Merge pull request #11602 from zimbatm/stricter-chroot-user

build-fhs-userenv: don't leak file descriptors

1 files changed, 2 insertions, 2 deletions

diff --git a/pkgs/build-support/build-fhs-userenv/chroot-user.rb b/pkgs/build-support/build-fhs-userenv/chroot-user.rb
index 05b4914b6f6b..97316ac43695 100755
--- a/pkgs/build-support/build-fhs-userenv/chroot-user.rb
+++ b/pkgs/build-support/build-fhs-userenv/chroot-user.rb
@@ -140,10 +140,10 @@ if $cpid == 0
   link_swdir.call swdir, Pathname.new('')
 
   # New environment
-  ENV.replace(Hash[ envvars.map { |x| [x, ENV[x]] } ])
+  new_env = Hash[ envvars.map { |x| [x, ENV[x]] } ]
 
   # Finally, exec!
-  exec *execp
+  exec(new_env, *execp, close_others: true, unsetenv_others: true)
 end
 
 # Wait for a child. If we catch a signal, resend it to child and continue