From 4ec3cd7391e119b597375c547cf4ed50fce9f115 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sun, 30 Nov 2014 00:51:45 +0100 Subject: [PATCH] journald: close passed fds we cannot make sense of This is mostly likely the audit socket, and we really should close it if we cannot make sense of it, since as long as it is open the kernel might disable the kmsg forwarding of audit msgs, and we should avoid that, since audit msgs might get completely lost then. I also downgraded the log message we show a bit, after all things should really work fine, and we proceed fine with it. --- src/journal/journald-server.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index 3bee18b35..80c973642 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -1552,8 +1552,16 @@ int server_init(Server *s) { s->audit_fd = fd; - } else - log_error("Unknown socket passed as file descriptor %d, ignoring.", fd); + } else { + log_warning("Unknown socket passed as file descriptor %d, ignoring.", fd); + + /* Let's close the fd, better be safe than + sorry. The fd might reference some resource + that we really want to release if we don't + make use of it. */ + + safe_close(fd); + } } r = server_open_syslog_socket(s); -- 2.30.2