* process.c (allocate_pty) [PTY_OPEN]: Set fd's FD_CLOEXEC flag.

We can't portably rely on PTY_OPEN doing that, even if
it calls posix_openpt with O_CLOEXEC.

2 files changed, 15 insertions, 0 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 997459f01c2..c7cceb27a4f 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2013-08-21  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * process.c (allocate_pty) [PTY_OPEN]: Set fd's FD_CLOEXEC flag.
+        We can't portably rely on PTY_OPEN doing that, even if
+        it calls posix_openpt with O_CLOEXEC.
+
 2013-08-20  Kenichi Handa  <handa@gnu.org>
 
         * character.c (string_char): Improve commentary.
diff --git a/src/process.c b/src/process.c
index c4dd87a6b48..349ec26534b 100644
--- a/src/process.c
+++ b/src/process.c
@@ -687,6 +687,15 @@ allocate_pty (char pty_name[PTY_NAME_SIZE])
 
         if (fd >= 0)
           {
+#ifdef PTY_OPEN
+            /* Set FD's close-on-exec flag.  This is needed even if
+               PT_OPEN calls posix_openpt with O_CLOEXEC, since POSIX
+               doesn't require support for that combination.
+               Multithreaded platforms where posix_openpt ignores
+               O_CLOEXEC (or where PTY_OPEN doesn't call posix_openpt)
+               have a race condition between the PTY_OPEN and here.  */
+            fcntl (fd, F_SETFD, FD_CLOEXEC);
+#endif
             /* check to make certain that both sides are available
                this avoids a nasty yet stupid bug in rlogins */
 #ifdef PTY_TTY_NAME_SPRINTF