Nicolas Collignon 39667ff6f7 FD_CLOEXEC support ... * 001-fail2ban-server-socket-close-on-exec-no-leak.diff Add code that marks server and client sockets with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). Unix sockets managed by fail2ban-server don't need to be passed to any child process. Fail2ban already uses the FD_CLOEXEC flags in the filter code. This patch also avoids giving iptables access to fail2ban UNIX socket in a SELinux environment (A sane SELinux policy should trigger an audit event because "iptables" will be given read/write access to the fail2ban control socket). Some random references related to this bug: http://sourceforge.net/tracker/?func=detail&atid=689044&aid=2086568&group_id=121032 http://www.redhat.com/archives/fedora-selinux-list/2009-June/msg00124.html http://forums.fedoraforum.org/showthread.php?t=234230 * 002-fail2ban-filters-close-on-exec-typo-fix.diff There is a typo in the fail2ban server/filter.py source code. The FD_CLOEXEC is correctly set but additional *random* flags are also set. It has no side-effect as long as the fd doesn't match a valid flag :) "fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)" <== the 3rd parameter should be flags, not a file descriptor. * 003-fail2ban-gamin-socket-close-on-exec-no-leak.diff Add code that marks the Gamin monitor file descriptor with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). --- File descriptors in action process before patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lrwx------ 1 root root 64 3 -> socket:[116361] <== NOK (fail2ban.sock leak) lr-x------ 1 root root 64 4 -> /proc/20090/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK lrwx------ 1 root root 64 6 -> socket:[115608] <== NOK (gamin sock leak) File descriptors in action process after patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lr-x------ 1 root root 64 3 -> /proc/18284/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK		2013-04-02 19:11:59 +02:00
..
__init__.py	Update Free Software Foundation's address	2011-12-30 12:41:46 -05:00
action.py	Fixed typos	2013-03-10 22:05:33 +00:00
actions.py	Added additional Transmitter tests, and some associated fixes	2013-03-10 14:55:39 +00:00
asyncserver.py	FD_CLOEXEC support	2013-04-02 19:11:59 +02:00
banmanager.py	RF+TST: bring inBanList back from private to protected and enabled its rudimentary unittests	2013-03-29 15:33:08 -04:00
datedetector.py	invalid date recognition, irregular because of sorting template list, now via setRegex	2013-03-11 13:52:31 +01:00
datetemplate.py	BF: fixing up for handling of TAI64N timestamps and adding some unittest for prev commit (not effective much though)	2013-03-25 10:41:13 -04:00
faildata.py	Update Free Software Foundation's address	2011-12-30 12:41:46 -05:00
failmanager.py	ENH: FailManager -- improve log message to report total # of detected failures as well	2013-03-25 23:05:47 -04:00
failregex.py	BF: return str(host) to avoid spurious characters in the logs (Close gh-113)	2013-02-01 16:24:04 -05:00
filter.py	FD_CLOEXEC support	2013-04-02 19:11:59 +02:00
filtergamin.py	FD_CLOEXEC support	2013-04-02 19:11:59 +02:00
filterpoll.py	Fixed typos	2013-03-10 22:05:33 +00:00
filterpyinotify.py	ENH: move pyinotify callback debug message into callback + delay string interpolations	2013-03-25 23:05:55 -04:00
iso8601.py	ENH: modelines for emacs and vim to assure consistent indentation scheme (tabs)	2011-10-07 15:49:38 -04:00
jail.py	BF: (python 2.[45]) store backends names in a list to use .index later on (Closes gh-83)	2012-11-01 15:34:20 -04:00
jails.py	RF: move exceptions used by both client and server into common/exceptions.py	2013-01-28 09:46:50 -05:00
jailthread.py	Update Free Software Foundation's address	2011-12-30 12:41:46 -05:00
mytime.py	Update Free Software Foundation's address	2011-12-30 12:41:46 -05:00
server.py	BF: When changing log target with python2.{4,5} handle KeyError	2013-03-22 21:19:31 +00:00
ticket.py	BF: guarantee that IP is stored as a base, non-unicode str (Closes gh-91)	2012-11-26 12:01:42 -05:00
transmitter.py	Merge branch 'transmitter-testcase' of https://github.com/kwirk/fail2ban	2013-03-10 21:23:04 -04:00