journald: close passed fds we cannot make sense of

This is mostly likely the audit socket, and we really should close it
if we cannot make sense of it, since as long as it is open the kernel
might disable the kmsg forwarding of audit msgs, and we should avoid
that, since audit msgs might get completely lost then.

I also downgraded the log message we show a bit, after all things should
really work fine, and we proceed fine with it.

diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 3bee18b35bf30430d40fb37ff73bd2ff10b5be24..80c97364209405da735e70e40d31730eda8e7e81 100644 (file)
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1552,8 +1552,16 @@ int server_init(Server *s) {
 
                         s->audit_fd = fd;
 
-                } else
-                        log_error("Unknown socket passed as file descriptor %d, ignoring.", fd);
+                } else {
+                        log_warning("Unknown socket passed as file descriptor %d, ignoring.", fd);
+
+                        /* Let's close the fd, better be safe than
+                           sorry. The fd might reference some resource
+                           that we really want to release if we don't
+                           make use of it. */
+
+                        safe_close(fd);
+                }
         }
 
         r = server_open_syslog_socket(s);