<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Use close on exec flags instead of fcntl"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1104">1104</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Use close on exec flags instead of fcntl
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>CVS (please indicate timestamp)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>g.gupta@samsung.com
</td>
</tr></table>
<p>
<div>
<pre>Now in lateswt versions of glibc, close on exec flags are available for
file/socket open functions which are better than using fcntl.
Below is current usage of fcntl in iptables:
./libxtables/xtables.c: if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) {
./libxtables/xtables.c: if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
./libiptc/libiptc.c: if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
./extensions/libxt_set.h: if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1)
It can use O_CLOEXEC flag with open() system call & SOCK_CLOEXEC with socket()
call instead of using fcntl.
Please let me know if patch is required.
Refer:
<a href="http://man7.org/linux/man-pages/man2/open.2.html">http://man7.org/linux/man-pages/man2/open.2.html</a>
O_CLOEXEC (since Linux 2.6.23)
Enable the close-on-exec flag for the new file descriptor.
Specifying this flag permits a program to avoid additional
fcntl(2) F_SETFD operations to set the FD_CLOEXEC flag.
Note that the use of this flag is essential in some
multithreaded programs, because using a separate fcntl(2)
F_SETFD operation to set the FD_CLOEXEC flag does not suffice
to avoid race conditions where one thread opens a file
descriptor and attempts to set its close-on-exec flag using
fcntl(2) at the same time as another thread does a fork(2)
plus execve(2). Depending on the order of execution, the race
may lead to the file descriptor returned by open() being
unintentionally leaked to the program executed by the child
process created by fork(2). (This kind of race is in
principle possible for any system call that creates a file
descriptor whose close-on-exec flag should be set, and various
other Linux system calls provide an equivalent of the
O_CLOEXEC flag to deal with this problem.)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>