Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

When a system creates a child process through forking or execution, that new process automatically receives copies of all file descriptors currently open in its parent. This inherited access persists even if the child process runs with lower system privileges than its parent. The core risk emerges because the child can perform read or write operations through these inherited descriptors, bypassing normal permission checks that would block direct access to the underlying files or network connections. To prevent this, developers must proactively close sensitive file descriptors before spawning child processes, especially when dropping privileges or executing less-trusted code. This is a common oversight in privilege-separation architectures and can lead to information leaks, data corruption, or escalation of privilege, as the child process operates with unintended access rights handed down from its parent.