run-command: add close_fd_above_stderr option
Add a close_fd_above_stderr flag to struct child_process. When set, the child closes file descriptors 3 and above between fork and exec (skipping the child-notifier pipe), capped at sysconf(_SC_OPEN_MAX) or 4096, whichever is smaller. This prevents the child from inheriting pipe endpoints or other descriptors from the parent environment (e.g., the test harness). Signed-off-by: Paul Tarjan <github@paulisageek.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Paul Tarjan committed
Apr 15, 2026 at 13:27 UTC
50dc89cdfb6d8495853ceac4801c1cca9cd4ce38
2 files changed
+21
run-command.c
+12
@@ -546,6 +546,7 @@ static void atfork_parent(struct atfork_state *as)
546
"restoring signal mask");
547
#endif
548
}
549
+
550
#endif /* GIT_WINDOWS_NATIVE */
551
552
static inline void set_cloexec(int fd)
@@ -832,6 +833,17 @@ fail_pipe:
833
child_close(cmd->out);
834
}
835
836
+ if (cmd->close_fd_above_stderr) {
837
+ long max_fd = sysconf(_SC_OPEN_MAX);
838
+ int fd;
839
+ if (max_fd < 0 || max_fd > 4096)
840
+ max_fd = 4096;
841
+ for (fd = 3; fd < max_fd; fd++) {
842
+ if (fd != child_notifier)
843
+ close(fd);
844
+ }
845
+ }
846
+
847
if (cmd->dir && chdir(cmd->dir))
848
child_die(CHILD_ERR_CHDIR);
849
run-command.h
+9
@@ -141,6 +141,15 @@ struct child_process {
141
unsigned stdout_to_stderr:1;
142
unsigned clean_on_exit:1;
143
unsigned wait_after_clean:1;
144
+
145
+ /**
146
+ * Close file descriptors 3 and above in the child after forking
147
+ * but before exec. This prevents the child from inheriting
148
+ * pipe endpoints or other descriptors from the parent
149
+ * environment (e.g., the test harness).
150
+ */
151
+ unsigned close_fd_above_stderr:1;
152
+
153
void (*clean_on_exit_handler)(struct child_process *process);
154
};
155