1 files changed, 7 insertions, 1 deletions
diff --git a/oxish/src/session/mod.rs b/oxish/src/session/mod.rs
index b61bdeb..b1b12f4 100644
--- a/oxish/src/session/mod.rs
+++ b/oxish/src/session/mod.rs
@@ -16,7 +16,10 @@ use proto::{
     crypto::CryptoProvider,
     key_exchange::Rekey,
 };
-use rustix::net::{RecvAncillaryBuffer, RecvAncillaryMessage, RecvFlags, SendFlags};
+use rustix::{
+    io::FdFlags,
+    net::{RecvAncillaryBuffer, RecvAncillaryMessage, RecvFlags, SendFlags},
+};
 use tokio::{
     io::{AsyncRead, AsyncWrite},
     net::TcpStream,
@@ -113,6 +116,9 @@ impl Session<TcpStream> {
             return Err(Error::InvalidState("no file descriptor received"));
         };
 
+        // Mark the connection close-on-exec so the session does not inherit a copy of the socket.
+        rustix::io::fcntl_setfd(&fd, FdFlags::CLOEXEC).map_err(io::Error::from)?;
+
         let provider = DEFAULT_PROVIDER;
         let Decoded { value: state, next } =
             SessionState::<SessionHostKey>::decode(&received, provider)?;