https://gitlab.synchro.net/main/sbbs/-/commit/b16969edb8278a6a62307343  
  Modified Files:  
   src/sbbs3/xtrn.cpp src/xpdev/filewrap.c filewrap.h  
  Log Message:  
  Close every descriptor an external program has no business with (#1174)  
    
  Marking descriptors close-on-exec as they are created can only ever cover  
  the ones we create. It reaches neither the descriptors a library opens  
  behind our back - the four sockets libmosquitto holds to the MQTT broker are  
  the plain example - nor the roughly 1700 open()/fopen() call sites in this  
  tree, each of which would otherwise have to be found, flagged, and kept  
  flagged forever.  
    
  Close them in the child instead, where the set is knowable without an audit:  
  after the redirections are in place and immediately before exec, everything  
  above stderr goes, except the passthru socket a native socket-door is handed  
  by number. An external now starts with stdio and, at most, that one socket.  
  Previously it started with the node.dab handles, the node log, the client  
  sockets and whatever else happened to be open at the moment it was launched.  
    
  xp_close_inherited_fds() prefers close_range(2) and falls back to a loop  
  over  
  sysconf(_SC_OPEN_MAX). Between fork() and exec() in a process with other  
  threads running, only async-signal-safe calls are legal, which rules out  
  walking /proc/self/fd - readdir() allocates.  
    
  The exec-failure message now goes to stderr directly. lprintf() cannot be  
  trusted at that point: it is not fork-safe, and its descriptors are among  
  those just closed. Stderr at that point is the pipe the parent already reads  
  and logs, so the message still reaches the log it always did.  
    
  This covers externals only. The CGI and self-restart exec paths in  
  websrvr.cpp and js_global.cpp need the same treatment.  
    
  Co-Authored-By: Claude Opus 5 (1M context)   
  --- SBBSecho 3.37-Linux  
   * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)