From 2b71f5727ef2bddca438a32e81571e9a267d574c Mon Sep 17 00:00:00 2001 From: Andrea Mazzoleni Date: Thu, 6 Aug 2026 23:18:12 +0200 Subject: [PATCH] Guard lower close_range call with fd > 3 in os_exec_script --- os/unix.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/os/unix.c b/os/unix.c index dfc4f053..52a2371c 100644 --- a/os/unix.c +++ b/os/unix.c @@ -839,7 +839,8 @@ int os_script(char** argv, char** envp, const char* run_as_user) * * For scripts we cannot set fd as CLOEXEC. */ - close_range(3, fd - 1, CLOSE_RANGE_CLOEXEC); + if (fd > 3) + close_range(3, fd - 1, CLOSE_RANGE_CLOEXEC); close_range(fd + 1, ~0U, CLOSE_RANGE_CLOEXEC); #endif @@ -1333,7 +1334,7 @@ int os_wait(pid_t pid, int* status) } while (ret == -1 && errno == EINTR); if (ret == -1) { - os_syslog(OS_LVL_INFO, "failed to wait, errno=%s(%d)", strerror(errno), errno); + os_syslog(OS_LVL_INFO, "failed to wait, errno=%s(%d)", strerror(errno), errno); } return ret; @@ -1502,7 +1503,7 @@ void os_privileges_acquire(void) /* If EPERM, process lacks permission to switch privileges (e.g. dropped capabilities); continue with active privileges */ os_syslog(OS_LVL_INFO, "permission denied to acquire privileges, continuing with active privileges"); } else { - os_syslog(OS_LVL_INFO, "failed to acquire privileges, errno=%s(%d)", strerror(errno), errno); + os_syslog(OS_LVL_INFO, "failed to acquire privileges, errno=%s(%d)", strerror(errno), errno); os_abort(); } }