[netcf-devel] [PATCH] Improved run_program

Laine Stump laine at laine.org
Tue Apr 6 04:20:38 UTC 2010


On 03/23/2010 06:31 PM, David Lutterkort wrote:
> On Thu, 2010-03-18 at 01:00 -0400, Laine Stump wrote:
>    
>> The original run_program simply called system(3), which was expedient,
>> but failed to do things like close open file descriptors prior to
>> exec'ing the child binary. This particular omission caused complaints
>> when SELinux audited for leaked file descriptors during exec.
>>
>> The new run program does the fork/exec manually, and in between it
>> closes all open file descriptors in the child process, as well as
>> clearing and restoring the signal mask to prevent a potential race
>> condition when killing off the parent's signal handlers in the child
>> process.
>>
>> The code was heavily inspired by virRun() in libvirt, but is greatly
>> simplified, since netcf doesn't (currently) need all the facilities of
>> virRun().
>> ---
>>   configure.ac |    7 +++
>>   src/netcf.c  |  139 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
>>   2 files changed, 133 insertions(+), 13 deletions(-)
>>      
> ACK, good stuff. Some minor nits:
>    

Thanks. I made your suggested changes and pushed.

Is there anything you have waiting in the wings that you want in "the 
next release"? Now would probably be a good time for us to do a release, 
since this patch fixes a couple of outstanding Fedora selinux-related 
bugs...


More information about the netcf-devel mailing list