In article <[EMAIL PROTECTED]>,
 <[EMAIL PROTECTED]> wrote:
>"Carlos Velasco" <[EMAIL PROTECTED]> wrote:
>> I have commented these lines and compiled:
>> 
>>      /* if we're running as a daemon, close other file descriptors. */
>>      if (debug_flag =3D=3D FALSE) {
>>              close(STDIN_FILENO);
>>              close(STDOUT_FILENO);
>>              close(STDERR_FILENO);
>>      }
>> 
>> It works, although I don't know why this fail.
>
>  Hmm... It looks like something is closing stdout (or whatever),
>opening it as the acct_fd, and then this code closes it.  That's bad.

It can get worse. If you close(STDOUT_FILENO) and/or STDERR_FILENO,
then the next open will get fd#1 or fd#2. That could be your SQL
socket, or whatever. Now anything that calls printf() or perror()
or something (some libc routines do! yuck!) will write to a random
filedescriptor.

I've seen linux mount corrupt the /etc/mtab it wrote because of this.

>  It's also weird that it happens only on Solaris.
>  I'll fix the code in src/main/radiusd.c.  It looks to me like there
>are 2-3 sections of code trying to do the same thing, which is
>probably where the bug comes from.

The correct fix is opening /dev/null and dup2() ing it over
stdin/stdout/stderr filedescriptors.

>  The CVS snapshot from tonight should have the fix.

By the way, the new code in freeradius is still subtly wrong.

devnull = open("/dev/null", O_RDWR);
dup2(devnull, STDIN_FILENO);
dup2(devnull, STDOUT_FILENO);
dup2(devnull, STDERR_FILENO);
close(devnull);

Imagine what happens if one of the filedescriptors is already closed.
The last line should read if (devnull > 2) close(devnull);

Mike.


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Reply via email to