]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MEDIUM: listeners: set O_CLOEXEC on the accepted FDs
authorWilliam Lallemand <wlallemand@haproxy.com>
Fri, 26 Oct 2018 12:47:44 +0000 (14:47 +0200)
committerWilly Tarreau <w@1wt.eu>
Sun, 28 Oct 2018 13:03:31 +0000 (14:03 +0100)
Set the O_CLOEXEC flag on the accept, useful to avoid an FD leak in the
master process, since it reexecutes itself during a reload

src/listener.c

index fb230692772a3f75e6a0534a7a315a0d9a94cf25..a730b18326a8728f7246ff8e59ad26d2b79f504c 100644 (file)
@@ -545,7 +545,7 @@ void listener_accept(int fd)
                /* with sockpair@ we don't want to do an accept */
                if (unlikely(l->addr.ss_family == AF_CUST_SOCKPAIR)) {
                        if ((cfd = recv_fd_uxst(fd)) != -1)
-                               fcntl(cfd, F_SETFL, O_NONBLOCK);
+                               fcntl(cfd, F_SETFL, O_NONBLOCK|O_CLOEXEC);
                } else
 
 #ifdef USE_ACCEPT4
@@ -553,12 +553,12 @@ void listener_accept(int fd)
                 * fallback to the legacy accept() + fcntl().
                 */
                if (unlikely(accept4_broken ||
-                       ((cfd = accept4(fd, (struct sockaddr *)&addr, &laddr, SOCK_NONBLOCK)) == -1 &&
+                       ((cfd = accept4(fd, (struct sockaddr *)&addr, &laddr, SOCK_NONBLOCK|SOCK_CLOEXEC)) == -1 &&
                        (errno == ENOSYS || errno == EINVAL || errno == EBADF) &&
                        (accept4_broken = 1))))
 #endif
                        if ((cfd = accept(fd, (struct sockaddr *)&addr, &laddr)) != -1)
-                               fcntl(cfd, F_SETFL, O_NONBLOCK);
+                               fcntl(cfd, F_SETFL, O_NONBLOCK|O_CLOEXEC);
 
                if (unlikely(cfd == -1)) {
                        switch (errno) {