set FD_CLOEXEC on opened file descriptors

3 files changed, 18 insertions, 4 deletions

diff --git a/accel-pppd/ppp/ipv6cp_opt_intfid.c b/accel-pppd/ppp/ipv6cp_opt_intfid.c
index 2e7f67d8..0d3d7513 100644
--- a/accel-pppd/ppp/ipv6cp_opt_intfid.c
+++ b/accel-pppd/ppp/ipv6cp_opt_intfid.c
@@ -37,8 +37,6 @@ struct in6_ifreq {
         int             ifr6_ifindex; 
 };
 
-static int urandom_fd;
-
 static struct ipv6cp_option_t *ipaddr_init(struct ppp_ipv6cp_t *ipv6cp);
 static void ipaddr_free(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_option_t *opt);
 static int ipaddr_send_conf_req(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_option_t *opt, uint8_t *ptr);
@@ -394,8 +392,6 @@ static void init()
 	if (sock6_fd < 0)
 		return;
 
-	urandom_fd = open("/dev/urandom", O_RDONLY);
-
 	ipv6cp_option_register(&ipaddr_opt_hnd);
 	load_config();
 	triton_event_register_handler(EV_CONFIG_RELOAD, (triton_event_func)load_config);
diff --git a/accel-pppd/ppp/ppp.c b/accel-pppd/ppp/ppp.c
index acda84e9..3ab71662 100644
--- a/accel-pppd/ppp/ppp.c
+++ b/accel-pppd/ppp/ppp.c
@@ -33,6 +33,7 @@ __export LIST_HEAD(ppp_list);
 
 int __export sock_fd;
 int __export sock6_fd;
+int __export urandom_fd;
 
 int __export ppp_shutdown;
 
@@ -102,6 +103,8 @@ int __export establish_ppp(struct ppp_t *ppp)
 		log_ppp_error("open(chan) /dev/ppp: %s\n", strerror(errno));
 		return -1;
 	}
+	
+	fcntl(ppp->chan_fd, F_SETFD, fcntl(ppp->chan_fd, F_GETFD) | FD_CLOEXEC);
 
 	if (ioctl(ppp->chan_fd, PPPIOCATTCHAN, &ppp->chan_idx) < 0) {
 		log_ppp_error("ioctl(PPPIOCATTCHAN): %s\n", strerror(errno));
@@ -113,6 +116,8 @@ int __export establish_ppp(struct ppp_t *ppp)
 		log_ppp_error("open(unit) /dev/ppp: %s\n", strerror(errno));
 		goto exit_close_chan;
 	}
+	
+	fcntl(ppp->unit_fd, F_SETFD, fcntl(ppp->unit_fd, F_GETFD) | FD_CLOEXEC);
 
 	ppp->unit_idx = -1;
 	if (ioctl(ppp->unit_fd, PPPIOCNEWUNIT, &ppp->unit_idx) < 0) {
@@ -756,10 +761,22 @@ static void init(void)
 		perror("socket");
 		_exit(EXIT_FAILURE);
 	}
+	
+	fcntl(sock_fd, F_SETFD, fcntl(sock_fd, F_GETFD) | FD_CLOEXEC);
 
 	sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0);
 	if (sock6_fd < 0)
 		log_warn("ppp: kernel doesn't support ipv6\n");
+	else
+		fcntl(sock6_fd, F_SETFD, fcntl(sock6_fd, F_GETFD) | FD_CLOEXEC);
+
+	urandom_fd = open("/dev/urandom", O_RDONLY);
+	if (urandom_fd < 0) {
+		log_emerg("failed to open /dev/urandom: %s\n", strerror(errno));
+		return;
+	}
+	
+	fcntl(urandom_fd, F_SETFD, fcntl(urandom_fd, F_GETFD) | FD_CLOEXEC);
 
 	opt = conf_get_opt("ppp", "seq-file");
 	if (!opt)
diff --git a/accel-pppd/ppp/ppp.h b/accel-pppd/ppp/ppp.h
index 3ec15d9e..bb308899 100644
--- a/accel-pppd/ppp/ppp.h
+++ b/accel-pppd/ppp/ppp.h
@@ -203,4 +203,5 @@ extern struct ppp_stat_t ppp_stat;
 
 extern int sock_fd; // internet socket for ioctls
 extern int sock6_fd; // internet socket for ioctls
+extern int urandom_fd;
 #endif