@matheusbsbs / matheus-bagliano / commits / 57f5d52a94

common-main: call sanitize_stdfds()

This is setup that should be done in every program for safety, but we never got around to adding it everywhere (so builtins benefited from the call in git.c, but any external commands did not). Putting it in the common main() gives us this safety everywhere. Note that the case in daemon.c is a little funny. We wait until we know whether we want to daemonize, and then either: - call daemonize(), which will close stdio and reopen it to /dev/null under the hood - sanitize_stdfds(), to fix up any odd cases But that is way too late; the point of sanitizing is to give us reliable descriptors on 0/1/2, and we will already have executed code, possibly called die(), etc. The sanitizing should be the very first thing that happens. With this patch, git-daemon will sanitize first, and can remove the call in the non-daemonize case. It does mean that daemonize() may just end up closing the descriptors we opened, but that's not a big deal (it's not wrong to do so, nor is it really less optimal than the case where our parent process redirected us from /dev/null ahead of time). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Jul 1, 2016 at 02:06 UTC 57f5d52a942e8bbfa82e2741faf050de0d6b3eb3

4 files changed +9 -17

common-main.c

+8 -1

@@ -1,4 +1,4 @@

1 -#include "git-compat-util.h"

1 +#include "cache.h"

2 #include "exec_cmd.h"

4 int main(int argc, char **av)

@@ -9,6 +9,13 @@ int main(int argc, char **av)

9 */

10 const char **argv = (const char **)av;

12 + /*

13 + * Always open file descriptors 0/1/2 to avoid clobbering files

14 + * in die(). It also avoids messing up when the pipes are dup'ed

15 + * onto stdin/stdout/stderr in the child processes we spawn.

16 + */

17 + sanitize_stdfds();

18 +

19 argv[0] = git_extract_argv0_path(argv[0]);

21 return cmd_main(argc, argv);

daemon.c

+1 -2

@@ -1364,8 +1364,7 @@ int cmd_main(int argc, const char **argv)

1364 if (detach) {

1365 if (daemonize())

1366 die("--detach not supported on this platform");

1367 - } else

1368 - sanitize_stdfds();

1367 + }

1368

1369 if (pid_file)

1370 write_file(pid_file, "%"PRIuMAX, (uintmax_t) getpid());

git.c

-7

@@ -639,13 +639,6 @@ int cmd_main(int argc, const char **argv)

639 if (!cmd)

640 cmd = "git-help";

641

642 - /*

643 - * Always open file descriptors 0/1/2 to avoid clobbering files

644 - * in die(). It also avoids messing up when the pipes are dup'ed

645 - * onto stdin/stdout/stderr in the child processes we spawn.

646 - */

647 - sanitize_stdfds();

648 -

642 restore_sigpipe_to_default();

643

644 git_setup_gettext();

shell.c

-7

@@ -147,13 +147,6 @@ int cmd_main(int argc, const char **argv)

147

148 git_setup_gettext();

149

150 - /*

151 - * Always open file descriptors 0/1/2 to avoid clobbering files

152 - * in die(). It also avoids messing up when the pipes are dup'ed

153 - * onto stdin/stdout/stderr in the child processes we spawn.

154 - */

155 - sanitize_stdfds();

156 -

150 /*

151 * Special hack to pretend to be a CVS server

152 */