak for every container that uses user namespace isolation. The leak occurs because: - The pidfd is created when PidFD field is set in SysProcAttr - The original defer block only calls PidfdSendSignal() and pidfdWaitid() - No code path calls unix.Close(pidfd) to release the file descriptor This causes one pidfd leak per container launch when user namespace isolation is enabled (e.g., Kubernetes pods with hostUsers: false). In production environments with high container churn, this can exhaust the system's file descriptor limit. Fix the leak by adding a defer statement immediately after process creation that ensures unix.Close(pidfd) is always called, regardless of which code path is taken. This guarantees cleanup even if the function returns early due to errors or lack of pidfd support. This follows the same cleanup pattern already established in core/mount/mount_idmapped_utils_linux.go:getUsernsFD() which properly closes its pidfd. Closes: #12166 Signed-off-by: Jose Fernandez <josef@netflix.com> [Move SupportsPidFD up to handle dupfd in Go 1.23.{0,1} and simplify backport] Signed-off-by: Wei Fu <fuweid89@gmail.com>
diff --git a/pkg/sys/unshare_linux.go b/pkg/sys/unshare_linux.go
@@ -35,6 +35,10 @@ func UnshareAfterEnterUserns(uidMap, gidMap string, unshareFlags uintptr, f func
 		return fmt.Errorf("unshare flags should not include user namespace")
 	}
 
+	if !SupportsPidFD() {
+		return fmt.Errorf("kernel doesn't support pidfd")
+	}
+
 	uidMaps, err := parseIDMapping(uidMap)
 	if err != nil {
 		return err
@@ -65,7 +69,7 @@ func UnshareAfterEnterUserns(uidMap, gidMap string, unshareFlags uintptr, f func
 		return fmt.Errorf("failed to start noop process for unshare: %w", err)
 	}
 
-	if pidfd == -1 || !SupportsPidFD() {
+	if pidfd == -1 {
 		proc.Kill()
 		proc.Wait()
 		return fmt.Errorf("kernel doesn't support CLONE_PIDFD")
@@ -81,11 +85,13 @@ func UnshareAfterEnterUserns(uidMap, gidMap string, unshareFlags uintptr, f func
 		if dupErr != nil {
 			proc.Kill()
 			proc.Wait()
-			return fmt.Errorf("failed to dupfd: %w", err)
+			return fmt.Errorf("failed to dupfd: %w", dupErr)
 		}
 		pidfd = dupPidfd
 	}
 
+	defer unix.Close(pidfd)
+
 	defer func() {
 		derr := unix.PidfdSendSignal(pidfd, unix.SIGKILL, nil, 0)
 		if derr != nil {
