Skip to content

fix: ssh socket hygiene #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CertainLach wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: ssh socket hygiene #522

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/libstore/ssh.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,8 +259,17 @@ std::optional<std::filesystem::path> SSHMaster::startMaster()

close(out.readSide.get());

int nullFd = open("/dev/null", O_RDWR);
if (nullFd == -1)
throw SysError("opening /dev/null");

if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
throw SysError("duping over stdout");
if (dup2(nullFd, STDIN_FILENO) == -1)
throw SysError("duping over stdin");
if (dup2(logFD != -1 ? logFD : nullFd, STDERR_FILENO) == -1)

@edolstra edolstra Jun 25, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we should redirect stderr to /dev/null, since that could hide useful error messages if the master ssh fails to connect.

@CertainLach CertainLach Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is in my case I was seeing nix-daemon being stuck on Worker::waitForInput, where fd it waits for belongs to stderr of ssh control master

I'll try to add debug logs to understand what is happening here, but it seems that stderr should not leak to the child process here in any case

@CertainLach CertainLach Jun 25, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

...At least in context of remote build hook

throw SysError("duping over stderr");
unix::closeExtraFDs();

OsStrings args = {"ssh", hostnameAndUser.c_str(), "-M", "-N", "-oControlPersist=no"};
if (verbosity >= lvlChatty)
Expand Down
Loading