From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oa1-x2b.google.com (mail-oa1-x2b.google.com [IPv6:2001:4860:4864:20::2b]) by sourceware.org (Postfix) with ESMTPS id 35367385772A for ; Fri, 21 Apr 2023 12:56:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 35367385772A Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org Received: by mail-oa1-x2b.google.com with SMTP id 586e51a60fabf-187c78c6657so1267314fac.2 for ; Fri, 21 Apr 2023 05:56:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1682081761; x=1684673761; h=content-transfer-encoding:in-reply-to:organization:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to; bh=EHVX6f3vf1TvZvon8DWG7UToZPuhkn4kKsvas/MJ0/g=; b=Cu0/aerl0KSc9a6SzvhssEWtQFD8I/6Tnc/na7b0n/7TlA6hheCy3WRZZKqeW2rRIf O/NlCgX5uQSn/WCTQFneCaba4hshLh9AYXz/I/Kv+LDFacYq+LGvTNGIST/5aMW0vGxV J+QiZrwWO/micrFu+YqiHXPskqY57q1esNLiq5eK11cFLrK/SW2njNETJW7K34tg0dEh GxKsQYfOubQhaZ3wbHTuFkLIJs7iucv6hob4hujxYaiAwpsRtHAMp9ALPxoQndAUsDc9 AsTTf3789VJAVXA6B1d5VjrWwu5jj0Lwt4BRSswe3p1wEpDelSIZdI20IaIiRqeVLSao nkAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682081761; x=1684673761; h=content-transfer-encoding:in-reply-to:organization:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=EHVX6f3vf1TvZvon8DWG7UToZPuhkn4kKsvas/MJ0/g=; b=b97rDLSbqKonObdnWCM9JExD0EfaId0XFnnKbn9SVXgOF49OMDpbGTDxQ0ORFu5Hyj uJGxN640GEnUdlxnnVgdBIghg9Rsx9L6DLfXfbzie3eSW1UEUYuG/OCCi/2/QbOOv/AH iXtHQkhbHC0kxMEVpCt3UIOZQFeXWZLAFuxUaIWUkU4xBOjzpiVt3hBWxJqWzs6DQmgK ZEkx7hKgVBIbpGEtJzJas/CnUBwic0jEfzAZ2eaGbDGM8GWlreLO+VWLwEGd9CLTzhd0 0lOyZlOFPd3sBHx9/uPPcsP0DFXRW1Wqn3R8BRuDc8D1fYXsP0iTdc6XunfodSysA4cC 9t+A== X-Gm-Message-State: AAQBX9fYu4wOEQiL+Dfct75pdOFxMf9t8axT+IWM5jBhvNmMwsKnVG0y nQiRQeUnIOeV8NyO+4AgYeZxnw== X-Google-Smtp-Source: AKy350ZJmDlB+CBDrWN+Z4ahxlwDumhE3YtTWb1CGSc2SHZHXPbQTkh8WM7ebQk8fs79S81I8aiGBw== X-Received: by 2002:a05:6870:c0d4:b0:184:2399:8730 with SMTP id e20-20020a056870c0d400b0018423998730mr3667789oad.6.1682081761590; Fri, 21 Apr 2023 05:56:01 -0700 (PDT) Received: from ?IPV6:2804:1b3:a7c3:333:20b7:b016:1b7f:fd25? ([2804:1b3:a7c3:333:20b7:b016:1b7f:fd25]) by smtp.gmail.com with ESMTPSA id p7-20020a9d7447000000b006a4cceaf8ecsm1770501otk.48.2023.04.21.05.55.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 21 Apr 2023 05:56:00 -0700 (PDT) Message-ID: <941e4a09-2c4f-4740-9437-3a111d76aed4@linaro.org> Date: Fri, 21 Apr 2023 09:55:58 -0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: [RFC PATCH v2 3/7] Use O_CLOEXEC in more places (BZ #15722) Content-Language: en-US To: Sergey Bugaev , libc-alpha@sourceware.org Cc: bug-hurd@gnu.org, Samuel Thibault , =?UTF-8?Q?Cristian_Rodr=c3=adguez?= References: <20230419160207.65988-1-bugaevc@gmail.com> <20230419160207.65988-4-bugaevc@gmail.com> From: Adhemerval Zanella Netto Organization: Linaro In-Reply-To: <20230419160207.65988-4-bugaevc@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-14.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 19/04/23 13:02, Sergey Bugaev wrote: > When opening a temporary file without O_CLOEXEC we risk leaking the > file descriptor if another thread calls (fork and then) exec while we > have the fd open. Fix this by consistently passing O_CLOEXEC everywhere > where we open a file for internal use (and not to return it to the user, > in which case the API defines whether or not the close-on-exec flag > shall be set on the returned fd). > > Reviewed-by: Adhemerval Zanella > Signed-off-by: Sergey Bugaev LGTM, thanks. I can be installed independently. > --- > catgets/open_catalog.c | 4 ++-- > elf/dl-profile.c | 3 ++- > gmon/gmon.c | 7 ++++--- > iconv/gconv_cache.c | 2 +- > login/utmp_file.c | 2 +- > sysdeps/pthread/sem_open.c | 9 ++++++--- > 6 files changed, 16 insertions(+), 11 