journald: close passed fds we cannot make sense of

This is mostly likely the audit socket, and we really should close it
if we cannot make sense of it, since as long as it is open the kernel
might disable the kmsg forwarding of audit msgs, and we should avoid
that, since audit msgs might get completely lost then.

I also downgraded the log message we show a bit, after all things should
really work fine, and we proceed fine with it.

1 files changed, 10 insertions, 2 deletions

diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 3bee18b35b..80c9736420 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1552,8 +1552,16 @@ int server_init(Server *s) {
 
                         s->audit_fd = fd;
 
-                } else
-                        log_error("Unknown socket passed as file descriptor %d, ignoring.", fd);
+                } else {
+                        log_warning("Unknown socket passed as file descriptor %d, ignoring.", fd);
+
+                        /* Let's close the fd, better be safe than
+                           sorry. The fd might reference some resource
+                           that we really want to release if we don't
+                           make use of it. */
+
+                        safe_close(fd);
+                }
         }
 
         r = server_open_syslog_socket(s);