ext/sockets: socket_accept setting fcntl's FD_CLOEXEC on unixes.

mainly for scenarios when pcntl_fork/pcntl_exec are involved so when
the latter is executed, we avoid unwarranted effects with the file
descriptors, instead the socket will be closed on success.

close GH-14606

NEWS

@@ -269,6 +269,7 @@ PHP                                                                        NEWS
     macOs and FreeBSD. (David Carlier)
   . Added SO_LINGER_SEC for macOs, true equivalent of SO_LINGER in other platforms.
     (David Carlier)
+  . Add close-on-exec on socket created with socket_accept on unixes. (David Carlier)
 
 - SNMP:
   . Removed the deprecated inet_ntoa call support. (David Carlier)

ext/sockets/sockets.c

@@ -269,6 +269,28 @@ static bool php_accept_connect(php_socket *in_sock, php_socket *out_sock, struct
 		return 0;
 	}
 
+#if !defined(PHP_WIN32)
+	/**
+	 * accept4 could had been used but not all platforms support it (e.g. Haiku, solaris < 11.4, ...)
+	 * win32, not having any concept of child process, has no need to address it.
+	 */
+	int mode;
+
+	if ((mode = fcntl(out_sock->bsd_socket, F_GETFD)) < 0) {
+		PHP_SOCKET_ERROR(out_sock, "unable to get fcntl mode on the socket", errno);
+		return 0;
+	}
+
+	int cloexec = (mode | FD_CLOEXEC);
+
+	if (mode != cloexec) {
+		if (fcntl(out_sock->bsd_socket, F_SETFD, cloexec) < 0) {
+			PHP_SOCKET_ERROR(out_sock, "unable to set cloexec mode on the socket", errno);
+			return 0;
+		}
+	}
+#endif
+
 	out_sock->error = 0;
 	out_sock->blocking = 1;
 	out_sock->type = la->sa_family;