From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=TYyyhMaR; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 8170F5A061D for ; Tue, 14 Jul 2026 11:29:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1784021369; bh=WguPm+kdrbSKdJAlSxUx5w7wJPkoDz3C11InEsmwC48=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TYyyhMaRImVFmtqGC4bX8gZl9ltuxjeERgnFxGdxtTyfhPl+V7lWem0yGHjD0RLsc cC3LCvRlRFe7YjkFVQhy+YiGROkvC4qtOBhNEMh4H9pCpeQ9VC9ICLHfXCKzT4TQlT 0DklgXdxZf24jk29KSVh7VeAdYgJQiKCkUmBfXLqtSCJlNKwTpN5BKVUl/vfGvtvW6 PwZsX7u4iNKiAeXn4N7ScU56ONHuHrWGSAOKUBWWWSwlfwat0O6nrv73kAu2N2+iVy 4DsdOrIdl+GnaZN2grnOWjUudwWoQChjAYBlrozctQ+jy8PmZhnYhBnpP2n8qR0fGc hmWQKFDuK01uA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzvCF6H78z4w1b; Tue, 14 Jul 2026 19:29:29 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 1/6] isolation, util: Fold close_open_files() into isolate_initial() Date: Tue, 14 Jul 2026 19:29:21 +1000 Message-ID: <20260714092926.2881848-2-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260714092926.2881848-1-david@gibson.dropbear.id.au> References: <20260714092926.2881848-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: EZ5O73QOQ32RJFX5GYQHQSO7DS6URAHE X-Message-ID-Hash: EZ5O73QOQ32RJFX5GYQHQSO7DS6URAHE X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Most functions in util.c are, well, utilities, that are useful in a bunch of places. close_open_files(), however, is very specific, it's only called from isolate_initial(), and really only can be called from there - it's logic encodes a very specific action we want to take at that point. So, remove it from util.c and fold into isolate_initial(). Signed-off-by: David Gibson --- isolation.c | 37 ++++++++++++++++++++++++++++++++++++- util.c | 49 ------------------------------------------------- util.h | 1 - 3 files changed, 36 insertions(+), 51 deletions(-) diff --git a/isolation.c b/isolation.c index c868e668..07b281bb 100644 --- a/isolation.c +++ b/isolation.c @@ -58,6 +58,7 @@ #include #include +#include #include #include #include @@ -88,6 +89,7 @@ #include "passt.h" #include "log.h" #include "isolation.h" +#include "conf.h" #define CAP_VERSION _LINUX_CAPABILITY_VERSION_3 #define CAP_WORDS _LINUX_CAPABILITY_U32S_3 @@ -204,6 +206,9 @@ static int move_root(void) */ void isolate_initial(int argc, char **argv) { + const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, + { 0 }, }; + int name, rc, fd_tap = -1; uint64_t keep; /* We want to keep CAP_NET_BIND_SERVICE in the initial @@ -244,7 +249,37 @@ void isolate_initial(int argc, char **argv) drop_caps_ep_except(keep); - close_open_files(argc, argv); + do { + name = getopt_long(argc, argv, "-:F:", optfd, NULL); + + if (name == 'F') + fd_tap = conf_tap_fd(optarg); + } while (name != -1); + + if (fd_tap == -1) { + rc = close_range(STDERR_FILENO + 1, ~0U, CLOSE_RANGE_UNSHARE); + } else if (fd_tap == STDERR_FILENO + 1) { /* Still a single range */ + rc = close_range(STDERR_FILENO + 2, ~0U, CLOSE_RANGE_UNSHARE); + } else { + rc = close_range(STDERR_FILENO + 1, fd_tap - 1, + CLOSE_RANGE_UNSHARE); + if (!rc) + rc = close_range(fd_tap + 1, ~0U, CLOSE_RANGE_UNSHARE); + } + + if (rc) { + if (errno == ENOSYS || errno == EINVAL) { + /* This probably means close_range() or the + * CLOSE_RANGE_UNSHARE flag is not supported by the + * kernel. Not much we can do here except carry on and + * hope for the best. + */ + warn( +"Can't use close_range() to ensure no files leaked by parent"); + } else { + die_perror("Failed to close files leaked by parent"); + } + } } /** diff --git a/util.c b/util.c index 4bc5d6f8..ce5021a9 100644 --- a/util.c +++ b/util.c @@ -26,7 +26,6 @@ #include #include #include -#include #include "linux_dep.h" #include "util.h" @@ -38,7 +37,6 @@ #include "epoll_ctl.h" #include "pasta.h" #include "serialise.h" -#include "conf.h" #ifdef HAS_GETRANDOM #include #endif @@ -924,53 +922,6 @@ const char *str_ee_origin(const struct sock_extended_err *ee) return ""; } -/** - * close_open_files() - Close leaked files, but not --fd, stdin, stdout, stderr - * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd - */ -void close_open_files(int argc, char **argv) -{ - const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, - { 0 }, - }; - long fd = -1; - int name, rc; - - do { - name = getopt_long(argc, argv, "-:F:", optfd, NULL); - - if (name == 'F') - fd = conf_tap_fd(optarg); - } while (name != -1); - - if (fd == -1) { - rc = close_range(STDERR_FILENO + 1, ~0U, CLOSE_RANGE_UNSHARE); - } else if (fd == STDERR_FILENO + 1) { /* Still a single range */ - rc = close_range(STDERR_FILENO + 2, ~0U, CLOSE_RANGE_UNSHARE); - } else { - rc = close_range(STDERR_FILENO + 1, fd - 1, - CLOSE_RANGE_UNSHARE); - if (!rc) - rc = close_range(fd + 1, ~0U, CLOSE_RANGE_UNSHARE); - } - - if (rc) { - if (errno == ENOSYS || errno == EINVAL) { - /* This probably means close_range() or the - * CLOSE_RANGE_UNSHARE flag is not supported by the - * kernel. Not much we can do here except carry on and - * hope for the best. - */ - warn( -"Can't use close_range() to ensure no files leaked by parent"); - } else { - die_perror("Failed to close files leaked by parent"); - } - } - -} - /** * snprintf_check() - snprintf() wrapper, checking for truncation and errors * @str: Output buffer diff --git a/util.h b/util.h index 90e8a20d..2435f536 100644 --- a/util.h +++ b/util.h @@ -168,7 +168,6 @@ intmax_t read_file_integer(const char *path, intmax_t fallback); int write_remainder(int fd, const struct iovec *iov, size_t iovcnt, size_t skip, size_t length); int read_remainder(int fd, const struct iovec *iov, size_t cnt, size_t skip); -void close_open_files(int argc, char **argv); bool snprintf_check(char *str, size_t size, const char *format, ...); long clamped_scale(long x, long y, long lo, long hi, long f); -- 2.55.0