Skip to content

Commit 1c8b3b5

Browse files
author
Alexey Izbyshev
authored
bpo-47260: Fix os.closerange() potentially being a no-op in a seccomp sandbox (GH-32418)
_Py_closerange() currently assumes that close_range() closes all file descriptors even if it returns an error (other than ENOSYS). This assumption can be wrong on Linux if a seccomp sandbox denies the underlying syscall, pretending that it returns EPERM or EACCES. In this case _Py_closerange() won't close any descriptors at all, which in the worst case can be a security issue. Fix this by falling back to other methods in case of any close_range() error. Note that fallbacks will not be triggered on any problems with closing individual file descriptors because close_range() is documented to ignore such errors on both Linux[1] and FreeBSD[2]. [1] https://man7.org/linux/man-pages/man2/close_range.2.html [2] https://www.freebsd.org/cgi/man.cgi?query=close_range&sektion=2
1 parent d6fb104 commit 1c8b3b5

File tree

2 files changed

+7
-4
lines changed

2 files changed

+7
-4
lines changed
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix ``os.closerange()`` potentially being a no-op in a Linux seccomp
2+
sandbox.

Python/fileutils.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2624,10 +2624,11 @@ _Py_closerange(int first, int last)
26242624
first = Py_MAX(first, 0);
26252625
_Py_BEGIN_SUPPRESS_IPH
26262626
#ifdef HAVE_CLOSE_RANGE
2627-
if (close_range(first, last, 0) == 0 || errno != ENOSYS) {
2628-
/* Any errors encountered while closing file descriptors are ignored;
2629-
* ENOSYS means no kernel support, though,
2630-
* so we'll fallback to the other methods. */
2627+
if (close_range(first, last, 0) == 0) {
2628+
/* close_range() ignores errors when it closes file descriptors.
2629+
* Possible reasons of an error return are lack of kernel support
2630+
* or denial of the underlying syscall by a seccomp sandbox on Linux.
2631+
* Fallback to other methods in case of any error. */
26312632
}
26322633
else
26332634
#endif /* HAVE_CLOSE_RANGE */

0 commit comments

Comments
 (0)