From 0c771423b49c236ff3960a4361ab7e7db710a492 Mon Sep 17 00:00:00 2001 From: Hendrik Brueckner Date: Mon, 6 Jul 2026 14:44:28 +0200 Subject: [PATCH] iucvterm/iucvtty: Ensure PTY and server fd's are closed at exec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Check the return code of fcntl() calls to ensure the close-on-exec setting succeeded. Otherwise, the PTY and server file descriptors would become available to the forked client process. Reviewed-by: Steffen Eiden Signed-off-by: Hendrik Brueckner Signed-off-by: Jan Höppner --- iucvterm/src/iucvtty.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/iucvterm/src/iucvtty.c b/iucvterm/src/iucvtty.c index 8937c522..1aeb727e 100644 --- a/iucvterm/src/iucvtty.c +++ b/iucvterm/src/iucvtty.c @@ -262,8 +262,13 @@ int main(int argc, char *argv[]) } /* set close-on-exec for file descriptors */ - fcntl(master, F_SETFD, FD_CLOEXEC); - fcntl(server, F_SETFD, FD_CLOEXEC); + if (fcntl(master, F_SETFD, FD_CLOEXEC) || + fcntl(server, F_SETFD, FD_CLOEXEC)) { + print_error("Setting file controls failed"); + close(server); + rc = 1; + goto exit_on_error; + } /* syslog */ openlog(SYSLOG_IDENT, LOG_PID, LOG_AUTHPRIV); @@ -276,6 +281,7 @@ int main(int argc, char *argv[]) client = accept(server, (struct sockaddr *) &caddr, &len); if (client == -1) { print_error("An incoming connection could not be accepted"); + close(server); rc = 2; goto exit_on_error; } @@ -292,10 +298,14 @@ int main(int argc, char *argv[]) } else { /* client is allowed to connect */ syslog(LOG_INFO, "Accepted client connection from %s", client_host); - /* set close-on-exec for client socket */ - fcntl(client, F_SETFD, FD_CLOEXEC); /* close server socket */ close(server); + /* set close-on-exec for client socket */ + if (fcntl(client, F_SETFD, FD_CLOEXEC)) { + print_error("Setting file controls failed"); + rc = 4; + goto exit_on_error; + } /* setup signal handler to notify shutdown signal */ sigemptyset(&sigact.sa_mask);