From: Gary Lockyer <gary@catalyst.net.nz>
Date: Sun, 10 Dec 2017 20:31:33 +0000 (+1300)
Subject: lib/async_req/async_sock.c set socket close on exec
X-Git-Tag: talloc-2.1.11~153
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=8b3c58251146d2e982a6c9fdb3828ca65e307a96

lib/async_req/async_sock.c set socket close on exec

Set SOCKET_CLOEXEC on the sockets returned by accept.  This ensures that
the socket is unavailable to any child process created by system().
Making it harder for malicious code to set up a command channel,
as seen in the exploit for CVE-2015-0240

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/lib/async_req/async_sock.c b/lib/async_req/async_sock.c
index db3916e07e7..0a8a333f4f3 100644
--- a/lib/async_req/async_sock.c
+++ b/lib/async_req/async_sock.c
@@ -738,6 +738,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde,
 		tevent_req_error(req, errno);
 		return;
 	}
+	smb_set_close_on_exec(ret);
 	state->sock = ret;
 	tevent_req_done(req);
 }
diff --git a/lib/tevent/echo_server.c b/lib/tevent/echo_server.c
index 3b2122dac11..f93d8bcdee7 100644
--- a/lib/tevent/echo_server.c
+++ b/lib/tevent/echo_server.c
@@ -118,7 +118,7 @@ static void accept_handler(struct tevent_context *ev, struct tevent_fd *fde,
 		tevent_req_error(req, errno);
 		return;
 	}
-	smb_set_close_on_exec(state->listen_sock);
+	smb_set_close_on_exec(ret);
 	state->sock = ret;
 	tevent_req_done(req);
 }