ppp/ppp-2.4.4-fd_leak.patch

diff -up ppp-2.4.4/pppd/auth.c.fd_leak ppp-2.4.4/pppd/auth.c
--- ppp-2.4.4/pppd/auth.c.fd_leak	2006-06-18 13:26:00.000000000 +0200
+++ ppp-2.4.4/pppd/auth.c	2009-10-08 21:22:59.789547513 +0200
@@ -428,7 +428,7 @@ setupapfile(argv)
 	option_error("unable to reset uid before opening %s: %m", fname);
 	return 0;
     }
-    ufile = fopen(fname, "r");
+    ufile = fopen_r(fname);
     if (seteuid(euid) == -1)
 	fatal("unable to regain privileges: %m");
     if (ufile == NULL) {
@@ -1414,7 +1414,7 @@ check_passwd(unit, auser, userlen, apass
     filename = _PATH_UPAPFILE;
     addrs = opts = NULL;
     ret = UPAP_AUTHNAK;
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     if (f == NULL) {
 	error("Can't open PAP password file %s: %m", filename);
 
@@ -1511,7 +1511,7 @@ null_login(unit)
     if (ret <= 0) {
 	filename = _PATH_UPAPFILE;
 	addrs = NULL;
-	f = fopen(filename, "r");
+	f = fopen_r(filename);
 	if (f == NULL)
 	    return 0;
 	check_access(f, filename);
@@ -1558,7 +1558,7 @@ get_pap_passwd(passwd)
     }
 
     filename = _PATH_UPAPFILE;
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     if (f == NULL)
 	return 0;
     check_access(f, filename);
@@ -1596,7 +1596,7 @@ have_pap_secret(lacks_ipp)
     }
 
     filename = _PATH_UPAPFILE;
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     if (f == NULL)
 	return 0;
 
@@ -1641,7 +1641,7 @@ have_chap_secret(client, server, need_ip
     }
 
     filename = _PATH_CHAPFILE;
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     if (f == NULL)
 	return 0;
 
@@ -1683,7 +1683,7 @@ have_srp_secret(client, server, need_ip,
     struct wordlist *addrs;
 
     filename = _PATH_SRPFILE;
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     if (f == NULL)
 	return 0;
 
@@ -1739,7 +1739,7 @@ get_secret(unit, client, server, secret,
 	addrs = NULL;
 	secbuf[0] = 0;
 
-	f = fopen(filename, "r");
+	f = fopen_r(filename);
 	if (f == NULL) {
 	    error("Can't open chap secret file %s: %m", filename);
 	    return 0;
@@ -1796,7 +1796,7 @@ get_srp_secret(unit, client, server, sec
 	filename = _PATH_SRPFILE;
 	addrs = NULL;
 
-	fp = fopen(filename, "r");
+	fp = fopen_r(filename);
 	if (fp == NULL) {
 	    error("Can't open srp secret file %s: %m", filename);
 	    return 0;
@@ -2202,7 +2202,7 @@ scan_authfile(f, client, server, secret,
 	     */
 	    if (word[0] == '@' && word[1] == '/') {
 		strlcpy(atfile, word+1, sizeof(atfile));
-		if ((sf = fopen(atfile, "r")) == NULL) {
+		if ((sf = fopen_r(atfile)) == NULL) {
 		    warn("can't open indirect secret file %s", atfile);
 		    continue;
 		}
diff -up ppp-2.4.4/pppd/eap.c.fd_leak ppp-2.4.4/pppd/eap.c
--- ppp-2.4.4/pppd/eap.c.fd_leak	2004-11-09 23:39:25.000000000 +0100
+++ ppp-2.4.4/pppd/eap.c	2009-10-08 21:22:59.791544181 +0200
@@ -1226,7 +1226,7 @@ mode_t modebits;
 
