|
 |
997411a |
Patches by Paul Howarth
|
|
|
997411a |
https://bugzilla.redhat.com/show_bug.cgi?id=485426
|
|
|
997411a |
|
|
|
997411a |
--- sendmail-8.14.3/sendmail/milter.c 2008-09-19 15:51:03.000000000 +0100
|
|
|
997411a |
+++ sendmail-8.14.3/sendmail/milter.c 2008-09-19 16:37:57.000000000 +0100
|
|
|
997411a |
@@ -30,6 +30,9 @@
|
|
|
997411a |
|
|
|
997411a |
# include <sm/fdset.h>
|
|
|
997411a |
|
|
|
997411a |
+# include <unistd.h>
|
|
|
997411a |
+# include <fcntl.h>
|
|
|
997411a |
+
|
|
|
997411a |
static void milter_connect_timeout __P((int));
|
|
|
997411a |
static void milter_error __P((struct milter *, ENVELOPE *));
|
|
|
997411a |
static int milter_open __P((struct milter *, bool, ENVELOPE *));
|
|
|
997411a |
@@ -650,6 +653,7 @@
|
|
|
997411a |
SOCKADDR_LEN_T addrlen = 0;
|
|
|
997411a |
int addrno = 0;
|
|
|
997411a |
int save_errno;
|
|
|
997411a |
+ int fdflags;
|
|
|
997411a |
char *p;
|
|
|
997411a |
char *colon;
|
|
|
997411a |
char *at;
|
|
|
997411a |
@@ -1186,6 +1190,21 @@
|
|
|
997411a |
(char *)&nodelay, sizeof(nodelay));
|
|
|
997411a |
}
|
|
|
997411a |
# endif /* MILTER_NO_NAGLE && !defined(TCP_CORK) */
|
|
|
997411a |
+
|
|
|
997411a |
+ /*
|
|
|
997411a |
+ ** Need to set close-on-exec for sock to prevent it
|
|
|
997411a |
+ ** leaking to the local delivery process
|
|
|
997411a |
+ */
|
|
|
997411a |
+ if ((fdflags = fcntl(sock, F_GETFD, 0)) == -1 ||
|
|
|
997411a |
+ fcntl(sock, F_SETFD, fdflags | FD_CLOEXEC) == -1)
|
|
|
997411a |
+ {
|
|
|
997411a |
+ save_errno = errno;
|
|
|
997411a |
+ if (MilterLogLevel > 0)
|
|
|
997411a |
+ sm_syslog(LOG_WARNING, e->e_id,
|
|
|
997411a |
+ "Milter (%s): Unable to set close-on-exec on sock (%s)",
|
|
|
997411a |
+ m->mf_name, sm_errstring(save_errno = errno));
|
|
|
997411a |
+ }
|
|
|
997411a |
+
|
|
|
997411a |
return sock;
|
|
|
997411a |
}
|
|
|
997411a |
|
|
|
997411a |
--- sendmail-8.14.3/libmilter/listener.c 2007-04-23 23:22:50.000000000 +0100
|
|
|
997411a |
+++ sendmail-8.14.3/libmilter/listener.c 2008-06-18 16:36:38.000000000 +0100
|
|
|
997411a |
@@ -728,6 +728,7 @@
|
|
|
997411a |
int acnt = 0; /* error count for accept() failures */
|
|
|
997411a |
int scnt = 0; /* error count for select() failures */
|
|
|
997411a |
int save_errno = 0;
|
|
|
997411a |
+ int fdflags;
|
|
|
997411a |
#if !_FFR_WORKERS_POOL
|
|
|
997411a |
sthread_t thread_id;
|
|
|
997411a |
#endif /* !_FFR_WORKERS_POOL */
|
|
|
997411a |
@@ -807,6 +808,19 @@
|
|
|
997411a |
(void) smutex_unlock(&L_Mutex);
|
|
|
997411a |
|
|
|
997411a |
/*
|
|
|
997411a |
+ ** Need to set close-on-exec for connfd in case a user's
|
|
|
997411a |
+ ** filter starts other applications
|
|
|
997411a |
+ */
|
|
|
997411a |
+ if ((fdflags = fcntl(connfd, F_GETFD, 0)) == -1 ||
|
|
|
997411a |
+ fcntl(connfd, F_SETFD, fdflags | FD_CLOEXEC) == -1)
|
|
|
997411a |
+ {
|
|
|
997411a |
+ smi_log(SMI_LOG_WARN,
|
|
|
997411a |
+ "%s: Unable to set close-on-exec on connfd (%s)",
|
|
|
997411a |
+ smfi->xxfi_name, sm_errstring(errno));
|
|
|
997411a |
+ /* XXX: continue? */
|
|
|
997411a |
+ }
|
|
|
997411a |
+
|
|
|
997411a |
+ /*
|
|
|
997411a |
** If remote side closes before accept() finishes,
|
|
|
997411a |
** sockaddr might not be fully filled in.
|
|
|
997411a |
*/
|