pipecmd: close fds in child.

This is usually what you want; I didn't even add a flag to stop it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

diff --git a/ccan/pipecmd/pipecmd.c b/ccan/pipecmd/pipecmd.c
index d45713b6f8015db478592f5795fdfda474605c3c..afeaf5a0a256de9839b39b522f0cc1e3e8f142a9 100644 (file)
--- a/ccan/pipecmd/pipecmd.c
+++ b/ccan/pipecmd/pipecmd.c
@@ -137,6 +137,13 @@ pid_t pipecmdarr(int *fd_tochild, int *fd_fromchild, int *fd_errfromchild,
                                goto child_errno_fail;
                        close(errfromchild[1]);
                }
+
+               /* Make (fairly!) sure all other fds are closed. */
+               int max = sysconf(_SC_OPEN_MAX);
+               for (int i = 3; i < max; i++)
+                       if (i != execfail[1])
+                               close(i);
+
                execvp(arr[0], arr);
 
        child_errno_fail:

diff --git a/ccan/pipecmd/pipecmd.h b/ccan/pipecmd/pipecmd.h
index 5bbaefc01234699e23ab719d2495161f9ae1b935..3c169ade32fa06694022f4f7b8fc94bf4863a615 100644 (file)
--- a/ccan/pipecmd/pipecmd.h
+++ b/ccan/pipecmd/pipecmd.h
@@ -20,7 +20,8 @@
  * If @errfd == @outfd (and non-NULL) they will be shared.
  * If @infd, @outfd or @errfd is &pipecmd_preserve, it is unchanged.
  *
- * The return value is the pid of the child, or -1.
+ * The return value is the pid of the child, or -1.  All other file-descriptors
+ * are closed in the child.
  */
 pid_t pipecmd(int *infd, int *outfd, int *errfd, const char *cmd, ...);