Re: [PATCH v2 0/3] fcntl fortification

[Florian Weimer <fweimer@redhat.com>]

* Sergey Bugaev:

>> Oh, I'm not sure if the run-time check is really that useful.
>>
>> There's no vfcntl function, so I expect that we will have accurate type
>> information at the callsite in most cases, and the compile-time check
>> works.
>
> I see. Well, I copied what the open () fortification was doing, and I
> see that many other fortifications have a runtime-checked version in
> addition to compile-time checks.
>
> There is no vopen either, but it's not hard to imagine someone doing
>
> open (path, O_WRITE | O_CREAT | (cloexec ? O_CLOEXEC : 0))
>
> and similarly
>
> fcntl (fd, cloexec ? F_DUPFD_CLOEXEC : F_DUPFD)
>
> in both cases __builtin_constant_p will be false, and the user will
> miss out on the fortification, and won't notice they forgot the
> required 3rd argument.

That suggests that we should apply __builtin_constant_p to the result of
the cmd check, and not the cmd value.  So something like

  (__builtin_constant_p ((cmd) == F_DUPFD || (cmd) == F_DUPFD_CLOEXEC)
   && ((cmd) == F_DUPFD || (cmd) == F_DUPFD_CLOEXEC))

with a potential guard against evaluating cmd multiple times.

Thanks,
Florian