refactor closing of file descriptors

src/firejail/dbus.c

@@ -297,11 +297,12 @@ void dbus_proxy_start(void) {
 	if (dbus_proxy_pid == -1)
 		errExit("fork");
 	if (dbus_proxy_pid == 0) {
-		int i;
-		for (i = STDERR_FILENO + 1; i < FIREJAIL_MAX_FD; i++) {
-			if (i != status_pipe[1] && i != args_pipe[0])
-				close(i); // close open files
-		}
+		// close open files
+		int keep_list[2];
+		keep_list[0] = status_pipe[1];
+		keep_list[1] = args_pipe[0];
+		close_all(keep_list, ARRAY_SIZE(keep_list));
+
 		if (arg_dbus_log_file != NULL) {
 			int output_fd = creat(arg_dbus_log_file, 0666);
 			if (output_fd < 0)

src/firejail/firejail.h

@@ -551,6 +551,7 @@ int remount_by_fd(int dst, unsigned long mountflags);
 int bind_mount_by_fd(int src, int dst);
 int bind_mount_path_to_fd(const char *srcname, int dst);
 int bind_mount_fd_to_path(int src, const char *destname);
+void close_all(int *keep_list, size_t sz);
 int has_handler(pid_t pid, int signal);
 void enter_network_namespace(pid_t pid);
 int read_pid(const char *name, pid_t *pid);
@@ -881,7 +882,6 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 #define SBOX_CAPS_HIDEPID (1 << 7)	// hidepid caps filter for running firemon
 #define SBOX_CAPS_NET_SERVICE (1 << 8) // caps filter for programs running network services
 #define SBOX_KEEP_FDS (1 << 9) // keep file descriptors open
-#define FIREJAIL_MAX_FD 20 // getdtablesize() is overkill for a firejail process
 
 // run sbox
 int sbox_run(unsigned filter, int num, ...);

src/firejail/sbox.c

@@ -72,11 +72,8 @@ static int __attribute__((noreturn)) sbox_do_exec_v(unsigned filtermask, char *
 	}
 
 	// close all other file descriptors
-	if ((filtermask & SBOX_KEEP_FDS) == 0) {
-		int i;
-		for (i = 3; i < FIREJAIL_MAX_FD; i++)
-			close(i); // close open files
-	}
+	if ((filtermask & SBOX_KEEP_FDS) == 0)
+		close_all(NULL, 0);
 
 	umask(027);
 

src/firejail/util.c

@@ -1398,6 +1398,52 @@ int bind_mount_path_to_fd(const char *srcname, int dst) {
 	return rv;
 }
 
+void close_all(int *keep_list, size_t sz) {
+	DIR *dir;
+	if (!(dir = opendir("/proc/self/fd"))) {
+		// sleep 2 seconds and try again
+		sleep(2);
+		if (!(dir = opendir("/proc/self/fd"))) {
+			fprintf(stderr, "Error: cannot open /proc/self/fd directory\n");
+			exit(1);
+		}
+	}
+	struct dirent *entry;
+	while ((entry = readdir(dir)) != NULL) {
+		if (strcmp(entry->d_name, ".") == 0 ||
+		    strcmp(entry->d_name, "..") == 0)
+			continue;
+
+		int fd = atoi(entry->d_name);
+
+		// don't close standard streams
+		if (fd == STDIN_FILENO ||
+		    fd == STDOUT_FILENO ||
+		    fd == STDERR_FILENO)
+			continue;
+
+		if (fd == dirfd(dir))
+			continue; // just postponed
+
+		// dont't close file descriptors in keep list
+		int keep = 0;
+		if (keep_list) {
+			size_t i;
+			for (i = 0; i < sz; i++) {
+				if (keep_list[i] == fd) {
+					keep = 1;
+					break;
+				}
+			}
+		}
+		if (keep)
+			continue;
+
+		close(fd);
+	}
+	closedir(dir);
+}
+
 int has_handler(pid_t pid, int signal) {
 	if (signal > 0 && signal <= SIGRTMAX) {
 		char *fname;