X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fsrc%2Fdaemon.c;h=3db9be374214e9e3f37b54af3e1c219c8c7f2cd1;hb=33191679e1a86ba6d9c38a74d0795d00c300f2c5;hp=777cda6f4a42c41edbf39f50133e05ff504177f7;hpb=cf73943b330a44b8716aa1fcbf649ee1f0fbc67b;p=user%2Fhenk%2Fcode%2Fexim.git

diff --git a/src/src/daemon.c b/src/src/daemon.c
index 777cda6f4..3db9be374 100644
--- a/src/src/daemon.c
+++ b/src/src/daemon.c
@@ -1,10 +1,10 @@
-/* $Cambridge: exim/src/src/daemon.c,v 1.26 2008/12/12 14:44:25 nm4 Exp $ */
+/* $Cambridge: exim/src/src/daemon.c,v 1.27 2009/11/16 19:50:36 nm4 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2007 */
+/* Copyright (c) University of Cambridge 1995 - 2009 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions concerned with running Exim as a daemon */
@@ -425,6 +425,13 @@ if (pid == 0)
 
   for (i = 0; i < listen_socket_count; i++) (void)close(listen_sockets[i]);
 
+  /* Set FD_CLOEXEC on the SMTP socket. We don't want any rogue child processes
+  to be able to communicate with them, under any circumstances. */
+  (void)fcntl(accept_socket, F_SETFD,
+              fcntl(accept_socket, F_GETFD) | FD_CLOEXEC);
+  (void)fcntl(dup_accept_socket, F_SETFD,
+              fcntl(dup_accept_socket, F_GETFD) | FD_CLOEXEC);
+
   #ifdef SA_NOCLDWAIT
   act.sa_handler = SIG_IGN;
   sigemptyset(&(act.sa_mask));