In reading about vfork, it is suggested that a vfork be followed
immediately with an exec. I'm trying to understand the possible
implications of a program that does a bunch of I/O redirection
in the child before the exec.
Here's a code fragment I wonder about:
= =
iop = NULL;
switch (pid = vfork()) {
case -1: /* error */
(void) close(pdes[0]);
(void) close(pdes[1]);
goto pfree;
/* NOTREACHED */
case 0: /* child */
if (*type == 'r') {
if (pdes[1] != 1) {
dup2(pdes[1], 1);
if (closestderr)
(void) close(2);
else
dup2(pdes[1], 2); /* stderr, too! */
(void) close(pdes[1]);
}
(void) close(pdes[0]);
} else {
if (pdes[0] != 0) {
dup2(pdes[0], 0);
(void) close(pdes[0]);
}
(void) close(pdes[1]);
}
for (i = 3; i < fds; i++)
close(i);
/* begin CERT suggested fixes */
close(0);
i = geteuid();
delay_signaling(); /* we can't allow any signals while euid==0: kinch */
seteuid(0);
setgid(getegid());
setuid(i);
enable_signaling(); /* we can allow signals once again: kinch */
/* end CERT suggested fixes */
execv(gargv[0], gargv);
_exit(1);
}
/* parent; assume fdopen can't fail... */
if (*type == 'r') {
iop = fdopen(pdes[0], type);
(void) close(pdes[1]);
} else {
iop = fdopen(pdes[1], type);
(void) close(pdes[0]);
}
pids[fileno(iop)] = pid;
= =
(This is from the wuftpd version wu-2.4.2-academ[BETA-12] in the ftpd_popen
routine in popen.c, for those who care about context.)
I'm concerned that all that messing about in the child will affect
the memory space of the parent too, since this is a vfork, but
I'm not sure exactly what is shared across a vfork.
Stuff using this code has bus errors and segmentation faults more
that I'd like so I'm looking for potentital memory clobbers.
--