Fill in TODO

crates/libcontainer/src/process/container_init_process.rs

@@ -840,7 +840,7 @@ fn sync_seccomp(
 
 // verifyCwd ensures that the current directory is actually inside the mount
 // namespace root of the current process.
-// Please refer to XXXXXXX(TODO(utam0k): fill in) for more details.
+// Please refer to https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv for more details.
 fn verify_cwd() -> Result<()> {
     let cwd = unistd::getcwd().map_err(|err| {
         if let nix::errno::Errno::ENOENT = err {

crates/libcontainer/src/process/container_main_process.rs

@@ -74,7 +74,7 @@ pub fn container_main_process(container_args: &ContainerArgs) -> Result<(Pid, bo
 
     // Before starting the intermediate process, mark all non-stdio open files as O_CLOEXEC
     // to ensure we don't leak any file descriptors to the intermediate process.
-    // Please refer to XXXXXXX(TODO(utam0k): fill in) for more details.
+    // Please refer to https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv for more details.
     let syscall = container_args.syscall.create_syscall();
     syscall.close_range(0).map_err(|err| {
         tracing::error!(?err, "failed to cleanup extra fds");