build: Unconditionally nullify stdin for build scripts

When we run a build script, redirect its standard input to a newly
created pipe with no open writers. This makes the behaviour of build
scripts more robust against e. g. unsolicited interactivity (esp. if
inherited stdio points to a tty) and more reproducible.

build/build.c

@@ -216,6 +216,11 @@ fprintf(stderr, "*** addMacros\n");
 
     rpmMessage(RPMMESS_NORMAL, _("Executing(%s): %s\n"), name, buildCmd);
     if (!(child = fork())) {
+	if (rpm_nullify_input(STDIN_FILENO)) {
+		perror("rpm_nullify_stdin");
+		_exit(-1);
+	}
+
 	if ( rpm_close_all() ) {
 		perror( "rpm_close_all" );
 		_exit( -1 );

lib/closeall.c

@@ -31,3 +31,22 @@ int rpm_close_all (void)
 
 	return 0;
 }
+
+int rpm_nullify_input (int fdno) {
+	int null_pipe[2];
+	if (pipe(null_pipe) < 0) {
+		return -1;
+	}
+	if (close(null_pipe[1] < 0)) {
+		return -1;
+	}
+	if (null_pipe[0] != fdno) {
+		if (dup2(null_pipe[0], fdno) != fdno) {
+			return -1;
+		}
+		if (close(null_pipe[0]) < 0) {
+			return -1;
+		}
+	}
+	return 0;
+}

system.h

@@ -609,5 +609,6 @@ extern void unsetenv(const char *name);
 #endif
 
 extern int rpm_close_all (void);
+extern int rpm_nullify_input (int);
 
 #endif	/* H_SYSTEM */