subproc: mark supervisor fds CLOEXEC before helper exec

[ManoharPaturi]

Problem

systemExe() executes external helpers such as newuidmap and newgidmap without first marking unrelated supervisor descriptors close-on-exec. As a result, listening sockets, accepted connections, log descriptors, or other inherited resources can cross the helper execve() boundary unnecessarily.

Change

Before executing an external helper, mark all descriptors above stderr FD_CLOEXEC using nsjail's existing util::makeRangeCOE() helper — the same mechanism the pasta helper path already uses.

The systemExe() error-reporting pipe is already created with O_CLOEXEC. This means it remains available when execve() fails, allowing the child to report the failure, while it is automatically closed when execve() succeeds.

If descriptor sealing itself fails, helper execution is aborted rather than executing with an unknown inherited descriptor set.

Regression test

tests/systemexe_fd_test.cc (wired into make test) demonstrates the behavior before/after: it occupies fd 123 in the supervisor, then runs a helper through systemExe() that checks for /dev/fd/123 in its own process.

• on master: the helper observes fd 123 and exits 42 → the test fails
• with this patch: the descriptor is closed by the exec and the helper exits 0 → the test passes

Verified on Ubuntu 24.04: plain build + full test suite, and a full ASan/UBSan build with the suite run under the sanitizers — all green, no sanitizer findings.

Notes

• The sealing uses close_range(CLOSE_RANGE_CLOEXEC), which requires kernel ≥ 5.9; if support for older kernels without a fallback is preferred (as in containMakeFdsCOE()), that variant is easy to switch to.
• Thanks to the review that suggested the makeRangeCOE() shape — an earlier revision of this PR closed descriptors manually and cleared O_CLOEXEC on the error pipe, which was strictly worse than the existing primitive.

[ManoharPaturi]

Small branch hygiene fix: my local CI workflow file accidentally ended up in this branch — force-pushed the branch rebuilt from current master with only the intended change. The diff is now just the patch itself; the actions scan failure from earlier is gone.

[ManoharPaturi]

Reworked per review: replaced the manual close_range + /proc/self/fd block with util::makeRangeCOE(STDERR_FILENO + 1, ~0U) (the same primitive the pasta helper path uses), keeping the error pipe's O_CLOEXEC semantics intact, and failing closed if the sealing fails. Also added the suggested regression test (tests/systemexe_fd_test.cc, runs in make test): it occupies fd 123 in the supervisor and proves the helper no longer sees it — on master the helper observes the fd and the test fails, with the patch it passes. Verified with a plain build and under ASan/UBSan.

[ManoharPaturi]

@robertswiecki Could you take a look at this revision? Following review feedback, the change now uses util::makeRangeCOE(STDERR_FILENO + 1, ~0U) — the same mechanism the pasta helper path already uses — instead of manual descriptor closing, and fails closed if the sealing fails. The included regression test parks a descriptor at fd 123 and verifies a helper executed via systemExe() can no longer observe it; it fails on master and passes with the patch. The full suite was also run under ASan/UBSan.