deletions(-) > > diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c > index 242709db..46c444d2 100644 > --- a/catgets/open_catalog.c > +++ b/catgets/open_catalog.c > @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > char *buf = NULL; > > if (strchr (cat_name, '/') != NULL || nlspath == NULL) > - fd = __open_nocancel (cat_name, O_RDONLY); > + fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC); > else > { > const char *run_nlspath = nlspath; > @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > > if (bufact != 0) > { > - fd = __open_nocancel (buf, O_RDONLY); > + fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC); > if (fd >= 0) > break; > } > diff --git a/elf/dl-profile.c b/elf/dl-profile.c > index 2ecac05f..d8345da2 100644 > --- a/elf/dl-profile.c > +++ b/elf/dl-profile.c > @@ -324,7 +324,8 @@ _dl_start_profile (void) > *cp++ = '/'; > __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile"); > > - fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE); > + fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW > + | O_CLOEXEC, DEFFILEMODE); > if (fd == -1) > { > char buf[400]; > diff --git a/gmon/gmon.c b/gmon/gmon.c > index bc0e2943..6439ed1c 100644 > --- a/gmon/gmon.c > +++ b/gmon/gmon.c > @@ -384,13 +384,14 @@ write_gmon (void) > size_t len = strlen (env); > char buf[len + 20]; > __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ()); > - fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666); > + fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW > + | O_CLOEXEC, 0666); > } > > if (fd == -1) > { > - fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, > - 0666); > + fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY > + | O_NOFOLLOW | O_CLOEXEC, 0666); > if (fd < 0) > { > char buf[300]; > diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c > index f2100ca8..87136e24 100644 > --- a/iconv/gconv_cache.c > +++ b/iconv/gconv_cache.c > @@ -58,7 +58,7 @@ __gconv_load_cache (void) > return -1; > > /* See whether the cache file exists. */ > - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); > + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); > if (__builtin_expect (fd, 0) == -1) > /* Not available. */ > return -1; > diff --git a/login/utmp_file.c b/login/utmp_file.c > index 53494595..1ef07821 100644 > --- a/login/utmp_file.c > +++ b/login/utmp_file.c > @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp) > int fd; > > /* Open WTMP file. */ > - fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE); > + fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC); > if (fd < 0) > return -1; > > diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c > index 2d32a135..e5db929d 100644 > --- a/sysdeps/pthread/sem_open.c > +++ b/sysdeps/pthread/sem_open.c > @@ -36,6 +36,7 @@ sem_t * > __sem_open (const char *name, int oflag, ...) > { > int fd; > + int open_flags; > sem_t *result; > > /* Check that shared futexes are supported. */ > @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...) > /* If the semaphore object has to exist simply open it. */ > if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0) > { > + open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC; > + open_flags |= (oflag & ~(O_CREAT|O_ACCMODE)); > try_again: > - fd = __open (dirname.name, > - (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR); > + fd = __open (dirname.name, open_flags); > > if (fd == -1) > { > @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...) > } > > /* Open the file. Make sure we do not overwrite anything. */ > - fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode); > + open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC; > + fd = __open (tmpfname, open_flags, mode); > if (fd == -1) > { > if (errno == EEXIST)