 	if ((path = name_of_pn_file()) == NULL)
 		return (-1);
-	fd = open(path, modebits, S_IRUSR | S_IWUSR);
+	fd = open_fd(path, modebits, S_IRUSR | S_IWUSR);
 	err = errno;
 	free(path);
 	errno = err;
diff -up ppp-2.4.4/pppd/main.c.fd_leak ppp-2.4.4/pppd/main.c
--- ppp-2.4.4/pppd/main.c.fd_leak	2009-10-08 21:22:59.769544859 +0200
+++ ppp-2.4.4/pppd/main.c	2009-10-08 21:30:32.356546561 +0200
@@ -201,6 +201,8 @@ int ngroups;			/* How many groups valid 
 
 static struct timeval start_time;	/* Time when link was started. */
 
+static int cloexec_works; /* controlls setting FD_CLOEXEC flag up */
+
 static struct pppd_stats old_link_stats;
 struct pppd_stats link_stats;
 unsigned link_connect_time;
@@ -245,6 +247,7 @@ static void holdoff_end __P((void *));
 static void forget_child __P((int pid, int status));
 static int reap_kids __P((void));
 static void childwait_end __P((void *));
+static void check_cloexec __P((int));
 
 #ifdef USE_TDB
 static void update_db_entry __P((void));
@@ -419,7 +422,7 @@ main(argc, argv)
 	die(0);
 
     /* Make sure fds 0, 1, 2 are open to somewhere. */
-    fd_devnull = open(_PATH_DEVNULL, O_RDWR);
+    fd_devnull = open_fd(_PATH_DEVNULL, O_RDWR);
     if (fd_devnull < 0)
 	fatal("Couldn't open %s: %m", _PATH_DEVNULL);
     while (fd_devnull <= 2) {
@@ -865,6 +866,104 @@ holdoff_end(arg)
     new_phase(PHASE_DORMANT);
 }
 
+
+/*
+ * check_cloexec - checks for FD_CLOEXEC flag and adds it if necessary
+ */
+static void
+check_cloexec(int fd)
+{
+    if (cloexec_works == 0) {
+        int fl = fcntl(fd, F_GETFD);
+        cloexec_works = (fl & FD_CLOEXEC) ? 1 : -1;
+    }
+    if (cloexec_works > 0)
+        return;
+    fcntl(fd, F_SETFD, FD_CLOEXEC);
+    return;
+}
+
+/*
+ * socket_fd - create an endpoint for communication. uses FD_CLOEXEC if supported
+ */
+int
+socket_fd(int domain, int type, int protocol)
+{
+	int fd;
+
+#ifdef SOCK_CLOEXEC
+	if (cloexec_works != -1)
+		type |= SOCK_CLOEXEC;
+#endif
+	fd = socket(domain, type, protocol);
+	if (fd == -1)
+		return -1;
+	check_cloexec(fd);
+	return fd;
+}
+
+/*
+ * open_fd - open file with FD_CLOEXEC flag
+ */
+int
+open_fd(const char *path, int flags)
+{
+    int fd;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+    if (cloexec_works != -1)
+        flags |= O_CLOEXEC;
+#endif
+    fd = open(path, flags);
+    if (fd == -1)
+        return -1;
+    check_cloexec(fd);
+    return fd;
+}
+
+/*
+ * open_fd_mmode - open file with FD_CLOEXEC flag
+ */
+int
+open_fd_mode(const char *path, int flags, int mode)
+{
+    int fd;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+    if (cloexec_works != -1)
+        flags |= O_CLOEXEC;
+#endif
+    fd = open(path, flags, mode);
+    if (fd == -1)
+        return -1;
+    check_cloexec(fd);
+    return fd;
+}
+
+/*
+ * fopen_r - open file with FD_CLOEXEC flag
+ */
+FILE *
+fopen_r(const char *path)
+{
+    FILE *f;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+    if (cloexec_works != -1) {
+        f = fopen(path, "re");
+        if (f != NULL) {
+            check_cloexec(fileno(f));
+            return f;
+        }
+    }
+#endif
+    f = fopen(path, "r");
+    if (f == NULL)
+        return NULL;
+    check_cloexec(fileno(f));
+    return f;
+}
+
 /* List of protocol names, to make our messages a little more informative. */
 struct protocol_list {
     u_short	proto;
@@ -1618,7 +1717,7 @@ device_script(program, in, out, dont_wai
     if (log_to_fd >= 0)
 	errfd = log_to_fd;
     else
-	errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0600);
+	errfd = open_fd_mode(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0600);
 
