On 03/23/2010 06:31 PM, David Lutterkort wrote:
On Thu, 2010-03-18 at 01:00 -0400, Laine Stump wrote:
> The original run_program simply called system(3), which was expedient,
> but failed to do things like close open file descriptors prior to
> exec'ing the child binary. This particular omission caused complaints
> when SELinux audited for leaked file descriptors during exec.
>
> The new run program does the fork/exec manually, and in between it
> closes all open file descriptors in the child process, as well as
> clearing and restoring the signal mask to prevent a potential race
> condition when killing off the parent's signal handlers in the child
> process.
>
> The code was heavily inspired by virRun() in libvirt, but is greatly
> simplified, since netcf doesn't (currently) need all the facilities of
> virRun().
> ---
> configure.ac | 7 +++
> src/netcf.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
> 2 files changed, 133 insertions(+), 13 deletions(-)
>
ACK, good stuff. Some minor nits:
Thanks. I made your suggested changes and pushed.
Is there anything you have waiting in the wings that you want in "the
next release"? Now would probably be a good time for us to do a release,
since this patch fixes a couple of outstanding Fedora selinux-related
bugs...