carlos / platform Public

Merge remote-tracking branch 'origin/feat/hostclaim-boxguard' into feat/hostclaim-console

claude 2 weeks ago bfe55e3379eb9c7aa218effc53e471740a406578 parent 075c50dparent 695b6d3

1 file changed, +6 −1

diff --git a/internal/stopevidence/fds_linux_test.go b/internal/stopevidence/fds_linux_test.go

index b113c98c2..9bd1f183e 100644

--- a/internal/stopevidence/fds_linux_test.go

+++ b/internal/stopevidence/fds_linux_test.go

@@ -217,9 +217,14 @@ func TestFDTaskScanErrors(t *testing.T) {

func TestFDHoldersUnsharedThread(t *testing.T) {

path := filepath.Join(t.TempDir(), "thread.db")

ready, release, done := make(chan error), make(chan struct{}), make(chan struct{})

+ leader := false

go func() {

runtime.LockOSThread()

defer close(done)

+ // The goroutine may land on the thread-group leader, whose table is

+ // /proc/<pid>/fd itself; the leader-invisibility check below only

+ // holds for a non-leader thread.

+ leader = unix.Gettid() == os.Getpid()

if err := unix.Unshare(unix.CLONE_FILES); err != nil {

ready <- err

return

@@ -247,7 +252,7 @@ func TestFDHoldersUnsharedThread(t *testing.T) {

}

for _, entry := range entries {

target, err := os.Readlink(filepath.Join("/proc", pid, "fd", entry.Name()))

- if err == nil && target == path {

+ if err == nil && target == path && !leader {

t.Fatal("private descriptor visible in leader table")

}