Do not close error pipe or debug fd via closefrom() as we need them

to report an exec error should one occur.

--HG--
branch : 1.7

diff --git a/exec.c b/exec.c
index fd4c8a61e220a1f2366e436497291a3041cf56b5..401b718484fa3b1816cde0fadc77e6ab3de1fff3 100644 (file)
--- a/exec.c
+++ b/exec.c
@@ -142,7 +142,11 @@ static int fork_cmnd(path, argv, envp, sv, rbac_enabled)
        restore_signals();
        if (exec_setup(rbac_enabled, user_ttypath, -1) == TRUE) {
            /* headed for execve() */
-           closefrom(def_closefrom);
+           int maxfd = def_closefrom;
+           dup2(sv[1], maxfd);
+           (void)fcntl(maxfd, F_SETFD, FD_CLOEXEC);
+           sv[1] = maxfd++;
+           closefrom(maxfd);
 #ifdef HAVE_SELINUX
            if (rbac_enabled)
                selinux_execve(path, argv, envp);

diff --git a/exec_pty.c b/exec_pty.c
index 0788a136f2ab912819ae4892373e312fb0a59cbc..37c4e31bd4e25d4e27fd574db511cf4af093b99c 100644 (file)
--- a/exec_pty.c
+++ b/exec_pty.c
@@ -104,7 +104,7 @@ static void flush_output __P((void));
 static int exec_monitor __P((const char *path, char *argv[],
     char *envp[], int, int));
 static void exec_pty __P((const char *path, char *argv[],
-    char *envp[], int));
+    char *envp[], int, int *));
 static RETSIGTYPE sigwinch __P((int s));
 static void sync_ttysize __P((int src, int dst));
 static void deliver_signal __P((pid_t pid, int signo));
@@ -780,7 +780,7 @@ exec_monitor(path, argv, envp, backchannel, rbac)
        restore_signals();
 
        /* setup tty and exec command */
-       exec_pty(path, argv, envp, rbac);
+       exec_pty(path, argv, envp, rbac, &errpipe[1]);
        cstat.type = CMD_ERRNO;
        cstat.val = errno;
        if (write(errpipe[1], &cstat, sizeof(cstat)) == -1)
@@ -977,12 +977,14 @@ flush_output()
  * Returns only if execve() fails.
  */
 static void
-exec_pty(path, argv, envp, rbac_enabled)
+exec_pty(path, argv, envp, rbac_enabled, errfd)
     const char *path;
     char *argv[];
     char *envp[];
     int rbac_enabled;
+    int *errfd;
 {
+    int maxfd = def_closefrom;
     pid_t self = getpid();
 
     /* Set child process group here too to avoid a race. */
@@ -1010,7 +1012,10 @@ exec_pty(path, argv, envp, rbac_enabled)
     if (io_fds[SFD_STDERR] != io_fds[SFD_SLAVE])
        close(io_fds[SFD_STDERR]);
 
-    closefrom(def_closefrom);
+    dup2(*errfd, maxfd);
+    (void)fcntl(maxfd, F_SETFD, FD_CLOEXEC);
+    *errfd = maxfd++;
+    closefrom(maxfd);
 #ifdef HAVE_SELINUX
     if (rbac_enabled)
        selinux_execve(path, argv, envp);