[immanuwell]

In listen mode, when the first pipe() or the second one fails (EMFILE), connfd and the already created in pipe are never closed. Each failed accept leaks 1 to 3 fds for the lifetime of the process, even after all clients are gone.

Repro with default limits and no --max_conns (the soft RLIMIT_NOFILE is raised to 8192, so about 2000 concurrent clients are enough):

nsjail -Ml --port 9000 --bindhost 127.0.0.1 --disable_clone_newnet --disable_clone_newuser --disable_clone_newns --disable_clone_newpid --disable_clone_newipc --disable_clone_newuts --disable_clone_newcgroup --disable_rlimits -- /bin/sleep 8
# open 2300 connections, wait for the jails to exit, close the clients
ls /proc/$(pidof nsjail)/fd | wc -l

Before: 293 fds (5 right after start). After: 5.

With a low hard limit (ulimit -n 48) the leaked fds fill the table. accept() then fails with EMFILE forever and a new client is never served, even though no jail is running.

The fix closes them on the error paths.