-
- pid = fork();
- switch (pid) {
- case -1:
- fclose(f);
- close(p[0]);
- close(p[1]);
- return NULL;
- case 0:
- if (dup2(p[1-op], 1-op) < 0) _exit(127);
- if (p[0] != 1-op) close(p[0]);
- if (p[1] != 1-op) close(p[1]);
- execl("/bin/sh", "sh", "-c", cmd, (char *)0);
- _exit(127);
+ FLOCK(f);
+
+ /* If the child's end of the pipe happens to already be on the final
+ * fd number to which it will be assigned (either 0 or 1), it must
+ * be moved to a different fd. Otherwise, there is no safe way to
+ * remove the close-on-exec flag in the child without also creating
+ * a file descriptor leak race condition in the parent. */
+ if (p[1-op] == 1-op) {
+ int tmp = fcntl(F_DUPFD_CLOEXEC, 1-op, 0);
+ if (tmp < 0) {
+ e = errno;
+ goto fail;
+ }
+ __syscall(SYS_close, p[1-op]);
+ p[1-op] = tmp;
+ }
+
+ e = ENOMEM;
+ if (!posix_spawn_file_actions_init(&fa)) {
+ if (!posix_spawn_file_actions_adddup2(&fa, p[1-op], 1-op)) {
+ if (!(e = posix_spawn(&pid, "/bin/sh", &fa, 0,
+ (char *[]){ "sh", "-c", (char *)cmd, 0 }, __environ))) {
+ posix_spawn_file_actions_destroy(&fa);
+ f->pipe_pid = pid;
+ if (!strchr(mode, 'e'))
+ fcntl(p[op], F_SETFD, 0);
+ __syscall(SYS_close, p[1-op]);
+ FUNLOCK(f);
+ return f;
+ }
+ }
+ posix_spawn_file_actions_destroy(&fa);