mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
source3/lib/server_prefork.c set socket close on exec
Set SOCKET_CLOEXEC on the sockets returned by accept. This ensures that the socket is unavailable to any child process created by system(). Making it harder for malicious code to set up a command channel, as seen in the exploit for CVE-2015-0240 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
parent
3a504d48c3
commit
215d6089c3
@ -620,6 +620,7 @@ static void prefork_listen_accept_handler(struct tevent_context *ev,
|
||||
state->error, strerror(state->error)));
|
||||
goto done;
|
||||
}
|
||||
smb_set_close_on_exec(sd);
|
||||
|
||||
state->accept_fd = sd;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user