Re: [PATCH] BUG/MEDIUM: namespace: fix fd leak in master-worker mode

[Willy Tarreau]

Hi Krisztián,

On Fri, Sep 20, 2019 at 02:48:19PM +, Krisztián Kovács (kkovacs) wrote:
> When namespaces are used in the configuration, the respective namespace 
> handles
> are opened during config parsing and stored in an ebtree for lookup later.
> 
> Unfortunately, when the master process re-execs itself these file descriptors
> were not closed, effectively leaking the fds and preventing destruction of
> namespaces no longer present in the configuration.

Good catch!

> This change fixes this issue by opening the namespace file handles as
> close-on-exec, making sure that they will be closed during re-exec.

I was initially concerned about the version of introduction of O_CLOEXEC
vs our support for USE_NS=1 but I saw that O_CLOEXEC has been there since
2.6.23 while we suggest 2.6.24 and onwards for USE_NS so that's perfectly
covered, thank you!

Willy

[PATCH] BUG/MEDIUM: namespace: fix fd leak in master-worker mode

[kkovacs]

When namespaces are used in the configuration, the respective namespace handles
are opened during config parsing and stored in an ebtree for lookup later.

Unfortunately, when the master process re-execs itself these file descriptors
were not closed, effectively leaking the fds and preventing destruction of
namespaces no longer present in the configuration.

This change fixes this issue by opening the namespace file handles as
close-on-exec, making sure that they will be closed during re-exec.
---
 src/namespace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/namespace.c b/src/namespace.c
index 8a2e5a7b1..cfb81ba0f 100644
--- a/src/namespace.c
+++ b/src/namespace.c
@@ -24,7 +24,7 @@ static int open_named_namespace(const char *ns_name)
 {
if (chunk_printf(&trash, "/var/run/netns/%s", ns_name) < 0)
return -1;
-   return open(trash.area, O_RDONLY);
+   return open(trash.area, O_RDONLY | O_CLOEXEC);
 }
 
 static int default_namespace = -1;
@@ -33,7 +33,7 @@ static int init_default_namespace()
 {
if (chunk_printf(&trash, "/proc/%d/ns/net", getpid()) < 0)
return -1;
-   default_namespace = open(trash.area, O_RDONLY);
+   default_namespace = open(trash.area, O_RDONLY | O_CLOEXEC);
return default_namespace;
 }
 
-- 
2.23.0