inetd fd leak?

[Doug Graham]

That could probably be done blindly, by just looping over the entire
fd space ([0..getdtablesize]) and closing everything except the fds
that inetd knows it needs to pass to the child, but otherwise, I think
the problem with the logging fd is that it's hidden in the guts of the
C library, and there's no way to find out what it is.

--Doug.

Cathey, Jim wrote:
>> Now I guess the only worry is that some implementation
>> of syslog won't set FD_CLOEXEC, but even that probably
>> wouldn't be a major cause for concern.
>>     
>
> I didn't think vforked children shared fd's, only memory maps.
> So correct me if I'm wrong, but the problem is that the
> child side changed a global, not that it closed the file.
> So why not just close the file descriptor on the child side
> _without_ changing any globals, like state variables or
> buffered I/O streams?  Then it'd be safe even if it _was_
> missing FD_CLOEXEC.
>
> -- Jim
>
>
>
>
>