konsole leaks file descriptors for /tmp/kde-$USER/konsole*.tmp

[Warren E. Downs]

Binary package hint: konsole

Description: Ubuntu 9.04
Release: 9.04
Version: konsole 4:4.2.2-0ubuntu4
Expected behavior:

Programs executed by user within a konsole shell will only have file descriptors 0 (stdin), 1 (stdout), and 2 (stderr) open when they begin.

Actual behavior:

/usr/bin/konsole leaves multiple open file descriptors pointing to files in:

/tmp/kde-$USER/konsole*.tmp

when executing programs from within it.

It should perform a:

fcntl(fd, F_SETFD, FD_CLOEXEC)

on each of these file descriptors prior to exec'ing the program.

This is apparently also in other distributions as noted in this RedHat bug report:

https://bugzilla.redhat.com/show_bug.cgi?id=466087

Security risk:
Leaving open file descriptors could potentially cause a sudo'ed process to dump privileged information to a non-root user file.

[Steven (steven-redhat-bugs)]

This is the one bug to rule them all.

Description of problem:

SELinux AVC warnings are being issued due to Konsole leaking open file descriptors

Will report this upstream, and all existing bugs and new bugs re this topic will be duped to this one.

[Steven (steven-redhat-bugs)]

*** Bug 471344 has been marked as a duplicate of this bug. ***

[Steven (steven-redhat-bugs)]

*** Bug 480569 has been marked as a duplicate of this bug. ***

[Steven (steven-redhat-bugs)]

*** Bug 466087 has been marked as a duplicate of this bug. ***

[Steven (steven-redhat-bugs)]

*** Bug 474819 has been marked as a duplicate of this bug. ***

[Steven (steven-redhat-bugs)]

*** Bug 477508 has been marked as a duplicate of this bug. ***

[Kevin (kevin-redhat-bugs)]

*** Bug 490751 has been marked as a duplicate of this bug. ***

[Rex (rex-redhat-bugs)]

*** Bug 492916 has been marked as a duplicate of this bug. ***

[Kevin (kevin-redhat-bugs)]

*** Bug 492608 has been marked as a duplicate of this bug. ***

[Rex (rex-redhat-bugs)]

Starting to think this isn't limited to konsole, per a recent comment I made to upstream report on this,

Interestingly,
launching konsole from yakuake (started as part of session management)
    -> no socket file descriptors
launching konsole from kickoff or krunner or yakuake (after login, not part of
session management)
    -> open socket file descriptors

[Rex (rex-redhat-bugs)]

*** Bug 495353 has been marked as a duplicate of this bug. ***

[Rex (rex-redhat-bugs)]

*** Bug 491462 has been marked as a duplicate of this bug. ***

[Rex (rex-redhat-bugs)]

Should be addressed in kdelibs-4.2.2-7

* Sun Apr 19 2009 Rex Dieter <email address hidden> 4.2.2-7
- fix and simplify the child struct disposal (kde#180785)

* Sat Apr 18 2009 Rex Dieter <email address hidden> 4.2.2-6
- squash leaky file descriptors in kdeinit (kde#180785,rhbz#484370)

[Fedora (fedora-redhat-bugs)]

kdeutils-4.2.2-2.fc10, kdetoys-4.2.2-2.fc10, kdesdk-4.2.2-2.fc10, kdeplasma-addons-4.2.2-2.fc10, kdeedu-4.2.2-1.fc10, kdebase-4.2.2-2.fc10, kdeartwork-4.2.2-3.fc10, kdeadmin-4.2.2-2.fc10, kdeaccessibility-4.2.2-1.fc10, sigen-0.1.1-1.fc10, qgit-2.2-4.fc10.1, psi-0.12.1-2.fc10, kde-plasma-weather-1.0.0-3.fc10, arora-0.6-1.fc10, kde-l10n-4.2.2-1.fc10, kdegraphics-4.2.2-3.fc10, kde-i18n-3.5.10-4.fc10, kdepimlibs-4.2.2-3.fc10, oxygen-icon-theme-4.2.2-1.fc10, kdebindings-4.2.2-2.fc10, kdepim-4.2.2-3.fc10, konq-plugins-4.2.2-1.fc10, kdemultimedia-4.2.2-2.fc10, kdenetwork-4.2.2-1.fc10, kdegames-4.2.2-6.fc10, kdebase-workspace-4.2.2-3.fc10, qt-4.5.0-14.fc10, kdebase-runtime-4.2.2-4.fc10, qjackctl-0.3.4-1.fc10, qsynth-0.3.3-6.fc10, kdelibs-4.2.2-7.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.

[Rex (rex-redhat-bugs)]

*** Bug 495353 has been marked as a duplicate of this bug. ***

[Jonathan Thomas (echidnaman)]

Fixed in Karmic. Security team might want to SRU this.