Typo in default pidfile in fail2ban.conf
FD_CLOEXEC support

 * 001-fail2ban-server-socket-close-on-exec-no-leak.diff

Add code that marks server and client sockets with FD_CLOEXEC flags.
Avoid leaking file descriptors to processes spawned when handling
fail2ban actions (ex: iptables).

Unix sockets managed by fail2ban-server don't need to be passed to any
child process. Fail2ban already uses the FD_CLOEXEC flags in the filter
code.

This patch also avoids giving iptables access to fail2ban UNIX socket in
a SELinux environment (A sane SELinux policy should trigger an audit
event because "iptables" will be given read/write access to the fail2ban
control socket).

Some random references related to this bug:
 http://sourceforge.net/tracker/?func=detail&atid=689044&aid=2086568&group_id=121032
 http://www.redhat.com/archives/fedora-selinux-list/2009-June/msg00124.html
 http://forums.fedoraforum.org/showthread.php?t=234230

 * 002-fail2ban-filters-close-on-exec-typo-fix.diff

There is a typo in the fail2ban server/filter.py source code. The
FD_CLOEXEC is correctly set but additional *random* flags are also set.
It has no side-effect as long as the fd doesn't match a valid flag :)
"fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)" <== the 3rd
parameter should be flags, not a file descriptor.

 * 003-fail2ban-gamin-socket-close-on-exec-no-leak.diff

Add code that marks the Gamin monitor file descriptor with FD_CLOEXEC
flags. Avoid leaking file descriptors to processes spawned when handling
fail2ban actions (ex: iptables).

---

File descriptors in action process before patches:
dr-x------ 2 root root  0 .
dr-xr-xr-x 8 root root  0 ..
lr-x------ 1 root root 64 0 -> /dev/null        <== OK
l-wx------ 1 root root 64 1 -> /tmp/test.log    <== used by test action
lrwx------ 1 root root 64 2 -> /dev/null        <== OK
lrwx------ 1 root root 64 3 -> socket:[116361]  <== NOK (fail2ban.sock leak)
lr-x------ 1 root root 64 4 -> /proc/20090/fd   <== used by test action
l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK
lrwx------ 1 root root 64 6 -> socket:[115608]  <== NOK (gamin sock leak)

File descriptors in action process after patches:
dr-x------ 2 root root  0 .
dr-xr-xr-x 8 root root  0 ..
lr-x------ 1 root root 64 0 -> /dev/null        <== OK
l-wx------ 1 root root 64 1 -> /tmp/test.log    <== used by test action
lrwx------ 1 root root 64 2 -> /dev/null        <== OK
lr-x------ 1 root root 64 3 -> /proc/18284/fd   <== used by test action
l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK
Merge remote-tracking branch 'github_kwirk_fail2ban/pidfile'

* github_kwirk_fail2ban/pidfile:
  Typo in default pidfile in fail2ban.conf
Merge remote-tracking branch 'pr/167/head': FD_CLOEXEC bug fixes (filters) + support (actions). Avoid sockets descriptors leak.

* pr/167/head:
  FD_CLOEXEC support
DOC: thanks @kwirk for spotting the typos in exception message
TST: no cover additions to server, primarily daemon creation
TST: Coverage for coveralls.io should only be run on success
ENH: Minor change to action for consistency of execStart/Stop
TST: Add tag replace and escape test for actions
TST: test all valid loglevels in server testcases
Merge pull request #172 from kwirk/minor

Minor tweaks -- removing duplication and improving testing
DOC: initiated changelog (but not juice left to actually fill it up ;-))
Merge branch 'master' into 0.9

* master:
  DOC: initiated changelog (but not juice left to actually fill it up ;-))
  TST: test all valid loglevels in server testcases
  TST: Add tag replace and escape test for actions
  ENH: Minor change to action for consistency of execStart/Stop
  TST: Coverage for coveralls.io should only be run on success
  TST: no cover additions to server, primarily daemon creation
  DOC: thanks @kwirk for spotting the typos in exception message
  FD_CLOEXEC support
  Typo in default pidfile in fail2ban.conf

Conflicts:
	.travis.yml   -- after_success
	ChangeLog     -- added perspective changelog for 0.8.9
	fail2ban/server/asyncserver.py -- imports
	fail2ban/server/server.py -- no pragma (if I got it right ;-) )