diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2010-06-11 13:42:21 +0300 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2010-06-11 13:42:21 +0300 |
| commit | 43cb554c3fd94ba394b708265c5fa2225a37a9eb (patch) | |
| tree | ff9708008237754d46c3c2188cdb866a4d0fd195 /src/package.c | |
| parent | bcbe575c3b28997a03a65426b241bdfef4d8b747 (diff) | |
| download | apk-tools-43cb554c3fd94ba394b708265c5fa2225a37a9eb.tar.gz apk-tools-43cb554c3fd94ba394b708265c5fa2225a37a9eb.tar.bz2 apk-tools-43cb554c3fd94ba394b708265c5fa2225a37a9eb.tar.xz apk-tools-43cb554c3fd94ba394b708265c5fa2225a37a9eb.zip | |
various: use O_CLOEXEC and add some error checking
Diffstat (limited to 'src/package.c')
| -rw-r--r-- | src/package.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/src/package.c b/src/package.c index 10f0d1b..0dd89d3 100644 --- a/src/package.c +++ b/src/package.c @@ -444,7 +444,7 @@ int apk_sign_ctx_process_file(struct apk_sign_ctx *ctx, if (strncmp(&fi->name[6], "RSA.", 4) == 0 || strncmp(&fi->name[6], "DSA.", 4) == 0) { - int fd = openat(ctx->keys_fd, &fi->name[10], O_RDONLY); + int fd = openat(ctx->keys_fd, &fi->name[10], O_RDONLY|O_CLOEXEC); BIO *bio; if (fd < 0) @@ -884,22 +884,24 @@ int apk_ipkg_run_script(struct apk_installed_package *ipkg, int root_fd, if (apk_flags & APK_SIMULATE) return 0; - fd = openat(root_fd, fn, O_CREAT|O_RDWR|O_TRUNC, 0755); + fd = openat(root_fd, fn, O_CREAT|O_RDWR|O_TRUNC|O_CLOEXEC, 0755); if (fd < 0) { mkdirat(root_fd, "var/cache/misc", 0755); - fd = openat(root_fd, fn, O_CREAT|O_RDWR|O_TRUNC, 0755); + fd = openat(root_fd, fn, O_CREAT|O_RDWR|O_TRUNC|O_CLOEXEC, 0755); if (fd < 0) return -errno; } - write(fd, ipkg->script[type].ptr, ipkg->script[type].len); + if (write(fd, ipkg->script[type].ptr, ipkg->script[type].len) < 0) { + close(fd); + return -errno; + } close(fd); pid = fork(); if (pid == -1) return -1; if (pid == 0) { - fchdir(root_fd); - if (chroot(".") < 0) { + if (fchdir(root_fd) < 0 || chroot(".") < 0) { apk_error("chroot: %s", strerror(errno)); } else { execve(fn, argv, environment); |