init: don't special-case logrus fds

We close the logfd before execve so there's no need to special case it.
In addition, it turns out that (*os.File).Fd() doesn't handle the case
where the file was closed and so it seems suspect to use that kind of
check.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2024-01-20 16:56:38 +11:00
parent ee73091a8d
commit d8edada9f2
2 changed files with 0 additions and 17 deletions
-8
View File
@@ -16,8 +16,6 @@ import (
securejoin "github.com/cyphar/filepath-securejoin"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
"github.com/opencontainers/runc/libcontainer/logs"
)
// EnsureProcHandle returns whether or not the given file handle is on procfs.
@@ -142,12 +140,6 @@ func UnsafeCloseFrom(minFd int) error {
// don't have any choice.
return
}
if logs.IsLogrusFd(uintptr(fd)) {
// Do not close the logrus output fd. We cannot exec a pipe, and
// the contents are quite limited (very little attacker control,
// JSON-encoded) making shellcode attacks unlikely.
return
}
// There's nothing we can do about errors from close(2), and the
// only likely error to be seen is EBADF which indicates the fd was
// already closed (in which case, we got what we wanted).