Use close_range

[kazuho]

This PR:

• refactors the code, we always rely on closefrom
• on non-BSD systems, use a loop-based implementation of closefrom, with a tweak on linux to try close_range at first (a syscall available on linux 5.09 and above).

[jhatala]

The syscall fails with EPERM under docker unless I start the container with --privileged.

It appears that it is due to docker's allow-list approach to new syscalls: docker/for-linux#1262.

#include <sys/syscall.h>
#include <unistd.h>
#include <err.h>
#include <stdio.h>
#include <fcntl.h>

int main(void)
{
        for (int i = 0; i < 10; ++i) {
                (void)open("/dev/null", O_RDONLY);
        }

        if (syscall(__NR_close_range, 3, ~0, 0) == 0) {
                printf("Success.\n");
        } else {
                err(1, "close_range");
        }
        return 0;
}

$ docker run --rm -it -v $PWD:$PWD ubuntu:latest $PWD/doit
doit: close_range: Operation not permitted

$ docker run --privileged --rm -it -v $PWD:$PWD ubuntu:latest $PWD/doit
Success.

$ docker --version
Docker version 20.10.5, build 55c4c88966

[kazuho]

@jhatala

The syscall fails with EPERM under docker unless I start the container with --privileged.

Oh that's understandable but unfortunate.

OTOH, I do not think that's an blocker for us, as we have a fallback. Note also that h2o uses --privileged option (https://github.com/h2o/h2o/blob/f7eeb02b7fe4933bab57ee1922baf1cad2e3087f/misc/docker-ci/check.mk#L8).

Please let me know if you have issues.