[int_19h]

But in POSIX, they are not, so any module implemented in C is still potentially problematic.

[teddyh]

Only if that C-implemented module uses raw C to create file descriptors. And if the module has not gotten an update in the past ten years to fix the problem.

[jcalvinowens]

This can help: https://man7.org/linux/man-pages/man2/close_range.2.html

    close_range(3, ~0U, CLOSE_RANGE_UNSHARE);
    execve(....);

...but it's not very portable yet.

[oseityphelysiol]

I’ve never heard of it before. I work in an embedded environment where kernel version is known beforehand, so portability won’t be an issue. Thanks.