|
 |
ca1eb8 |
From a195869e527df27451bee8b68108abd005976b2d Mon Sep 17 00:00:00 2001
|
|
|
ca1eb8 |
From: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
ca1eb8 |
Date: Tue, 31 Jul 2018 21:03:38 +0000
|
|
|
ca1eb8 |
Subject: [PATCH] SSS_CERT: Close file descriptors after executing p11_child
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
We can call cert_to_ssh_key_step from cert_to_ssh_key_done and thus
|
|
|
ca1eb8 |
p11_child can be executed more time. We created pipes for each call
|
|
|
ca1eb8 |
but destructor for state->io can close just last one.
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
It's better to manually close pipes with macro PIPE_FD_CLOSE.
|
|
|
ca1eb8 |
that macro set file descriptor to -1 and destructor will not try
|
|
|
ca1eb8 |
to close them 2nd time. Destructor will cover just edge cases.
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
Merges: https://pagure.io/SSSD/sssd/pull-request/3793
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
Resolves:
|
|
|
ca1eb8 |
https://pagure.io/SSSD/sssd/issue/3794
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ca1eb8 |
(cherry picked from commit a76f96ac143128c11bdb975293d667aca861cd91)
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
DOWNSTREAM:
|
|
|
ca1eb8 |
Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
|
|
|
ca1eb8 |
---
|
|
|
ca1eb8 |
src/util/cert/cert_common_p11_child.c | 3 +++
|
|
|
ca1eb8 |
1 file changed, 3 insertions(+)
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
diff --git a/src/util/cert/cert_common_p11_child.c b/src/util/cert/cert_common_p11_child.c
|
|
|
ca1eb8 |
index 17e97eeeeb1956ca6d2bbf048445117029b10dde..aacdb5c475274234fd18d5eca23ee5f9c9288c3e 100644
|
|
|
ca1eb8 |
--- a/src/util/cert/cert_common_p11_child.c
|
|
|
ca1eb8 |
+++ b/src/util/cert/cert_common_p11_child.c
|
|
|
ca1eb8 |
@@ -255,6 +255,9 @@ static void cert_to_ssh_key_done(int child_status,
|
|
|
ca1eb8 |
int ret;
|
|
|
ca1eb8 |
bool valid = false;
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
+ PIPE_FD_CLOSE(state->io->read_from_child_fd);
|
|
|
ca1eb8 |
+ PIPE_FD_CLOSE(state->io->write_to_child_fd);
|
|
|
ca1eb8 |
+
|
|
|
ca1eb8 |
if (WIFEXITED(child_status)) {
|
|
|
ca1eb8 |
if (WEXITSTATUS(child_status) != 0) {
|
|
|
ca1eb8 |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ca1eb8 |
--
|
|
|
ca1eb8 |
2.17.1
|
|
|
ca1eb8 |
|