From c537804fe1bd624b7d23fda029f91eeb43162242 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Wed, 24 Jun 2026 23:54:10 +0200
Subject: [PATCH] fix: ssh socket hygiene

---
 src/libstore/ssh.cc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 5e82ecbbbd6..322585cca06 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -259,8 +259,17 @@ std::optional<std::filesystem::path> SSHMaster::startMaster()
 
             close(out.readSide.get());
 
+            int nullFd = open("/dev/null", O_RDWR);
+            if (nullFd == -1)
+                throw SysError("opening /dev/null");
+
             if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
                 throw SysError("duping over stdout");
+            if (dup2(nullFd, STDIN_FILENO) == -1)
+                throw SysError("duping over stdin");
+            if (dup2(logFD != -1 ? logFD : nullFd, STDERR_FILENO) == -1)
+                throw SysError("duping over stderr");
+            unix::closeExtraFDs();
 
             OsStrings args = {"ssh", hostnameAndUser.c_str(), "-M", "-N", "-oControlPersist=no"};
             if (verbosity >= lvlChatty)