     ++conn_running;
     pid = safe_fork(in, out, errfd);
diff -up ppp-2.4.4/pppd/options.c.fd_leak ppp-2.4.4/pppd/options.c
--- ppp-2.4.4/pppd/options.c.fd_leak	2006-06-18 13:26:00.000000000 +0200
+++ ppp-2.4.4/pppd/options.c	2009-10-08 21:22:59.797544174 +0200
@@ -409,7 +409,7 @@ options_from_file(filename, must_exist, 
 	option_error("unable to drop privileges to open %s: %m", filename);
 	return 0;
     }
-    f = fopen(filename, "r");
+    f = fopen_r(filename);
     err = errno;
     if (check_prot && seteuid(euid) == -1)
 	fatal("unable to regain privileges");
@@ -1528,9 +1528,9 @@ setlogfile(argv)
 	option_error("unable to drop permissions to open %s: %m", *argv);
 	return 0;
     }
-    fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL, 0644);
+    fd = open_fd_mode(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL, 0644);
     if (fd < 0 && errno == EEXIST)
-	fd = open(*argv, O_WRONLY | O_APPEND);
+	fd = open_fd(*argv, O_WRONLY | O_APPEND);
     err = errno;
     if (!privileged_option && seteuid(euid) == -1)
 	fatal("unable to regain privileges: %m");
diff -up ppp-2.4.4/pppd/pppd.h.fd_leak ppp-2.4.4/pppd/pppd.h
--- ppp-2.4.4/pppd/pppd.h.fd_leak	2005-08-26 01:59:34.000000000 +0200
+++ ppp-2.4.4/pppd/pppd.h	2009-10-08 21:22:59.800544904 +0200
@@ -494,6 +494,10 @@ int  ppp_send_config __P((int, int, u_in
 int  ppp_recv_config __P((int, int, u_int32_t, int, int));
 const char *protocol_name __P((int));
 void remove_pidfiles __P((void));
+int socket_fd __P((int, int, int));
+int open_fd __P((const char *, int));
+int open_fd_mode __P((const char *, int, int));
+FILE *fopen_r __P((const char *));
 void lock_db __P((void));
 void unlock_db __P((void));
 
diff -up ppp-2.4.4/pppd/sys-linux.c.fd_leak ppp-2.4.4/pppd/sys-linux.c
--- ppp-2.4.4/pppd/sys-linux.c.fd_leak	2009-10-08 21:22:59.778544744 +0200
+++ ppp-2.4.4/pppd/sys-linux.c	2009-10-08 21:22:59.803544377 +0200
@@ -308,12 +308,12 @@ static int modify_flags(int fd, int clea
 void sys_init(void)
 {
     /* Get an internet socket for doing socket ioctls. */
-    sock_fd = socket(AF_INET, SOCK_DGRAM, 0);
+    sock_fd = socket_fd(AF_INET, SOCK_DGRAM, 0);
     if (sock_fd < 0)
 	fatal("Couldn't create IP socket: %m(%d)", errno);
 
