[newlib-cygwin] Cygwin: fork: restrict parent handle perms and drop handle after use

[Corinna Vinschen]

https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=69cc7a068656b5c6ef07ca079a213f801e02e650

commit 69cc7a068656b5c6ef07ca079a213f801e02e650
Author: Corinna Vinschen <cori...@vinschen.de>
Date:   Sun Jan 27 13:15:15 2019 +0100

    Cygwin: fork: restrict parent handle perms and drop handle after use
    
    Signed-off-by: Corinna Vinschen <cori...@vinschen.de>

Diff:
---
 winsup/cygwin/dcrt0.cc   | 3 ++-
 winsup/cygwin/fork.cc    | 2 ++
 winsup/cygwin/sigproc.cc | 5 +++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/winsup/cygwin/dcrt0.cc b/winsup/cygwin/dcrt0.cc
index af5eaac..cf2a08e 100644
--- a/winsup/cygwin/dcrt0.cc
+++ b/winsup/cygwin/dcrt0.cc
@@ -637,7 +637,8 @@ child_info_fork::handle_fork ()
 bool
 child_info_spawn::get_parent_handle ()
 {
-  parent = OpenProcess (PROCESS_VM_READ, false, parent_winpid);
+  parent = OpenProcess (PROCESS_QUERY_LIMITED_INFORMATION, FALSE,
+                       parent_winpid);
   moreinfo->myself_pinfo = NULL;
   return !!parent;
 }
diff --git a/winsup/cygwin/fork.cc b/winsup/cygwin/fork.cc
index 6813446..d8c4ac4 100644
--- a/winsup/cygwin/fork.cc
+++ b/winsup/cygwin/fork.cc
@@ -203,6 +203,8 @@ frok::child (volatile char * volatile here)
      rd_proc_pipe that would be an invalid handle.  In the case of
      wr_proc_pipe it would be == my_wr_proc_pipe.  Both would be bad. */
   ch.rd_proc_pipe = ch.wr_proc_pipe = NULL;
+  CloseHandle (hParent);
+  hParent = NULL;
   cygwin_finished_initializing = true;
   return 0;
 }
diff --git a/winsup/cygwin/sigproc.cc b/winsup/cygwin/sigproc.cc
index 92fa5ea..45e9482 100644
--- a/winsup/cygwin/sigproc.cc
+++ b/winsup/cygwin/sigproc.cc
@@ -814,8 +814,9 @@ child_info::child_info (unsigned in_cb, child_info_types 
chtype,
      allow the child to duplicate handles from the parent to itself. */
   parent = NULL;
   if (!DuplicateHandle (GetCurrentProcess (), GetCurrentProcess (),
-                       GetCurrentProcess (), &parent, 0, true,
-                       DUPLICATE_SAME_ACCESS))
+                       GetCurrentProcess (), &parent,
+                       PROCESS_DUP_HANDLE | PROCESS_VM_READ
+                       | PROCESS_QUERY_LIMITED_INFORMATION, TRUE, 0))
     system_printf ("couldn't create handle to myself for child, %E");
 }