From: Paul Eggert Date: Wed, 9 May 2018 18:34:28 +0000 (-0700) Subject: af_alg: don’t leak file descriptors into children X-Git-Tag: v1.0~5632 X-Git-Url: https://gitweb.git.savannah.gnu.org/gitweb/?a=commitdiff_plain;h=842c754d2bb21b0dbb9bd2ad5fd87d94a81b2aeb;p=gnulib.git af_alg: don’t leak file descriptors into children * lib/af_alg.c (alg_socket): Use SOCK_CLOEXEC when creating sockets. This code should be compiled only on recent GNU/Linux platforms so we shouldn’t have to also depend on the accept4 module. --- diff --git a/ChangeLog b/ChangeLog index c4e155392f..818d3a6020 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,10 @@ 2018-05-09 Paul Eggert + af_alg: don’t leak file descriptors into children + * lib/af_alg.c (alg_socket): Use SOCK_CLOEXEC when creating sockets. + This code should be compiled only on recent GNU/Linux platforms + so we shouldn’t have to also depend on the accept4 module. + af_alg: coalesce socket creation * lib/af_alg.c (alg_socket): New function. (afalg_buffer, afalg_stream): Use it. This avoids some diff --git a/lib/af_alg.c b/lib/af_alg.c index ca3dd03235..c85140a335 100644 --- a/lib/af_alg.c +++ b/lib/af_alg.c @@ -49,11 +49,11 @@ alg_socket (char const *alg) if (i == sizeof salg.salg_name - 1) return -EINVAL; - int cfd = socket (AF_ALG, SOCK_SEQPACKET, 0); + int cfd = socket (AF_ALG, SOCK_SEQPACKET | SOCK_CLOEXEC, 0); if (cfd < 0) return -EAFNOSUPPORT; int ofd = (bind (cfd, (struct sockaddr *) &salg, sizeof salg) == 0 - ? accept (cfd, NULL, 0) + ? accept4 (cfd, NULL, 0, SOCK_CLOEXEC) : -1); close (cfd); return ofd < 0 ? -EAFNOSUPPORT : ofd;