 #ifdef INET6
-    sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0);
+    sock6_fd = socket_fd(AF_INET6, SOCK_DGRAM, 0);
     if (sock6_fd < 0)
 	sock6_fd = -errno;	/* save errno for later */
 #endif
@@ -459,7 +459,7 @@ int generic_establish_ppp (int fd)
 	    goto err;
 	}
 	dbglog("using channel %d", chindex);
-	fd = open("/dev/ppp", O_RDWR);
+	fd = open_fd("/dev/ppp", O_RDWR);
 	if (fd < 0) {
 	    error("Couldn't reopen /dev/ppp: %m");
 	    goto err;
@@ -619,7 +619,7 @@ static int make_ppp_unit()
 		dbglog("in make_ppp_unit, already had /dev/ppp open?");
 		close(ppp_dev_fd);
 	}
-	ppp_dev_fd = open("/dev/ppp", O_RDWR);
+	ppp_dev_fd = open_fd("/dev/ppp", O_RDWR);
 	if (ppp_dev_fd < 0)
 		fatal("Couldn't open /dev/ppp: %m");
 	flags = fcntl(ppp_dev_fd, F_GETFL);
@@ -693,7 +693,7 @@ int bundle_attach(int ifnum)
 	if (!new_style_driver)
 		return -1;
 
-	master_fd = open("/dev/ppp", O_RDWR);
+	master_fd = open_fd("/dev/ppp", O_RDWR);
 	if (master_fd < 0)
 		fatal("Couldn't open /dev/ppp: %m");
 	if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) {
@@ -1412,7 +1412,7 @@ static char *path_to_procfs(const char *
 	/* Default the mount location of /proc */
 	strlcpy (proc_path, "/proc", sizeof(proc_path));
 	proc_path_len = 5;
-	fp = fopen(MOUNTED, "r");
+	fp = fopen_r(MOUNTED);
 	if (fp != NULL) {
 	    while ((mntent = getmntent(fp)) != NULL) {
 		if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0)
@@ -1472,7 +1472,7 @@ static int open_route_table (void)
     close_route_table();
 
     path = path_to_procfs("/net/route");
-    route_fd = fopen (path, "r");
+    route_fd = fopen_r(path);
     if (route_fd == NULL) {
 	error("can't open routing table %s: %m", path);
 	return 0;
@@ -1713,7 +1713,7 @@ int sifproxyarp (int unit, u_int32_t his
 	if (tune_kernel) {
 	    forw_path = path_to_procfs("/sys/net/ipv4/ip_forward");
 	    if (forw_path != 0) {
-		int fd = open(forw_path, O_WRONLY);
+		int fd = open_fd(forw_path, O_WRONLY);
 		if (fd >= 0) {
 		    if (write(fd, "1", 1) != 1)
 			error("Couldn't enable IP forwarding: %m");
@@ -1857,7 +1857,7 @@ get_if_hwaddr(u_char *addr, char *name)
 	struct ifreq ifreq;
 	int ret, sock_fd;
 
-	sock_fd = socket(AF_INET, SOCK_DGRAM, 0);
+	sock_fd = socket_fd(AF_INET, SOCK_DGRAM, 0);
 	if (sock_fd < 0)
 		return 0;
 	memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr));
@@ -2030,7 +2030,7 @@ int ppp_available(void)
     sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch);
     kernel_version = KVERSION(osmaj, osmin, ospatch);
 
-    fd = open("/dev/ppp", O_RDWR);
+    fd = open_fd("/dev/ppp", O_RDWR);
     if (fd >= 0) {
 	new_style_driver = 1;
 
@@ -2068,7 +2068,7 @@ int ppp_available(void)
 /*
  * Open a socket for doing the ioctl operations.
  */
-    s = socket(AF_INET, SOCK_DGRAM, 0);
+    s = socket_fd(AF_INET, SOCK_DGRAM, 0);
     if (s < 0)
 	return 0;
 
