s/--fdopen/--fd-conn/

2 files changed, 6 insertions, 5 deletions

diff --git a/lacme b/lacme
index edcc77e..03ce556 100755
--- a/lacme
+++ b/lacme
@@ -408,7 +408,7 @@ sub acme_client($@) {
             drop_privileges($accountd->{user}, $accountd->{group}, '/');
             set_FD_CLOEXEC($s, 0);
             $client->close() or die "Can't close: $!";
-            my @cmd = ($accountd->{command}, '--fdopen='.fileno($s));
+            my @cmd = ($accountd->{command}, '--fd-conn='.fileno($s));
             push @cmd, '--config='.$accountd->{config}   if defined $accountd->{config};
             push @cmd, '--privkey='.$accountd->{privkey} if defined $accountd->{privkey};
             push @cmd, '--quiet' unless lc $accountd->{quiet} eq 'no';
diff --git a/lacme-accountd b/lacme-accountd
index 411538d..55ae0c0 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -59,7 +59,7 @@ sub usage(;$$) {
     }
     exit $rv;
 }
-usage(1) unless GetOptions(\%OPTS, qw/config=s privkey=s socket=s fdopen=i quiet|q debug help|h/);
+usage(1) unless GetOptions(\%OPTS, qw/config=s privkey=s socket=s fd-conn=i quiet|q debug help|h/);
 usage(0) if $OPTS{help};
 
 do {
@@ -137,8 +137,9 @@ $JWK = JSON::->new->encode($JWK);
 # to support the abstract namespace.)  The downside is that we have to
 # delete the file manually.
 #
-if (defined $OPTS{fdopen}) {
-    die "Invalid file descriptor" unless $OPTS{fdopen} =~ /\A(\d+)\z/;
+if (defined $OPTS{'fd-conn'}) {
+    die "Invalid file descriptor" unless $OPTS{'fd-conn'} =~ /\A(\d+)\z/;
+    # untaint and fdopen(3) our end of the socket pair
     open $S, '+<&=', $1 or die "fdopen $1: $!";
 } else {
     my $sockname = $OPTS{socket} // (defined $ENV{XDG_RUNTIME_DIR} ? "$ENV{XDG_RUNTIME_DIR}/S.lacme" : undef);
@@ -182,7 +183,7 @@ sub conn($;$) {
     }
 }
 
-if (defined $OPTS{fdopen}) {
+if (defined $OPTS{'fd-conn'}) {
     conn($S, $$);
 } else {
     $SIG{PIPE} = 'IGNORE'; # ignore broken pipes