From 6aca3716f051b5b6bff63d51fff68b9c7ebc7474 Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Mon, 20 Oct 2025 17:14:31 +0200 Subject: ExecFork: Use close_range() if available Use close_range() if we have it in preference to iterating over /proc/self/fd and falling back to closing all possible fds. This builds sets of ranges to close that take into account the APT::Keep-Fds vector, and a test case is provided to ensure correctness of the splitting logic. Preference is given to close_range() over /proc as in the optimal case, this results in a single system call! --- test/integration/test-close-range | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100755 test/integration/test-close-range (limited to 'test') diff --git a/test/integration/test-close-range b/test/integration/test-close-range new file mode 100755 index 000000000..977c4cf0a --- /dev/null +++ b/test/integration/test-close-range @@ -0,0 +1,25 @@ +#!/bin/sh +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" + +setupenvironment +configarchitecture 'amd64' + + +testsuccessequal "close_range(3, 4294967295)" apthelper drop-privs -o Debug::CloseRange=1 true + + +testsuccessequal "close_range(4, 4294967295)" apthelper drop-privs -o APT::Keep-Fds::=3 -o Debug::CloseRange=1 true + + +testsuccessequal "close_range(3, 4) +close_range(6, 4294967295)" apthelper drop-privs -o APT::Keep-Fds::=5 -o Debug::CloseRange=1 true + + +testsuccessequal "close_range(4, 4) +close_range(6, 4294967295)" apthelper drop-privs -o APT::Keep-Fds::=3 -o APT::Keep-Fds::=5 -o Debug::CloseRange=1 true + +testsuccessequal "close_range(4, 4) +close_range(7, 4294967295)" apthelper drop-privs -o APT::Keep-Fds::=3 -o APT::Keep-Fds::=5 -o APT::Keep-Fds::=6 -o Debug::CloseRange=1 true -- cgit v1.2.3-70-g09d2