@@ -2318,7 +2318,7 @@ int sifaddr (int unit, u_int32_t our_adr
 	int fd;
 
 	path = path_to_procfs("/sys/net/ipv4/ip_dynaddr");
-	if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) {
+	if (path != 0 && (fd = open_fd(path, O_WRONLY)) >= 0) {
 	    if (write(fd, "1", 1) != 1)
 		error("Couldn't enable dynamic IP addressing: %m");
 	    close(fd);
@@ -2494,7 +2494,7 @@ get_pty(master_fdp, slave_fdp, slave_nam
     /*
      * Try the unix98 way first.
      */
-    mfd = open("/dev/ptmx", O_RDWR);
+    mfd = open_fd("/dev/ptmx", O_RDWR);
     if (mfd >= 0) {
 	int ptn;
 	if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) {
@@ -2505,7 +2505,7 @@ get_pty(master_fdp, slave_fdp, slave_nam
 	    if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0)
 		warn("Couldn't unlock pty slave %s: %m", pty_name);
 #endif
-	    if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0)
+	    if ((sfd = open_fd(pty_name, O_RDWR | O_NOCTTY)) < 0)
 		warn("Couldn't open pty slave %s: %m", pty_name);
 	}
     }
@@ -2516,10 +2516,10 @@ get_pty(master_fdp, slave_fdp, slave_nam
 	for (i = 0; i < 64; ++i) {
 	    slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x",
 		     'p' + i / 16, i % 16);
-	    mfd = open(pty_name, O_RDWR, 0);
+	    mfd = open_fd_mode(pty_name, O_RDWR, 0);
 	    if (mfd >= 0) {
 		pty_name[5] = 't';
-		sfd = open(pty_name, O_RDWR | O_NOCTTY, 0);
+		sfd = open_fd_mode(pty_name, O_RDWR | O_NOCTTY, 0);
 		if (sfd >= 0) {
 		    fchown(sfd, uid, -1);
 		    fchmod(sfd, S_IRUSR | S_IWUSR);
@@ -2784,7 +2784,7 @@ ether_to_eui64(eui64_t *p_eui64)
     int skfd;
     const unsigned char *ptr;
 
-    skfd = socket(PF_INET6, SOCK_DGRAM, 0);
+    skfd = socket_fd(PF_INET6, SOCK_DGRAM, 0);
     if(skfd == -1)
     {
         warn("could not open IPv6 socket");
diff -up ppp-2.4.4/pppd/tdb.c.fd_leak ppp-2.4.4/pppd/tdb.c
--- ppp-2.4.4/pppd/tdb.c.fd_leak	2004-11-13 08:13:07.000000000 +0100
+++ ppp-2.4.4/pppd/tdb.c	2009-10-08 21:22:59.806583590 +0200
@@ -1724,7 +1724,7 @@ TDB_CONTEXT *tdb_open_ex(const char *nam
 		goto internal;
 	}
 
-	if ((tdb->fd = open(name, open_flags, mode)) == -1) {
+	if ((tdb->fd = open_fd_mode(name, open_flags, mode)) == -1) {
 		TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n",
 			 name, strerror(errno)));
 		goto fail;	/* errno set by open(2) */
@@ -1967,7 +1967,7 @@ int tdb_reopen(TDB_CONTEXT *tdb)
 	}
 	if (close(tdb->fd) != 0)
 		TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n"));
-	tdb->fd = open(tdb->name, tdb->open_flags & ~(O_CREAT|O_TRUNC), 0);
+	tdb->fd = open_fd_mode(tdb->name, tdb->open_flags & ~(O_CREAT|O_TRUNC), 0);
 	if (tdb->fd == -1) {
 		TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno)));
 		goto fail;
diff -up ppp-2.4.4/pppd/tty.c.fd_leak ppp-2.4.4/pppd/tty.c
--- ppp-2.4.4/pppd/tty.c.fd_leak	2006-06-04 09:04:57.000000000 +0200
+++ ppp-2.4.4/pppd/tty.c	2009-10-08 21:22:59.809544300 +0200
@@ -569,7 +569,7 @@ int connect_tty()
 				status = EXIT_OPEN_FAILED;
 				goto errret;
 			}
-			real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR, 0);
+			real_ttyfd = open_fd_mode(devnam, O_NONBLOCK | O_RDWR, 0);
 			err = errno;
 			if (prio < OPRIO_ROOT && seteuid(0) == -1)
 				fatal("Unable to regain privileges");
@@ -723,7 +723,7 @@ int connect_tty()
 	if (connector == NULL && modem && devnam[0] != 0) {
 		int i;
 		for (;;) {
-			if ((i = open(devnam, O_RDWR)) >= 0)
+			if ((i = open_fd(devnam, O_RDWR)) >= 0)
 				break;
 			if (errno != EINTR) {
 				error("Failed to reopen %s: %m", devnam);
@@ -896,7 +896,8 @@ open_socket(dest)
     *sep = ':';
 
