run-command: add close_fd_above_stderr option

Add a close_fd_above_stderr flag to struct child_process.  When set,
the child closes file descriptors 3 and above between fork and exec
(skipping the child-notifier pipe), capped at sysconf(_SC_OPEN_MAX)
or 4096, whichever is smaller.  This prevents the child from
inheriting pipe endpoints or other descriptors from the parent
environment (e.g., the test harness).

Signed-off-by: Paul Tarjan <github@paulisageek.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/run-command.c b/run-command.c
index e3e02475ccec50163865d571902b18ba2e339a36..f4361906c9b0e552997a829c7155f493f6388573 100644 (file)
--- a/run-command.c
+++ b/run-command.c
@@ -546,6 +546,7 @@ static void atfork_parent(struct atfork_state *as)
                "restoring signal mask");
 #endif
 }
+
 #endif /* GIT_WINDOWS_NATIVE */
 
 static inline void set_cloexec(int fd)
@@ -832,6 +833,17 @@ fail_pipe:
                        child_close(cmd->out);
                }
 
+               if (cmd->close_fd_above_stderr) {
+                       long max_fd = sysconf(_SC_OPEN_MAX);
+                       int fd;
+                       if (max_fd < 0 || max_fd > 4096)
+                               max_fd = 4096;
+                       for (fd = 3; fd < max_fd; fd++) {
+                               if (fd != child_notifier)
+                                       close(fd);
+                       }
+               }
+
                if (cmd->dir && chdir(cmd->dir))
                        child_die(CHILD_ERR_CHDIR);
 

diff --git a/run-command.h b/run-command.h
index 0df25e445f001cebf0d5ac33d7e6dbe3f779aa6e..fdaa01e140705f5ed3761d88ec6f6487a9b877ed 100644 (file)
--- a/run-command.h
+++ b/run-command.h
@@ -141,6 +141,15 @@ struct child_process {
        unsigned stdout_to_stderr:1;
        unsigned clean_on_exit:1;
        unsigned wait_after_clean:1;
+
+       /**
+        * Close file descriptors 3 and above in the child after forking
+        * but before exec.  This prevents the child from inheriting
+        * pipe endpoints or other descriptors from the parent
+        * environment (e.g., the test harness).
+        */
+       unsigned close_fd_above_stderr:1;
+
        void (*clean_on_exit_handler)(struct child_process *process);
 };