Port patch setting FD_CLOEXEC on curl sockets #858

New issue

Open

opened 2025-06-12 04:22:44 +00:00 by jade · 4 comments

jade commented

2025-06-12 04:22:44 +00:00

Owner

Code here: https://github.com/NixOS/nix/pull/12439

jade added the

E/easy

Area/fetching

labels

2025-06-12 04:22:56 +00:00

jade commented

2025-06-12 04:27:55 +00:00

Author

Owner

Note that this patch looks wrong and may not pass review in Lix in its current state as it looks to need rewriting as it is calling fcntl to set the fd as cloexec which is racy (or at the very least requires that you open the curl at a point in the program where it is single threaded/guaranteed not to fork before it is done, which, umm, bad!). You can set SOCK_CLOEXEC while opening the socket instead which is much safer and AFAIK supported on the platforms we care about. I don't know how to set that up via the curl API but surely there is some way to control the socket creation options; I would advise grepping for socket\( in the curl source code.

jade commented

2025-06-12 04:37:41 +00:00

Author

Owner

Oh no... okay their patch is correct on macOS because apparently you can't create a network socket safely on Mac. wat! Still ideally we should set it on socket creation on Linux, that's surprisingly goofy.

helle commented

2025-06-12 11:40:12 +00:00

Member

This is best done by hooking into CURLOPT_OPENSOCKETFUNCTION it looks like, so we either create it with SOCK_CLOEXEC or set FD_CLOEXEC with fcntl immediately after.

I may implement it, but anyone else, feel free

This is best done by hooking into [`CURLOPT_OPENSOCKETFUNCTION`](https://curl.se/libcurl/c/CURLOPT_OPENSOCKETFUNCTION.html) it looks like, so we either create it with `SOCK_CLOEXEC` or set `FD_CLOEXEC` with fcntl immediately after. I may implement it, but anyone else, feel free

helle self-assigned this

2025-06-12 13:15:53 +00:00

lix-bot commented

2025-06-12 13:36:10 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/3351 ("Set SOCK_CLOEXEC/FD_CLOEXEC on sockets created by curl")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/3351](https://gerrit.lix.systems/c/lix/+/3351) ("Set SOCK_CLOEXEC/FD_CLOEXEC on sockets created by curl")