Use FD_CLOEXEC in Sentinel, so that FDs don't leak to the scripts it runs (#8242)

Sentinel uses execve to run scripts, so it needs to use FD_CLOEXEC
on all file descriptors, so that they're not accessible by the script it runs.

This commit includes a change to the sentinel tests, which verifies no
FDs are left opened when the script is executed.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/ae_evport.c b/src/ae_evport.c
index 4e254b602..7a0b03aea 100644
--- a/src/ae_evport.c
+++ b/src/ae_evport.c
@@ -82,6 +82,7 @@ static int aeApiCreate(aeEventLoop *eventLoop) {
         zfree(state);
         return -1;
     }
+    anetCloexec(state->portfd);
 
     state->npending = 0;