From a195869e527df27451bee8b68108abd005976b2d Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Tue, 31 Jul 2018 21:03:38 +0000 Subject: [PATCH] SSS_CERT: Close file descriptors after executing p11_child We can call cert_to_ssh_key_step from cert_to_ssh_key_done and thus p11_child can be executed more time. We created pipes for each call but destructor for state->io can close just last one. It's better to manually close pipes with macro PIPE_FD_CLOSE. that macro set file descriptor to -1 and destructor will not try to close them 2nd time. Destructor will cover just edge cases. Merges: https://pagure.io/SSSD/sssd/pull-request/3793 Resolves: https://pagure.io/SSSD/sssd/issue/3794 Reviewed-by: Jakub Hrozek (cherry picked from commit a76f96ac143128c11bdb975293d667aca861cd91) DOWNSTREAM: Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key --- src/util/cert/cert_common_p11_child.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/util/cert/cert_common_p11_child.c b/src/util/cert/cert_common_p11_child.c index 17e97eeeeb1956ca6d2bbf048445117029b10dde..aacdb5c475274234fd18d5eca23ee5f9c9288c3e 100644 --- a/src/util/cert/cert_common_p11_child.c +++ b/src/util/cert/cert_common_p11_child.c @@ -255,6 +255,9 @@ static void cert_to_ssh_key_done(int child_status, int ret; bool valid = false; + PIPE_FD_CLOSE(state->io->read_from_child_fd); + PIPE_FD_CLOSE(state->io->write_to_child_fd); + if (WIFEXITED(child_status)) { if (WEXITSTATUS(child_status) != 0) { DEBUG(SSSDBG_OP_FAILURE, -- 2.17.1