Commit 8142d161 authored by Simon McVittie's avatar Simon McVittie

audit: make the first few fds close-on-exec

libcap-ng < 0.7.7 leaks one non-close-on-exec fd during initialization.
test-bus asserts that all fds beyond 2 passed to an executed subprocess
have the close-on-exec flag set, which will fail at that leaked fd.

This was unnoticed until commit 517c4685, because libaudit was
previously only initialized if we were configured to switch uid,
which the regression tests do not do; the system bus is normally
the only place that happens, but the system bus is not normally
run with the "embedded tests" enabled (since they are bad
for performance and security).

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=91684Reviewed-by: Philip Withnall's avatarPhilip Withnall <philip.withnall@collabora.co.uk>
parent 0a0206d9
......@@ -52,8 +52,15 @@ void
bus_audit_init (BusContext *context)
{
#ifdef HAVE_LIBAUDIT
int i;
capng_get_caps_process ();
/* Work around a bug in libcap-ng < 0.7.7: it leaks a fd, which isn't
* close-on-exec. Assume it will be one of the first few fds. */
for (i = 3; i < 42; i++)
_dbus_fd_set_close_on_exec (i);
if (!capng_have_capability (CAPNG_EFFECTIVE, CAP_AUDIT_WRITE))
return;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment