services: shepherd: Open /dev/null as O_CLOEXEC.

Failing to do that, that file descriptor could be inherited by child
processes as of Shepherd 0.9.2.

* gnu/services/shepherd.scm (shepherd-configuration-file): Open
/dev/null as O_CLOEXEC.
This commit is contained in:
Ludovic Courtès 2022-09-10 23:19:02 +02:00
parent 6ee40c3d99
commit 081bb6a7bd
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5

@ -387,7 +387,7 @@ as shepherd package."
;; call; this avoids situations where services wrongfully lead
;; PID 1 to read from stdin (the console), which users may not
;; have access to (see <https://bugs.gnu.org/23697>).
(redirect-port (open-input-file "/dev/null")
(redirect-port (open "/dev/null" (logior O_RDONLY O_CLOEXEC))
(current-input-port)))))
(scheme-file "shepherd.conf" config)))