daemon: if one of the standard fds is missing open it to /dev/null

diff --git a/daemon.c b/daemon.c
index 1ba4d669da346abb5dab86ea7842a7ad4d3e1cde..01ccda33ea97dd62c00e6cfd63734fe39182f4ce 100644 (file)
--- a/daemon.c
+++ b/daemon.c
@@ -35,7 +35,7 @@ static char *base_path = NULL;
  * after ~user/.  E.g. a request to git://host/~alice/frotz would
  * go to /home/alice/pub_git/frotz with --user-path=pub_git.
  */
-static char *user_path = NULL;
+static const char *user_path = NULL;
 
 /* Timeout, and initial timeout */
 static unsigned int timeout = 0;
@@ -95,6 +95,12 @@ static void loginfo(const char *err, ...)
        va_end(params);
 }
 
+static void NORETURN daemon_die(const char *err, va_list params)
+{
+       logreport(LOG_ERR, err, params);
+       exit(1);
+}
+
 static int avoid_alias(char *p)
 {
        int sl, ndot;
@@ -472,7 +478,7 @@ static void child_handler(int signo)
                        children_reaped = reaped + 1;
                        /* XXX: Custom logging, since we don't wanna getpid() */
                        if (verbose) {
-                               char *dead = "";
+                               const char *dead = "";
                                if (!WIFEXITED(status) || WEXITSTATUS(status) > 0)
                                        dead = " (with error)";
                                if (log_syslog)
@@ -656,6 +662,18 @@ static int service_loop(int socknum, int *socklist)
        }
 }
 
+/* if any standard file descriptor is missing open it to /dev/null */
+static void sanitize_stdfds(void)
+{
+       int fd = open("/dev/null", O_RDWR, 0);
+       while (fd != -1 && fd < 2)
+               fd = dup(fd);
+       if (fd == -1)
+               die("open /dev/null or dup failed: %s", strerror(errno));
+       if (fd > 2)
+               close(fd);
+}
+
 static int serve(int port)
 {
        int socknum, *socklist;
@@ -746,17 +764,14 @@ int main(int argc, char **argv)
                usage(daemon_usage);
        }
 
-       if (log_syslog)
+       if (log_syslog) {
                openlog("git-daemon", 0, LOG_DAEMON);
-
-       if (strict_paths && (!ok_paths || !*ok_paths)) {
-               if (!inetd_mode)
-                       die("git-daemon: option --strict-paths requires a whitelist");
-
-               logerror("option --strict-paths requires a whitelist");
-               exit (1);
+               set_die_routine(daemon_die);
        }
 
+       if (strict_paths && (!ok_paths || !*ok_paths))
+               die("option --strict-paths requires a whitelist");
+
        if (inetd_mode) {
                struct sockaddr_storage ss;
                struct sockaddr *peer = (struct sockaddr *)&ss;
@@ -770,5 +785,7 @@ int main(int argc, char **argv)
                return execute(peer);
        }
 
+       sanitize_stdfds();
+
        return serve(port);
 }