     /* get a socket and connect it to the other end */
-    sock = socket(PF_INET, SOCK_STREAM, 0);
+    //sock = socket(PF_INET, SOCK_STREAM, 0);
+    sock = socket_fd(PF_INET, SOCK_STREAM, 0);
     if (sock < 0) {
 	error("Can't create socket: %m");
 	return -1;
diff -up ppp-2.4.4/pppd/utils.c.fd_leak ppp-2.4.4/pppd/utils.c
--- ppp-2.4.4/pppd/utils.c.fd_leak	2009-10-08 21:22:59.620325739 +0200
+++ ppp-2.4.4/pppd/utils.c	2009-10-08 21:22:59.811573725 +0200
@@ -931,14 +931,14 @@ lock(dev)
     slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", LOCK_DIR, dev);
 #endif
 
-    while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR, 0644)) < 0) {
+    while ((fd = open_fd_mode(lock_file, O_EXCL | O_CREAT | O_RDWR, 0644)) < 0) {
 	if (errno != EEXIST) {
 	    error("Can't create lock file %s: %m", lock_file);
 	    break;
 	}
 
 	/* Read the lock file to find out who has the device locked. */
-	fd = open(lock_file, O_RDONLY, 0);
+	fd = open_fd_mode(lock_file, O_RDONLY, 0);
 	if (fd < 0) {
 	    if (errno == ENOENT) /* This is just a timing problem. */
 		continue;
@@ -1017,7 +1017,7 @@ relock(pid)
 
     if (lock_file[0] == 0)
 	return -1;
-    fd = open(lock_file, O_WRONLY, 0);
+    fd = open_fd_mode(lock_file, O_WRONLY, 0);
     if (fd < 0) {
 	error("Couldn't reopen lock file %s: %m", lock_file);
 	lock_file[0] = 0;
diff -up ppp-2.4.5/pppd/plugins/pppoatm/pppoatm.c.test ppp-2.4.5/pppd/plugins/pppoatm/pppoatm.c
--- ppp-2.4.5/pppd/plugins/pppoatm/pppoatm.c.test	2010-11-16 09:56:56.083707000 +0100
+++ ppp-2.4.5/pppd/plugins/pppoatm/pppoatm.c	2010-11-16 09:56:59.382707272 +0100
@@ -137,7 +137,11 @@ static int connect_pppoatm(void)
 
 	if (!device_got_set)
 		no_device_given_pppoatm();
+#ifdef SOCK_CLOEXEC
+	fd = socket(AF_ATMPVC, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+#else
 	fd = socket(AF_ATMPVC, SOCK_DGRAM, 0);
+#endif
 	if (fd < 0)
 		fatal("failed to create socket: %m");
 	memset(&qos, 0, sizeof qos);
diff -up ppp-2.4.5/pppd/plugins/pppol2tp/openl2tp.c.test ppp-2.4.5/pppd/plugins/pppol2tp/openl2tp.c
--- ppp-2.4.5/pppd/plugins/pppol2tp/openl2tp.c.test	2010-11-16 09:58:17.499711288 +0100
+++ ppp-2.4.5/pppd/plugins/pppol2tp/openl2tp.c	2010-11-16 10:00:15.791706960 +0100
@@ -83,7 +83,11 @@ static int openl2tp_client_create(void)
 	int result;
 
