From: Sergey Bugaev <bugaevc@gmail.com>
To: libc-alpha@sourceware.org
Cc: bug-hurd@gnu.org, "Samuel Thibault" <samuel.thibault@gnu.org>,
"Adhemerval Zanella Netto" <adhemerval.zanella@linaro.org>,
"Cristian Rodríguez" <crrodriguez@opensuse.org>,
"Sergey Bugaev" <bugaevc@gmail.com>
Subject: [RFC PATCH v2 3/7] Use O_CLOEXEC in more places (BZ #15722)
Date: Wed, 19 Apr 2023 19:02:03 +0300 [thread overview]
Message-ID: <20230419160207.65988-4-bugaevc@gmail.com> (raw)
In-Reply-To: <20230419160207.65988-1-bugaevc@gmail.com>
When opening a temporary file without O_CLOEXEC we risk leaking the
file descriptor if another thread calls (fork and then) exec while we
have the fd open. Fix this by consistently passing O_CLOEXEC everywhere
where we open a file for internal use (and not to return it to the user,
in which case the API defines whether or not the close-on-exec flag
shall be set on the returned fd).
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
---
catgets/open_catalog.c | 4 ++--
elf/dl-profile.c | 3 ++-
gmon/gmon.c | 7 ++++---
iconv/gconv_cache.c | 2 +-
login/utmp_file.c | 2 +-
sysdeps/pthread/sem_open.c | 9 ++++++---
6 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c
index 242709db..46c444d2 100644
--- a/catgets/open_catalog.c
+++ b/catgets/open_catalog.c
@@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
char *buf = NULL;
if (strchr (cat_name, '/') != NULL || nlspath == NULL)
- fd = __open_nocancel (cat_name, O_RDONLY);
+ fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC);
else
{
const char *run_nlspath = nlspath;
@@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
if (bufact != 0)
{
- fd = __open_nocancel (buf, O_RDONLY);
+ fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC);
if (fd >= 0)
break;
}
diff --git a/elf/dl-profile.c b/elf/dl-profile.c
index 2ecac05f..d8345da2 100644
--- a/elf/dl-profile.c
+++ b/elf/dl-profile.c
@@ -324,7 +324,8 @@ _dl_start_profile (void)
*cp++ = '/';
__stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile");
- fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE);
+ fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW
+ | O_CLOEXEC, DEFFILEMODE);
if (fd == -1)
{
char buf[400];
diff --git a/gmon/gmon.c b/gmon/gmon.c
index bc0e2943..6439ed1c 100644
--- a/gmon/gmon.c
+++ b/gmon/gmon.c
@@ -384,13 +384,14 @@ write_gmon (void)
size_t len = strlen (env);
char buf[len + 20];
__snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ());
- fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666);
+ fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW
+ | O_CLOEXEC, 0666);
}
if (fd == -1)
{
- fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW,
- 0666);
+ fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY
+ | O_NOFOLLOW | O_CLOEXEC, 0666);
if (fd < 0)
{
char buf[300];
diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c
index f2100ca8..87136e24 100644
--- a/iconv/gconv_cache.c
+++ b/iconv/gconv_cache.c
@@ -58,7 +58,7 @@ __gconv_load_cache (void)
return -1;
/* See whether the cache file exists. */
- fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0);
+ fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0);
if (__builtin_expect (fd, 0) == -1)
/* Not available. */
return -1;
diff --git a/login/utmp_file.c b/login/utmp_file.c
index 53494595..1ef07821 100644
--- a/login/utmp_file.c
+++ b/login/utmp_file.c
@@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp)
int fd;
/* Open WTMP file. */
- fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE);
+ fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC);
if (fd < 0)
return -1;
diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c
index 2d32a135..e5db929d 100644
--- a/sysdeps/pthread/sem_open.c
+++ b/sysdeps/pthread/sem_open.c
@@ -36,6 +36,7 @@ sem_t *
__sem_open (const char *name, int oflag, ...)
{
int fd;
+ int open_flags;
sem_t *result;
/* Check that shared futexes are supported. */
@@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...)
/* If the semaphore object has to exist simply open it. */
if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0)
{
+ open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC;
+ open_flags |= (oflag & ~(O_CREAT|O_ACCMODE));
try_again:
- fd = __open (dirname.name,
- (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR);
+ fd = __open (dirname.name, open_flags);
if (fd == -1)
{
@@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...)
}
/* Open the file. Make sure we do not overwrite anything. */
- fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode);
+ open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC;
+ fd = __open (tmpfname, open_flags, mode);
if (fd == -1)
{
if (errno == EEXIST)
--
2.40.0
next prev parent reply other threads:[~2023-04-19 16:02 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-19 16:02 [RFC PATCH v2 0/7] O_IGNORE_CTTY everywhere & misc fixes Sergey Bugaev
2023-04-19 16:02 ` [RFC PATCH v2 1/7] misc: Convert daemon () to GNU coding style Sergey Bugaev
2023-04-21 12:18 ` Adhemerval Zanella Netto
2023-04-22 11:47 ` Samuel Thibault
2023-04-19 16:02 ` [RFC PATCH v2 2/7] misc: Ignore SIGHUP in daemon () while forking Sergey Bugaev
2023-04-21 12:55 ` Adhemerval Zanella Netto
2023-04-19 16:02 ` Sergey Bugaev [this message]
2023-04-21 12:55 ` [RFC PATCH v2 3/7] Use O_CLOEXEC in more places (BZ #15722) Adhemerval Zanella Netto
2023-04-22 11:50 ` Samuel Thibault
2023-04-19 16:02 ` [RFC PATCH v2 4/7] csu: Fix standard fds' mode Sergey Bugaev
2023-04-19 19:13 ` Cristian Rodríguez
2023-04-19 19:40 ` Sergey Bugaev
2023-04-19 20:45 ` Adhemerval Zanella Netto
2023-04-19 21:16 ` Sergey Bugaev
2023-04-20 11:47 ` Adhemerval Zanella Netto
2023-04-20 12:06 ` Cristian Rodríguez
2023-04-20 15:13 ` Adhemerval Zanella Netto
2023-04-21 17:16 ` Paul Eggert
2023-04-19 16:02 ` [RFC PATCH v2 5/7] hurd: Make dl-sysdep's open () cope with O_IGNORE_CTTY Sergey Bugaev
2023-04-20 21:06 ` Samuel Thibault
2023-04-19 16:02 ` [RFC PATCH v2 6/7] include/fcntl.h: Define O_IGNORE_CTTY Sergey Bugaev
2023-04-19 16:02 ` [RFC PATCH v2 7/7] Use O_IGNORE_CTTY where appropriate Sergey Bugaev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230419160207.65988-4-bugaevc@gmail.com \
--to=bugaevc@gmail.com \
--cc=adhemerval.zanella@linaro.org \
--cc=bug-hurd@gnu.org \
--cc=crrodriguez@opensuse.org \
--cc=libc-alpha@sourceware.org \
--cc=samuel.thibault@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).