diff --git a/exile.c b/exile.c index a9d5e71..7b9449e 100644 --- a/exile.c +++ b/exile.c @@ -388,10 +388,10 @@ int exile_append_syscall_policy(struct exile_policy *exile_policy, long syscall, newpolicy->argfilters[i] = argfilters[i]; } newpolicy->next = NULL; - + *(exile_policy->syscall_policies_tail) = newpolicy; exile_policy->syscall_policies_tail = &(newpolicy->next); - + exile_policy->disable_syscall_filter = 0; return 0; } @@ -1446,7 +1446,20 @@ static void close_file_fds() long max_files = sysconf(_SC_OPEN_MAX); for(long i = 3; i <= max_files; i++) { - close((int)i); + struct stat statbuf; + int fd = (int) max_files; + int result = fstat(i, &statbuf); + if(result == -1 && errno != EBADF && errno != EACCES) + { + EXILE_LOG_ERROR("Could not fstat %i: %s\n", fd, strerror(errno)); + abort(); + } + int type = statbuf.st_mode & S_IFMT; + if(type != S_IFIFO && type != S_IFSOCK) + { + /* No error check, retrying not recommended */ + close(fd); + } } } @@ -1509,6 +1522,11 @@ int exile_enable_policy(struct exile_policy *policy) return -EINVAL; } + if(policy->keep_fds_open != 1) + { + close_file_fds(); + } + if(enter_namespaces(policy->namespace_options) < 0) { EXILE_LOG_ERROR("Error while trying to enter namespaces\n"); diff --git a/exile.h b/exile.h index 4898f17..76d7248 100644 --- a/exile.h +++ b/exile.h @@ -364,6 +364,7 @@ struct exile_policy int no_new_privs; int no_fs; int no_new_fds; + int keep_fds_open; int namespace_options; int disable_syscall_filter; /* Bind mounts all paths in path_policies into the chroot and applies