kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

iucvterm/iucvtty: Ensure PTY and server fd's are closed at exec

Browse Source 
Check the return code of fcntl() calls to ensure the close-on-exec
setting succeeded.  Otherwise, the PTY and server file descriptors
would become available to the forked client process.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Hendrik Brueckner
2026-07-06 14:44:28 +02:00
committed by Jan Höppner
parent f67fa03581
commit 0c771423b4
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
iucvterm/src/iucvtty.c
View File

@@ -262,8 +262,13 @@ int main(int argc, char *argv[])
}
/* set close-on-exec for file descriptors */
fcntl(master, F_SETFD, FD_CLOEXEC);
fcntl(server, F_SETFD, FD_CLOEXEC);
if (fcntl(master, F_SETFD, FD_CLOEXEC) ||
fcntl(server, F_SETFD, FD_CLOEXEC)) {
print_error("Setting file controls failed");
close(server);
rc = 1;
goto exit_on_error;
}
/* syslog */
openlog(SYSLOG_IDENT, LOG_PID, LOG_AUTHPRIV);
@@ -276,6 +281,7 @@ int main(int argc, char *argv[])
client = accept(server, (struct sockaddr *) &caddr, &len);
if (client == -1) {
print_error("An incoming connection could not be accepted");
close(server);
rc = 2;
goto exit_on_error;
}
@@ -292,10 +298,14 @@ int main(int argc, char *argv[])
} else { /* client is allowed to connect */
syslog(LOG_INFO, "Accepted client connection from %s",
client_host);
/* set close-on-exec for client socket */
fcntl(client, F_SETFD, FD_CLOEXEC);
/* close server socket */
close(server);
/* set close-on-exec for client socket */
if (fcntl(client, F_SETFD, FD_CLOEXEC)) {
print_error("Setting file controls failed");
rc = 4;
goto exit_on_error;
}
/* setup signal handler to notify shutdown signal */
sigemptyset(&sigact.sa_mask);