• Christian Brauner's avatar
    close_range: add CLOSE_RANGE_UNSHARE · 60997c3d
    Christian Brauner authored
    One of the use-cases of close_range() is to drop file descriptors just before
    execve(). This would usually be expressed in the sequence:
    
    unshare(CLONE_FILES);
    close_range(3, ~0U);
    
    as pointed out by Linus it might be desirable to have this be a part of
    close_range() itself under a new flag CLOSE_RANGE_UNSHARE.
    
    This expands {dup,unshare)_fd() to take a max_fds argument that indicates the
    maximum number of file descriptors to copy from the old struct files. When the
    user requests that all file descriptors are supposed to be closed via
    close_range(min, max) then we can cap via unshare_fd(min) and hence don't need
    to do any of the heavy fput() work for everything above min.
    
    The patch makes it so that if CLOSE_RANGE_UNSHARE is requested and we do in
    fact currently share our file descriptor table we create a new private copy.
    We then close all fds in the requested range and finally after we're done we
    install the new fd table.
    Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
    60997c3d
fork.c 74.6 KB