Re: [Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-10 Thread Charles-François Natali
The SocketServer class creates a socket to listen on clients, and a new socket per client (only for stream server like TCPServer, not for UDPServer). Until recently (2011-05-24, issue #5715), the listening socket was not closed after fork for the ForkingMixIn flavor. This caused two issues:

[Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-09 Thread Victor Stinner
Hi, The SocketServer class creates a socket to listen on clients, and a new socket per client (only for stream server like TCPServer, not for UDPServer). Until recently (2011-05-24, issue #5715), the listening socket was not closed after fork for the ForkingMixIn flavor. This caused two issues:

Re: [Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-09 Thread Senthil Kumaran
On Wed, Jan 9, 2013 at 4:48 AM, Victor Stinner victor.stin...@gmail.com wrote: My question is: would you accept to break backward compatibility (in Python 3.4) to fix a potential security vulnerability? If not, an alternative is to add an option, disabled by default, to enable (or disable)

Re: [Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-09 Thread Charles-François Natali
My question is: would you accept to break backward compatibility (in Python 3.4) to fix a potential security vulnerability? Although obvious, the security implications are not restricted to sockets (yes, it's a contrived example): # cat test_inherit.py import fcntl import os import pwd import

Re: [Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-09 Thread Victor Stinner
2013/1/9 Charles-François Natali cf.nat...@gmail.com: My question is: would you accept to break backward compatibility (in Python 3.4) to fix a potential security vulnerability? Although obvious, the security implications are not restricted to sockets (yes, it's a contrived example): ... f

Re: [Python-Dev] Set close-on-exec flag by default in SocketServer

2013-01-09 Thread Victor Stinner
2013/1/10 Victor Stinner victor.stin...@gmail.com: A better API is maybe to add a cloexec argument to open(), ... I realized that setting close-on-exec flag is a non trivial problem. There are many ways to set it depending on the function, on the OS, and on the OS version. There is also the