s4-socket: use set_close_on_exec()

this prevents a fd leak to child processes

2 files changed, 8 insertions, 0 deletions

diff --git a/source4/lib/socket/socket_ip.c b/source4/lib/socket/socket_ip.c
index cab51beafb..d2d57798d4 100644
--- a/source4/lib/socket/socket_ip.c
+++ b/source4/lib/socket/socket_ip.c
@@ -50,6 +50,8 @@ static NTSTATUS ipv4_init(struct socket_context *sock)
 		return map_nt_error_from_unix_common(errno);
 	}
 
+	set_close_on_exec(sock->fd);
+
 	sock->backend_name = "ipv4";
 	sock->family = AF_INET;
 
@@ -610,6 +612,8 @@ static NTSTATUS ipv6_init(struct socket_context *sock)
 		return map_nt_error_from_unix_common(errno);
 	}
 
+	set_close_on_exec(sock->fd);
+
 	sock->backend_name = "ipv6";
 	sock->family = AF_INET6;
 
diff --git a/source4/lib/socket/socket_unix.c b/source4/lib/socket/socket_unix.c
index d492f01268..ab9b06df1b 100644
--- a/source4/lib/socket/socket_unix.c
+++ b/source4/lib/socket/socket_unix.c
@@ -59,6 +59,8 @@ static NTSTATUS unixdom_init(struct socket_context *sock)
 
 	sock->backend_name = "unix";
 
+	set_close_on_exec(sock->fd);
+
 	return NT_STATUS_OK;
 }
 
@@ -198,6 +200,8 @@ static NTSTATUS unixdom_accept(struct socket_context *sock,
 		}
 	}
 
+	set_close_on_exec(new_fd);
+
 	(*new_sock) = talloc(NULL, struct socket_context);
 	if (!(*new_sock)) {
 		close(new_fd);