diff options
| author | Paul Holzinger <pholzing@redhat.com> | 2023-02-07 16:10:46 +0100 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2023-02-12 23:42:34 +0100 |
| commit | 3487b5fc938f2f28653bec5ab8c412f5c135d300 (patch) | |
| tree | 0b5ea9929ab8874473583e6300d88b0698838a8c /contrib/apparmor | |
| parent | 7a8ed9459dfe803c529d61d3741d8d4f8f67ea92 (diff) | |
| download | passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar.gz passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar.bz2 passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar.lz passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar.xz passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.tar.zst passt-3487b5fc938f2f28653bec5ab8c412f5c135d300.zip | |
pasta: do not leak netlink sock into child
When spawning a child command with pasta command... pasta should not
leak fds that it opened. Only the fds that were already open should be
given to the child.
Run `pasta --config-net -- ls -l /proc/self/fd` from a terminal where
only stdin/out/err are open. The fd 3 was opend by ls to read the
/proc/self/fd dir. But fd 5 is the netlink socket that was opend in
pasta. To prevent such a leak we will open the socket with SOCK_CLOEXEC.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/apparmor')
0 files changed, 0 insertions, 0 deletions