From patchwork Wed Mar 21 10:52:00 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Maciej_=C5=BBenczykowski?= X-Patchwork-Id: 147962 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 7680CB6F9D for ; Wed, 21 Mar 2012 21:52:27 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758141Ab2CUKwY (ORCPT ); Wed, 21 Mar 2012 06:52:24 -0400 Received: from mail-pz0-f51.google.com ([209.85.210.51]:56499 "EHLO mail-pz0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752980Ab2CUKwX (ORCPT ); Wed, 21 Mar 2012 06:52:23 -0400 Received: by dady9 with SMTP id y9so1358620dad.10 for ; Wed, 21 Mar 2012 03:52:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:mime-version :content-type:content-transfer-encoding; bh=P4RntUZBdZhD3yCfEL+1BTrXB6DcHq3KSa0e5kVqXp0=; b=l9A7V2Z8QN+/Z1W+eWWQAAm9e9OqqAWa/nb+bujc+Q/6T0tw4bGfqfeCOcgNu6vnH8 RgPS67m0JRS2dTRG54l3+9Wj5/XxYhPCM0DAQKuUbLag9CtbQbxsjmEqiQzKU6h0lIyC /ybUpqEHybWlgh6dLIOTZdzzSZ+rCyYVtXs6rUi8NPOf2lrsRNGPJ9m2ZQqpM5q0rBwD /Bjh295fOMeqIlds3C+XA7b8HjDwKnzOLUZ/gItCGMECHYd5UktjAVfkv9ossRTJu1O6 WDBFibiVcQKPdx2rFAWz24HmndMFnepFA4ek4xjuRGqW0ZyFgc8nAhptO1lGc7FhkCXR yrVA== Received: by 10.68.234.41 with SMTP id ub9mr9782190pbc.106.1332327143275; Wed, 21 Mar 2012 03:52:23 -0700 (PDT) Received: from sugar.mtv.corp.google.com (sugar.mtv.corp.google.com [172.22.97.53]) by mx.google.com with ESMTPS id h10sm1156034pbe.12.2012.03.21.03.52.21 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 21 Mar 2012 03:52:22 -0700 (PDT) From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= To: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Cc: netfilter-devel@vger.kernel.org Subject: [PATCH] mark newly opened fds as FD_CLOEXEC (close on exec) [part 2] Date: Wed, 21 Mar 2012 03:52:00 -0700 Message-Id: <1332327120-22444-1-git-send-email-zenczykowski@gmail.com> X-Mailer: git-send-email 1.7.7.3 MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Maciej Żenczykowski This is iptables-1.4.11-cloexec.patch from Fedora 18 iptables source rpm, in particular: http://kojipkgs.fedoraproject.org/packages/iptables/1.4.12.2/4.fc18/src/iptables-1.4.12.2-4.fc18.src.rpm Signed-off-by: Maciej Żenczykowski --- extensions/libxt_set.h | 7 +++++++ libiptc/libiptc.c | 8 ++++++++ 2 files changed, 15 insertions(+), 0 deletions(-) diff --git a/extensions/libxt_set.h b/extensions/libxt_set.h index 4ac84fa9c022..47c3f5b6f5d4 100644 --- a/extensions/libxt_set.h +++ b/extensions/libxt_set.h @@ -2,6 +2,7 @@ #define _LIBXT_SET_H #include +#include #include #include #include @@ -23,6 +24,12 @@ get_version(unsigned *version) xtables_error(OTHER_PROBLEM, "Can't open socket to ipset.\n"); + if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { + xtables_error(OTHER_PROBLEM, + "Could not set close on exec: %s\n", + strerror(errno)); + } + req_version.op = IP_SET_OP_VERSION; res = getsockopt(sockfd, SOL_IP, SO_IP_SET, &req_version, &size); if (res != 0) diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c index 13e41d525f28..63965e738596 100644 --- a/libiptc/libiptc.c +++ b/libiptc/libiptc.c @@ -29,6 +29,8 @@ * - performance work: speedup initial ruleset parsing. * - sponsored by ComX Networks A/S (http://www.comx.dk/) */ +#include +#include #include #include #include @@ -1316,6 +1318,12 @@ TC_INIT(const char *tablename) if (sockfd < 0) return NULL; + if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { + fprintf(stderr, "Could not set close on exec: %s\n", + strerror(errno)); + abort(); + } + retry: s = sizeof(info);