MFC src/lib/libkvm/kvm.c 1.23: mark file descriptors close-on-exec.

UPDATING

@@ -18,6 +18,11 @@ minimal number of processes, if possible, for that patch.  For those
 updates that don't have an advisory, or to be safe, you can do a full
 build and install as described in the COMMON ITEMS section.
 
+20020911:	p20
+	The kvm_openfiles/kvm_open functions now mark the returned file
+	descriptors close-on-exec in case set-user-ID/set-group-ID
+	applications are careless.
+
 20020813:	p19	FreeBSD-SA-02:38.signed-error
 	Bounds checking errors in accept(), getsockname(),
 	getpeername(), and a VESA ioctl() command were corrected.

lib/libkvm/kvm.c

@@ -206,6 +206,10 @@ _kvm_open(kd, uf, mf, flag, errout)
 		_kvm_syserr(kd, kd->program, "%s", mf);
 		goto failed;
 	}
+	if (fcntl(kd->pmfd, F_SETFD, FD_CLOEXEC) < 0) {
+		_kvm_syserr(kd, kd->program, "%s", mf);
+		goto failed;
+	}
 	if (S_ISCHR(st.st_mode)) {
 		/*
 		 * If this is a character special device, then check that
@@ -224,6 +228,10 @@ _kvm_open(kd, uf, mf, flag, errout)
 				_kvm_syserr(kd, kd->program, "%s", _PATH_KMEM);
 				goto failed;
 			}
+			if (fcntl(kd->vmfd, F_SETFD, FD_CLOEXEC) < 0) {
+				_kvm_syserr(kd, kd->program, "%s", _PATH_KMEM);
+				goto failed;
+			}
 		}
 	} else {
 		/*
@@ -235,6 +243,10 @@ _kvm_open(kd, uf, mf, flag, errout)
 			_kvm_syserr(kd, kd->program, "%s", uf);
 			goto failed;
 		}
+		if (fcntl(kd->nlfd, F_SETFD, FD_CLOEXEC) < 0) {
+			_kvm_syserr(kd, kd->program, "%s", uf);
+			goto failed;
+		}
 		if (_kvm_initvtop(kd) < 0)
 			goto failed;
 	}

sys/conf/newvers.sh

@@ -36,7 +36,7 @@
 
 TYPE="FreeBSD"
 REVISION="4.5"
-BRANCH="RELEASE-p19"
+BRANCH="RELEASE-p20"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"