sshd and file descriptors

[Andreas Hasenack]

I have an openssh RPM package that restarts the sshd server during
an upgrade if the daemon is already running. So far, so good, restart
works.

But I observed the following behaviour:
- when issuing rpm -Uvh bla.rpm, rpm, obviously, opens the rpm file and
  gets a file descriptor. Say, 8.
- rpm does its stuff and spawns a shell to execute the %post script. The
  shell also gets fd 8 (should rpm close all descriptors before executing
  its scripts? More below).
- the script decides at some point to restart sshd. It stops the daemon
  and starts a new one. The new sshd daemon also gets fd 8 pointing to
  the rpm package. Shouldn't sshd close all descriptors before
  daemonizing?

If I do this remotely I then get the famous hang-on-exit problem.

For example (just after upgrading the packages)

# ls -la /proc/15301/fd
total 0
dr-x------    2 root     root            0 Jun 26 19:02 ./
dr-xr-xr-x    3 root     root            0 Jun 26 19:02 ../
lrwx------    1 root     root           64 Jun 26 19:02 0 -> /dev/null
lrwx------    1 root     root           64 Jun 26 19:02 1 -> /dev/null
lrwx------    1 root     root           64 Jun 26 19:02 16 -> /dev/pts/0
lrwx------    1 root     root           64 Jun 26 19:02 2 -> /dev/null
l-wx------    1 root     root           64 Jun 26 19:02 21 -> /dev/null
lrwx------    1 root     root           64 Jun 26 19:02 3 -> socket:[192227]
lr-x------    1 root     root           64 Jun 26 19:02 7 -> pipe:[192223]
lr-x------    1 root     root           64 Jun 26 19:02 8 -> /home/user/rpm/RPMS/i386/openssh-server-3.4p1-1cl.i386.rpm
l-wx------    1 root     root           64 Jun 26 19:02 9 -> pipe:[192223]

Shouldn't a daemon close all fds before going into "daemon land"? What exactly is broken here?