From e4fd32021c8d2c63e6636ebbbf8cf2f63f851e91 Mon Sep 17 00:00:00 2001
From: Eric Faurot <eric@cvs.openbsd.org>
Date: Tue, 6 Sep 2016 16:34:30 +0000
Subject: use closefrom() before reexec to make sure the new process only gets
 the imsg socket.

ok gilles@ sunil@
---
 usr.sbin/smtpd/smtpd.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'usr.sbin/smtpd/smtpd.c')

diff --git a/usr.sbin/smtpd/smtpd.c b/usr.sbin/smtpd/smtpd.c
index c638e043e8c..661915d935d 100644
--- a/usr.sbin/smtpd/smtpd.c
+++ b/usr.sbin/smtpd/smtpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smtpd.c,v 1.284 2016/09/04 16:10:31 eric Exp $	*/
+/*	$OpenBSD: smtpd.c,v 1.285 2016/09/06 16:34:29 eric Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org>
@@ -810,11 +810,12 @@ start_child(int save_argc, char **save_argv, char *rexec)
 		return p;
 	}
 
-	close(sp[1]);
-
 	if (dup2(sp[0], 3) == -1)
 		fatal("%s: dup2", rexec);
 
+	if (closefrom(4) == -1)
+		fatal("%s: closefrom", rexec);
+
 	for (argc = 0; argc < save_argc; argc++)
 		argv[argc] = save_argv[argc];
 	argv[argc++] = "-x";
-- 
cgit v1.2.3