From: Volker Lendecke <vl@samba.org>
Date: Fri, 22 Jan 2021 10:15:41 +0000 (+0100)
Subject: rpc_server: Add CLOEXEC to the listening sockets
X-Git-Tag: tevent-0.11.0~1982
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=17a8fa6d242ee9c898a1fdb5ab340223702fcced;p=thirdparty%2Fsamba.git

rpc_server: Add CLOEXEC to the listening sockets

We don't want to leak them into exec'ed processes.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 26 01:13:53 UTC 2021 on sn-devel-184
---

diff --git a/source3/rpc_server/rpc_sock_helper.c b/source3/rpc_server/rpc_sock_helper.c
index 7bd929db96d..4b998962c8e 100644
--- a/source3/rpc_server/rpc_sock_helper.c
+++ b/source3/rpc_server/rpc_sock_helper.c
@@ -347,7 +347,7 @@ NTSTATUS dcesrv_create_binding_sockets(
 	int **pfds)
 {
 	enum dcerpc_transport_t transport = dcerpc_binding_get_transport(b);
-	size_t num_fds = 1;
+	size_t i, num_fds = 1;
 	int *fds = NULL;
 	NTSTATUS status;
 
@@ -379,6 +379,21 @@ NTSTATUS dcesrv_create_binding_sockets(
 		return status;
 	}
 
+	for (i=0; i<num_fds; i++) {
+		bool ok = smb_set_close_on_exec(fds[i]);
+		if (!ok) {
+			status = map_nt_error_from_unix(errno);
+			break;
+		}
+	}
+	if (i < num_fds) {
+		for (i=0; i<num_fds; i++) {
+			close(fds[i]);
+		}
+		TALLOC_FREE(fds);
+		return status;
+	}
+
 	*pfds = fds;
 	*pnum_fds = num_fds;
 	return NT_STATUS_OK;