mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-07-15 20:59:25 +03:00
Close all non-stdio FDs in virt-login-shell (CVE-2013-4400)
We don't want to inherit any FDs in the new namespace except for the stdio FDs. Explicitly close them all, just in case some do not have the close-on-exec flag set. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
@ -313,6 +313,18 @@ main(int argc, char **argv)
|
|||||||
if (cpid == 0) {
|
if (cpid == 0) {
|
||||||
pid_t ccpid;
|
pid_t ccpid;
|
||||||
|
|
||||||
|
int openmax = sysconf(_SC_OPEN_MAX);
|
||||||
|
int fd;
|
||||||
|
if (openmax < 0) {
|
||||||
|
virReportSystemError(errno, "%s",
|
||||||
|
_("sysconf(_SC_OPEN_MAX) failed"));
|
||||||
|
return EXIT_FAILURE;
|
||||||
|
}
|
||||||
|
for (fd = 3; fd < openmax; fd++) {
|
||||||
|
int tmpfd = fd;
|
||||||
|
VIR_MASS_CLOSE(tmpfd);
|
||||||
|
}
|
||||||
|
|
||||||
/* Fork once because we don't want to affect
|
/* Fork once because we don't want to affect
|
||||||
* virt-login-shell's namespace itself
|
* virt-login-shell's namespace itself
|
||||||
*/
|
*/
|
||||||
|
Reference in New Issue
Block a user