Mark inherited descriptors close-on-exec so none reach the sandbox

src/inherited_fds.rs

@@ -0,0 +1,20 @@
+use std::io;
+
+use crate::SandboxError;
+
+const FIRST_FD_AFTER_STDIO: libc::c_uint = 3;
+
+pub fn keep_out_of_sandbox() -> Result<(), SandboxError> {
+    let result = unsafe {
+        libc::syscall(
+            libc::SYS_close_range,
+            FIRST_FD_AFTER_STDIO,
+            libc::c_uint::MAX,
+            libc::CLOSE_RANGE_CLOEXEC,
+        )
+    };
+    if result < 0 {
+        return Err(SandboxError::InheritedFdsCloexec(io::Error::last_os_error()));
+    }
+    Ok(())
+}