Set close-on-exec flag in most places where file descriptors are

opened in our libraries (in case another application thread spawns a
new process) and in the KDC programs (in case a plugin library spawns
a new process).

Checked calls to: open fopen THREEPARAMOPEN mkstemp socket accept dup
dup2 pipe.  In: util lib plugins kdc kadmin/server krb524.

The various programs are less critical than the libraries, as any
well-written plugin that spawns a new process should close all file
descriptors it doesn't need to communicate with the new process.

This approach also isn't bulletproof, as the call to set the
close-on-exec flag is necessarily a separate call from creating the
file descriptor, and the fork call could happen in between them.  So
plugins should be careful regardless of this patch; it will only
reduce the window of potential lossage should a plugin be poorly
written.  (AFAIK there are currently no plugins that spawn processes
where this would be a problem.)

Update dependencies.

ticket: 5561

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20143 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 3 insertions, 0 deletions

diff --git a/src/kdc/network.c b/src/kdc/network.c
index dc21e1d77..266c6aa83 100644
--- a/src/kdc/network.c
+++ b/src/kdc/network.c
@@ -402,6 +402,7 @@ setup_a_tcp_listener(struct socksetup *data, struct sockaddr *addr)
 		paddr(addr));
 	return -1;
     }
+    set_cloexec_fd(sock);
     if (sock > FD_SETSIZE) {
 	close(sock);
 	com_err(data->prog, 0, "TCP socket fd number %d (for %s) too high",
@@ -606,6 +607,7 @@ setup_udp_port_1(struct socksetup *data, struct sockaddr *addr,
 		    port, haddrbuf);
 	    return 1;
 	}
+	set_cloexec_fd(sock);
 #ifdef KRB5_USE_INET6
 	if (addr->sa_family == AF_INET6) {
 #ifdef IPV6_V6ONLY
@@ -1110,6 +1112,7 @@ static void accept_tcp_connection(struct connection *conn, const char *prog,
     s = accept(conn->fd, addr, &addrlen);
     if (s < 0)
 	return;
+    set_cloexec_fd(s);
     if (s > FD_SETSIZE) {
 	close(s);
 	return;