From c3eafb10a0b886876316bca6f9af06db67308ad0 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 10 Jul 2026 18:48:35 +0100
Subject: [PATCH] shift-uid: close consumed directory fds on early return

recurse_fd() consumes each directory fd passed to it, but it has no
cleanup set up until after take_fdopendir() succeeds.
Errors and skipped procfs, sysfs, or read-only subtrees therefore leak the
incoming fd.

Follow-up for b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d
---
 src/shared/shift-uid.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/shared/shift-uid.c b/src/shared/shift-uid.c
index e455306be9..e1c53dcb88 100644
--- a/src/shared/shift-uid.c
+++ b/src/shared/shift-uid.c
@@ -295,8 +295,9 @@ static int is_fs_fully_userns_compatible(const struct statfs *sfs) {
                F_TYPE_EQUAL(sfs->f_type, SYSFS_MAGIC);
 }
 
-static int recurse_fd(int fd, const struct stat *st, uid_t shift, bool is_toplevel) {
+static int recurse_fd(int input_fd, const struct stat *st, uid_t shift, bool is_toplevel) {
         _cleanup_closedir_ DIR *d = NULL;
+        _cleanup_close_ int fd = input_fd;
         bool changed = false;
         struct statfs sfs;
         int r;