From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from eggs.gnu.org (eggs.gnu.org [IPv6:2001:470:142:3::10]) by sourceware.org (Postfix) with ESMTPS id CA004385842C for ; Sat, 22 Apr 2023 11:50:33 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org CA004385842C Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gnu.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gnu.org Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pqBlB-00070P-BO; Sat, 22 Apr 2023 07:50:33 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=In-Reply-To:MIME-Version:References:Subject:To:From: Date; bh=sjC2Hxp9yB27C0cksOosI1XfZfHpNvN5zhcJMwr/Y0U=; b=sPGUfvw5ESqIJDjZ8/SI ynulB9BUPBeO/NjoWUAVPgx84mVJ+1qT/zUsbiKARQbPPrToBEezruLWBcJ5MqhstNFCCYCzoFyno 9+ruyWsnzMHBPkho4IqLBaUqDooe3QyQvARgVWjvDXDAxz4122XDujjRdOTp5PkGscS6THzs/9VMC 6lYHEp6nyn7iWrs8E/HypwAAJKj/HzDk2Oj+TPCCOv8aZ/qKYASxxYVTHGkvkH2NH1DPpZOXTuMm4 UuZEfOC9tpufACzxcvrD49FB42YB5D2XrulIu5TxCO0q1IqcARQtY5HMg44pigxMeIxvgaeFynOgT L3LYoR7qoBKB8w==; Received: from [2a01:cb19:4a:a400:de41:a9ff:fe47:ec49] (helo=begin) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pqBlB-0005iL-28; Sat, 22 Apr 2023 07:50:33 -0400 Received: from samy by begin with local (Exim 4.96) (envelope-from ) id 1pqBl9-00698E-1m; Sat, 22 Apr 2023 13:50:31 +0200 Date: Sat, 22 Apr 2023 13:50:31 +0200 From: Samuel Thibault To: Adhemerval Zanella Netto Cc: Sergey Bugaev , libc-alpha@sourceware.org, bug-hurd@gnu.org, Cristian =?utf-8?Q?Rodr=C3=ADguez?= Subject: Re: [RFC PATCH v2 3/7] Use O_CLOEXEC in more places (BZ #15722) Message-ID: <20230422115031.hwamfyjbyicekyw7@begin> Mail-Followup-To: Adhemerval Zanella Netto , Sergey Bugaev , libc-alpha@sourceware.org, bug-hurd@gnu.org, Cristian =?utf-8?Q?Rodr=C3=ADguez?= References: <20230419160207.65988-1-bugaevc@gmail.com> <20230419160207.65988-4-bugaevc@gmail.com> <941e4a09-2c4f-4740-9437-3a111d76aed4@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <941e4a09-2c4f-4740-9437-3a111d76aed4@linaro.org> Organization: I am not organized User-Agent: NeoMutt/20170609 (1.8.3) X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,SPF_HELO_PASS,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Applied, thanks! Adhemerval Zanella Netto, le ven. 21 avril 2023 09:55:58 -0300, a ecrit: > > > On 19/04/23 13:02, Sergey Bugaev wrote: > > When opening a temporary file without O_CLOEXEC we risk leaking the > > file descriptor if another thread calls (fork and then) exec while we > > have the fd open. Fix this by consistently passing O_CLOEXEC everywhere > > where we open a file for internal use (and not to return it to the user, > > in which case the API defines whether or not the close-on-exec flag > > shall be set on the returned fd). > > > > Reviewed-by: Adhemerval Zanella > > Signed-off-by: Sergey Bugaev > > LGTM, thanks. I can be installed independently. > > > --- > > catgets/open_catalog.c | 4 ++-- > > elf/dl-profile.c | 3 ++- > > gmon/gmon.c | 7 ++++--- > > iconv/gconv_cache.c | 2 +- > > login/utmp_file.c | 2 +- > > sysdeps/pthread/sem_open.c | 9 ++++++--- > > 6 files changed, 16 insertions(+), 11 deletions(-) > > > > diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c > > index 242709db..46c444d2 100644 > > --- a/catgets/open_catalog.c > > +++ b/catgets/open_catalog.c > > @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > > char *buf = NULL; > > > > if (strchr (cat_name, '/') != NULL || nlspath == NULL) > > - fd = __open_nocancel (cat_name, O_RDONLY); > > + fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC); > > else > > { > > const char *run_nlspath = nlspath; > > @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > > > > if (bufact != 0) > > { > > - fd = __open_nocancel (buf, O_RDONLY); > > + fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC); > > if (fd >= 0) > > break; > > } > > diff --git a/elf/dl-profile.c b/elf/dl-profile.c > > index 2ecac05f..d8345da2 100644 > > --- a/elf/dl-profile.c > > +++ b/elf/dl-profile.c > > @@ -324,7 +324,8 @@ _dl_start_profile (void) > > *cp++ = '/'; > > __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile"); > > > > - fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE); > > + fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW > > + | O_CLOEXEC, DEFFILEMODE); > > if (fd == -1) > > { > > char buf[400]; > > diff --git a/gmon/gmon.c b/gmon/gmon.c > > index bc0e2943..6439ed1c 100644 > > --- a/gmon/gmon.c > > +++ b/gmon/gmon.c > > @@ -384,13 +384,14 @@ write_gmon (void) > > size_t len = strlen (env); > > char buf[len + 20]; > > __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ()); > > - fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666); > > + fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW > > + | O_CLOEXEC, 0666); > > } > > > > if (fd == -1) > > { > > - fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, > > - 0666); > > + fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY > > + | O_NOFOLLOW | O_CLOEXEC, 0666); > > if (fd < 0) > > { > > char buf[300]; > > diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c > > index f2100ca8..87136e24 100644 > > --- a/iconv/gconv_cache.c > > +++ b/iconv/gconv_cache.c > > @@ -58,7 +58,7 @@ __gconv_load_cache (void) > > return -1; > > > > /* See whether the cache file exists. */ > > - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); > > + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); > > if (__builtin_expect (fd, 0) == -1) > > /* Not available. */ > > return -1; > > diff --git a/login/utmp_file.c b/login/utmp_file.c > > index 53494595..1ef07821 100644 > > --- a/login/utmp_file.c > > +++ b/login/utmp_file.c > > @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp) > > int fd; > > > > /* Open WTMP file. */ > > - fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE); > > + fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC); > > if (fd < 0) > > return -1; > > > > diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c > > index 2d32a135..e5db929d 100644 > > --- a/sysdeps/pthread/sem_open.c > > +++ b/sysdeps/pthread/sem_open.c > > @@ -36,6 +36,7 @@ sem_t * > > __sem_open (const char *name, int oflag, ...) > > { > > int fd; > > + int open_flags; > > sem_t *result; > > > > /* Check that shared futexes are supported. */ > > @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...) > > /* If the semaphore object has to exist simply open it. */ > > if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0) > > { > > + open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC; > > + open_flags |= (oflag & ~(O_CREAT|O_ACCMODE)); > > try_again: > > - fd = __open (dirname.name, > > - (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR); > > + fd = __open (dirname.name, open_flags); > > > > if (fd == -1) > > { > > @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...) > > } > > > > /* Open the file. Make sure we do not overwrite anything. */ > > - fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode); > > + open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC; > > + fd = __open (tmpfname, open_flags, mode); > > if (fd == -1) > > { > > if (errno == EEXIST) > -- Samuel --- Pour une évaluation indépendante, transparente et rigoureuse ! Je soutiens la Commission d'Évaluation de l'Inria.