From 9f4419bdd64702bd02195215143ab5514138eac8 Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@redhat.com>
Date: Tue, 15 Sep 2015 12:44:08 -0400
Subject: Don't close descriptors for fork-without-exec

When we fork to call kuserok() with target user privs, don't close all
of our open file descriptors, since library APIs that are using them
(like nsswitch) won't know that we've done that to any that they have
open.  Based on a report from Roshni Pattath.
---
 src/kuserok.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/src/kuserok.c b/src/kuserok.c
index 4925f29..ae15b38 100644
--- a/src/kuserok.c
+++ b/src/kuserok.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2008,2009,2010,2012 Red Hat, Inc.
+ * Copyright 2008,2009,2010,2012,2015 Red Hat, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -119,14 +119,6 @@ _pam_krb5_kuserok(krb5_context ctx,
 	case 0:
 		/* We're the child. */
 		close(outpipe[0]);
-		for (i = 0; i < sysconf(_SC_OPEN_MAX); i++) {
-			if ((i != outpipe[1]) &&
-			    (i != STDIN_FILENO) &&
-			    (i != STDOUT_FILENO) &&
-			    (i != STDERR_FILENO)) {
-				close(i);
-			}
-		}
 		setgroups(0, NULL);
 		/* Now, attempt to assume the desired uid/gid pair.  Note that
 		 * if we're not root, this is allowed to fail. */
-- 
cgit v0.11.2