Merge ~enr0n/ubuntu/+source/openssh:lp2011458-follow-up-kinetic into ubuntu/+source/openssh:ubuntu/kinetic-devel

[Nick Rosbrook]

This is a follow-on adjust to the fix for LP: #2011458 so that we do not introduce LP: #2020474 into Kinetic.

[Steve Langasek (vorlon)]

Uploaded to kinetic-proposed.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index e6b838f..3dc6dc8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:9.0p1-1ubuntu7.3) kinetic; urgency=medium
+
+  * debian/patches/systemd-socket-activation.patch: do not leak sockets in
+    child process. Follow-up fix for LP: #2011458.
+
+ -- Nick Rosbrook <[e-mail]>  Tue, 30 May 2023 16:58:06 -0400
+
 openssh (1:9.0p1-1ubuntu7.2) kinetic; urgency=medium
 
   * debian/patches/systemd-socket-activation.patch: Fix re-execution behavior
diff --git a/debian/patches/systemd-socket-activation.patch b/debian/patches/systemd-socket-activation.patch
index f61639b..587b5c4 100644
--- a/debian/patches/systemd-socket-activation.patch
+++ b/debian/patches/systemd-socket-activation.patch
@@ -202,44 +202,27 @@ Last-Update: 2023-04-17
  				startup_pipe = startup_p[1];
  				close_startup_pipes();
 -				close_listen_socks();
-+				close_listen_socks(/* force = */ 0);
++				close_listen_socks(/* force = */ 1);
  				*sock_in = *newsock;
  				*sock_out = *newsock;
  				log_init(__progname,
-@@ -1701,6 +1777,38 @@
+@@ -1701,6 +1777,21 @@
  			break;
  		}
  	}
 +
 +#ifdef HAVE_SYSTEMD
-+	/* We should call sd_listen_fds() exactly once, and only in the parent
-+	 * process.
-+	 *
-+	 * If the parent calls sd_listen_fds() more than once, then FD_CLOEXEC
-+	 * will be re-configured for the passed fds, which will cause problems
-+	 * during re-execution. The FD_CLOEXEC flag will be cleared by
-+	 * setup_systemd_socket().
-+	 *
-+	 * If the child calls sd_listen_fds(), it will return 0 because it will
-+	 * compare our pid to the LISTEN_PID environment variable, and only
-+	 * return LISTEN_FDS if they match. Thus, when we are a child process,
-+	 * check the LISTEN_FDS ourselves. */
-+	if (rexeced_flag) {
-+		const char* s = getenv("LISTEN_FDS");
-+		if (s && s[0] != '\0') {
-+			errno = 0;
-+			r = (int)strtonum(s, 0, MAX_LISTEN_SOCKS, NULL);
-+			if (errno > 0)
-+			fatal("Failed to parse LISTEN_FDS: %s", strerror(errno));
-+		} else
-+			r = 0;
-+	} else {
-+		r = sd_listen_fds(0);
-+		if (r < 0)
-+			fatal("Failed to get systemd socket fds: %s", strerror(-r));
-+	}
++	/* We should call sd_listen_fds() exactly once. If we call
++	 * sd_listen_fds() more than once, then FD_CLOEXEC will be
++	 * re-configured for the passed fds, which will cause problems during
++	 * re-execution. The FD_CLOEXEC flag will be cleared by
++	 * setup_systemd_socket(). */
++	r = sd_listen_fds(0);
++	if (r < 0)
++		fatal("Failed to get systemd socket fds: %s", strerror(-r));
 +
 +	systemd_num_listen_fds = r;
++	rexec_flag = 0;
 +#endif
 +
  	if (rexeced_flag || inetd_flag)