passt, util: Close any open file that the parent might have leaked

If a parent accidentally or due to implementation reasons leaks any
open file, we don't want to have access to them, except for the file
passed via --fd, if any.

This is the case for Podman when Podman's parent leaks files into
Podman: it's not practical for Podman to close unrelated files before
starting pasta, as reported by Paul.

Use close_range(2) to close all open files except for standard streams
and the one from --fd.

Given that parts of conf() depend on other files to be already opened,
such as the epoll file descriptor, we can't easily defer this to a
more convenient point, where --fd was already parsed. Introduce a
minimal, duplicate version of --fd parsing to keep this simple.

As we need to check that the passed --fd option doesn't exceed
INT_MAX, because we'll parse it with strtol() but file descriptor
indices are signed ints (regardless of the arguments close_range()
take), extend the existing check in the actual --fd parsing in conf(),
also rejecting file descriptors numbers that match standard streams,
while at it.

Suggested-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Paul Holzinger <pholzing@redhat.com>

1 files changed, 6 insertions, 2 deletions

diff --git a/conf.c b/conf.c
index 14d8ece..2f5d649 100644
--- a/conf.c
+++ b/conf.c
@@ -1245,6 +1245,7 @@ void conf(struct ctx *c, int argc, char **argv)
 	const char *optstring;
 	size_t logsize = 0;
 	char *runas = NULL;
+	long fd_tap_opt;
 	int name, ret;
 	uid_t uid;
 	gid_t gid;
@@ -1260,6 +1261,7 @@ void conf(struct ctx *c, int argc, char **argv)
 	c->tcp.fwd_in.mode = c->tcp.fwd_out.mode = FWD_UNSET;
 	c->udp.fwd_in.mode = c->udp.fwd_out.mode = FWD_UNSET;
 
+	optind = 1;
 	do {
 		name = getopt_long(argc, argv, optstring, options, NULL);
 
@@ -1424,11 +1426,13 @@ void conf(struct ctx *c, int argc, char **argv)
 			break;
 		case 'F':
 			errno = 0;
-			c->fd_tap = strtol(optarg, NULL, 0);
+			fd_tap_opt = strtol(optarg, NULL, 0);
 
-			if (c->fd_tap < 0 || errno)
+			if (errno ||
+			    fd_tap_opt <= STDERR_FILENO || fd_tap_opt > INT_MAX)
 				die("Invalid --fd: %s", optarg);
 
+			c->fd_tap = fd_tap_opt;
 			c->one_off = true;
 			*c->sock_path = 0;
 			break;