From d581c9d284e7c635b0379d57e95cb32e682f0f02 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Wed, 30 Nov 2011 15:18:08 +1100 Subject: genrand: use set_close_on_exec() this prevents a fd leak to child processes --- lib/util/genrand.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/util/genrand.c b/lib/util/genrand.c index 7fe55f345e..b8d3c78fa1 100644 --- a/lib/util/genrand.c +++ b/lib/util/genrand.c @@ -172,6 +172,9 @@ static int do_reseed(bool use_fd, int fd) if (use_fd) { if (fd == -1) { fd = open( "/dev/urandom", O_RDONLY,0); + if (fd != -1) { + set_close_on_exec(fd); + } } if (fd != -1 && (read(fd, seed_inbuf, sizeof(seed_inbuf)) == sizeof(seed_inbuf))) { @@ -232,6 +235,9 @@ _PUBLIC_ void generate_random_buffer(uint8_t *out, int len) if (bytes_since_reseed < 40) { if (urand_fd == -1) { urand_fd = open( "/dev/urandom", O_RDONLY,0); + if (urand_fd != -1) { + set_close_on_exec(urand_fd); + } } if(urand_fd != -1 && (read(urand_fd, out, len) == len)) { return; @@ -269,6 +275,9 @@ _PUBLIC_ void generate_secret_buffer(uint8_t *out, int len) { if (urand_fd == -1) { urand_fd = open( "/dev/urandom", O_RDONLY,0); + if (urand_fd != -1) { + set_close_on_exec(urand_fd); + } } if(urand_fd != -1 && (read(urand_fd, out, len) == len)) { return; -- cgit