 	if (openl2tp_fd < 0) {
+#ifdef SOCK_CLOEXEC
+		openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+#else
 		openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM, 0);
+#endif
 		if (openl2tp_fd < 0) {
 			error("openl2tp connection create: %m");
 			return -ENOTCONN;
diff -up ppp-2.4.5/pppd/plugins/pppol2tp/pppol2tp.c.test ppp-2.4.5/pppd/plugins/pppol2tp/pppol2tp.c
--- ppp-2.4.5/pppd/plugins/pppol2tp/pppol2tp.c.test	2010-11-16 09:57:44.448709467 +0100
+++ ppp-2.4.5/pppd/plugins/pppol2tp/pppol2tp.c	2010-11-16 09:59:32.877707001 +0100
@@ -208,7 +208,11 @@ static void send_config_pppol2tp(int mtu
 		struct ifreq ifr;
 		int fd;
 
+#ifdef SOCK_CLOEXEC
+		fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+#else
 		fd = socket(AF_INET, SOCK_DGRAM, 0);
+#endif
 		if (fd >= 0) {
 			memset (&ifr, '\0', sizeof (ifr));
 			strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
diff -up ppp-2.4.5/pppd/plugins/rp-pppoe/if.c.test ppp-2.4.5/pppd/plugins/rp-pppoe/if.c
--- ppp-2.4.5/pppd/plugins/rp-pppoe/if.c.test	2009-11-16 23:26:07.000000000 +0100
+++ ppp-2.4.5/pppd/plugins/rp-pppoe/if.c	2010-11-16 09:54:03.973706239 +0100
@@ -116,6 +116,10 @@ openInterface(char const *ifname, UINT16
     stype = SOCK_PACKET;
 #endif
 
+#ifdef SOCK_CLOEXEC
+    stype |= SOCK_CLOEXEC;
+#endif
+
     if ((fd = socket(domain, stype, htons(type))) < 0) {
 	/* Give a more helpful message for the common error case */
 	if (errno == EPERM) {
diff -up ppp-2.4.5/pppd/plugins/rp-pppoe/plugin.c.test ppp-2.4.5/pppd/plugins/rp-pppoe/plugin.c
--- ppp-2.4.5/pppd/plugins/rp-pppoe/plugin.c.test	2009-11-16 23:26:07.000000000 +0100
+++ ppp-2.4.5/pppd/plugins/rp-pppoe/plugin.c	2010-11-16 09:40:23.355707001 +0100
@@ -158,7 +158,11 @@ PPPOEConnectDevice(void)
     ppp_session_number = ntohs(conn->session);
 
     /* Make the session socket */
+#ifdef SOCK_CLOEXEC
+    conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM | SOCK_CLOEXEC, PX_PROTO_OE);
+#else
     conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_OE);
+#endif
     if (conn->sessionSocket < 0) {
 	error("Failed to create PPPoE socket: %m");
 	goto errout;
@@ -289,7 +293,11 @@ PPPoEDevnameHook(char *cmd, char **argv,
     }
 
     /* Open a socket */
+#ifdef SOCK_CLOEXEC
+    if ((fd = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0)) < 0) {
+#else
     if ((fd = socket(PF_PACKET, SOCK_RAW, 0)) < 0) {
+#endif
 	r = 0;
     }
 
diff -up ppp-2.4.5/pppd/plugins/rp-pppoe/pppoe-discovery.c.test ppp-2.4.5/pppd/plugins/rp-pppoe/pppoe-discovery.c
--- ppp-2.4.5/pppd/plugins/rp-pppoe/pppoe-discovery.c.test	2009-11-16 23:26:07.000000000 +0100
+++ ppp-2.4.5/pppd/plugins/rp-pppoe/pppoe-discovery.c	2010-11-16 09:55:08.726707003 +0100
@@ -121,6 +121,10 @@ openInterface(char const *ifname, UINT16
     stype = SOCK_PACKET;
 #endif
 
+#ifdef SOCK_CLOEXEC
+    stype |= SOCK_CLOEXEC;
+#endif
+
     if ((fd = socket(domain, stype, htons(type))) < 0) {
 	/* Give a more helpful message for the common error case */
 	if (errno == EPERM) {