Do not close FDs 0, 1, or 2

If they are closed, another file descriptor could be created with these
numbers, and so standard library functions that use them might write to
an unwanted place.  dup2() a file descriptor to /dev/null over them
instead.

Also statically initialize trigger_fd to -1, which is the conventional
value for an invalid file descriptor.

This requires care to avoid closing the file descriptor to /dev/null in
fix_fds(), which took over an hour to debug.

agent/qrexec-agent.c

@@ -71,7 +71,7 @@ static libvchan_t *ctrl_vchan;
 
 static pid_t wait_for_session_pid = -1;
 
-static int trigger_fd;
+static int trigger_fd = -1;
 
 static int terminate_requested;
 
@@ -152,13 +152,18 @@ _Noreturn static void really_exec(const struct passwd *pw, char **env,
     _exit(QREXEC_EXIT_PROBLEM);
 }
 
-static void close_std(void)
+static void close_std(int null_fd)
 {
     /* close std*, so when child process closes them, qrexec-agent will receive EOF */
     /* this is the main purpose of this reimplementation of /bin/su... */
-    close(0);
-    close(1);
-    close(2);
+    for (int i = 0; i < 3; ++i) {
+        int j;
+        do {
+            j = dup2(null_fd, i);
+        } while (j == -1 && (errno == EINTR || errno == EBUSY));
+        if (j != i)
+            abort();
+    }
 }
 
 static int really_wait(pid_t child)
@@ -228,6 +233,12 @@ _Noreturn void do_exec(const char *cmd, const char *user)
             exit(QREXEC_EXIT_PROBLEM);
         }
 
+        int null_fd = open("/dev/null", O_RDWR|O_CLOEXEC);
+        if (null_fd == -1) {
+            LOG(ERROR, "cannot open /dev/null");
+            exit(QREXEC_EXIT_PROBLEM);
+        }
+
         /* FORK HERE */
         child = fork();
 
@@ -238,7 +249,7 @@ _Noreturn void do_exec(const char *cmd, const char *user)
                 really_exec(pw, environ, cmd);
             default:
                 /* parent */
-                close_std();
+                close_std(null_fd);
                 exit(really_wait(child));
         }
     }
@@ -326,6 +337,12 @@ _Noreturn void do_exec(const char *cmd, const char *user)
     if (retval != PAM_SUCCESS)
         goto error;
 
+    int null_fd = open("/dev/null", O_RDWR|O_CLOEXEC);
+    if (null_fd == -1) {
+        LOG(ERROR, "cannot open /dev/null");
+        goto error;
+    }
+
     /* FORK HERE */
     child = fork();
 
@@ -345,7 +362,7 @@ _Noreturn void do_exec(const char *cmd, const char *user)
             really_exec(pw, env, cmd);
         default:
             /* parent */
-            close_std();
+            close_std(null_fd);
     }
 
     /* reachable only in parent */