From 749793c8186848bc1356c88097f49953b4a74353 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Thu, 12 Jan 2012 13:19:01 -0500 Subject: [PATCH] Do not close error pipe or debug fd via closefrom() as we need them to report an exec error should one occur. --HG-- branch : 1.7 --- exec.c | 6 +++++- exec_pty.c | 13 +++++++++---- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/exec.c b/exec.c index fd4c8a61e..401b71848 100644 --- a/exec.c +++ b/exec.c @@ -142,7 +142,11 @@ static int fork_cmnd(path, argv, envp, sv, rbac_enabled) restore_signals(); if (exec_setup(rbac_enabled, user_ttypath, -1) == TRUE) { /* headed for execve() */ - closefrom(def_closefrom); + int maxfd = def_closefrom; + dup2(sv[1], maxfd); + (void)fcntl(maxfd, F_SETFD, FD_CLOEXEC); + sv[1] = maxfd++; + closefrom(maxfd); #ifdef HAVE_SELINUX if (rbac_enabled) selinux_execve(path, argv, envp); diff --git a/exec_pty.c b/exec_pty.c index 0788a136f..37c4e31bd 100644 --- a/exec_pty.c +++ b/exec_pty.c @@ -104,7 +104,7 @@ static void flush_output __P((void)); static int exec_monitor __P((const char *path, char *argv[], char *envp[], int, int)); static void exec_pty __P((const char *path, char *argv[], - char *envp[], int)); + char *envp[], int, int *)); static RETSIGTYPE sigwinch __P((int s)); static void sync_ttysize __P((int src, int dst)); static void deliver_signal __P((pid_t pid, int signo)); @@ -780,7 +780,7 @@ exec_monitor(path, argv, envp, backchannel, rbac) restore_signals(); /* setup tty and exec command */ - exec_pty(path, argv, envp, rbac); + exec_pty(path, argv, envp, rbac, &errpipe[1]); cstat.type = CMD_ERRNO; cstat.val = errno; if (write(errpipe[1], &cstat, sizeof(cstat)) == -1) @@ -977,12 +977,14 @@ flush_output() * Returns only if execve() fails. */ static void -exec_pty(path, argv, envp, rbac_enabled) +exec_pty(path, argv, envp, rbac_enabled, errfd) const char *path; char *argv[]; char *envp[]; int rbac_enabled; + int *errfd; { + int maxfd = def_closefrom; pid_t self = getpid(); /* Set child process group here too to avoid a race. */ @@ -1010,7 +1012,10 @@ exec_pty(path, argv, envp, rbac_enabled) if (io_fds[SFD_STDERR] != io_fds[SFD_SLAVE]) close(io_fds[SFD_STDERR]); - closefrom(def_closefrom); + dup2(*errfd, maxfd); + (void)fcntl(maxfd, F_SETFD, FD_CLOEXEC); + *errfd = maxfd++; + closefrom(maxfd); #ifdef HAVE_SELINUX if (rbac_enabled) selinux_execve(path, argv, envp); -- 2.40.0