Bug #67383 [NEW]: exec() leaks file and socket descriptors to called program

From: langemeijer@php.net Operating system: linux PHP version: Irrelevant Package: *General Issues Bug Type: Bug Bug description:exec() leaks file and socket descriptors to called program Description: ------------ PHP doesn't sanitize opened file descriptors opened by PHP itself before executing a program. This should be fixed by opening all sockets with SOCK_CLOEXEC and all run a fcntl(file, F_SETFD, FD_CLOEXEC); on all newly opened filedescriptors SOCK_CLOEXEC and FD_CLOEXEC cause exec() to close the descriptors in the fork()ed child process. Note that this is similar, but not identical to bug #38915, bug #15529 and bug #20302 which are about file descriptors and sockets opened by Apache. Note that my patch also sets SOCK_CLOEXEC on the fastcgi listening socket and other similar usages of sockets. The patch was generated on php-src master branch. I'm happy to do some more work on it if any of you feel this is required. -- Edit bug report at https://bugs.php.net/bug.php?id=67383&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67383&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67383&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67383&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=67383&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=67383&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=67383&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=67383&r=needscript Try newer version: https://bugs.php.net/fix.php?id=67383&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=67383&r=support Expected behavior: https://bugs.php.net/fix.php?id=67383&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=67383&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=67383&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=67383&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67383&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=67383&r=dst IIS Stability: https://bugs.php.net/fix.php?id=67383&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=67383&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=67383&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=67383&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=67383&r=mysqlcfg