From patchwork Mon Apr 17 22:58:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Bugaev X-Patchwork-Id: 1769903 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.a=rsa-sha256 header.s=default header.b=O0FrZKZs; dkim-atps=neutral Received: from sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Q0jFB6QXGz1ybC for ; Tue, 18 Apr 2023 09:00:14 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id D543D3857718 for ; Mon, 17 Apr 2023 23:00:12 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D543D3857718 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1681772412; bh=zO86PVT5+Se/6AiVW6f2U1nxvwuo8rCc0xaNAU33C8M=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=O0FrZKZsAJZtY+tke43HhICR5QClER23aI4nH344oFM9AQOpBD14wY9BEoBTDcFfg s8mezfefv9Cru/73PGeLrypaRzsYquYj/o/Of7aTQ2Cp9GEpFohQ6yaGoB+LHCw245 fw1drAfaq53kT/BwQbBZ36Om6WyWuRXiBsUDPOeo= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) by sourceware.org (Postfix) with ESMTPS id F06F03858C5F for ; Mon, 17 Apr 2023 22:59:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org F06F03858C5F Received: by mail-lj1-x236.google.com with SMTP id k15so10294003ljq.4 for ; Mon, 17 Apr 2023 15:59:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681772347; x=1684364347; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zO86PVT5+Se/6AiVW6f2U1nxvwuo8rCc0xaNAU33C8M=; b=SJE2i/q0Z17xVl9uyFsr4Pk222hRCiE6f9B33egmrQUokgsk6MSvMwxrTdHdLeVVL9 qrMlR0mZyONePm6DgplGMgD+tZpRVDPzyiUPb7UGqccGVurv3kZKFsaG+4kjLATPvHkO XlBtJcCg49kLw8T0bH7+sVQ+QOXHz3MSUWkwGuPYq3Dre+CFzxTM1DS3WwH49JHNacxh 8QVNBv5nIwr7NRyMrir6fsojJEYNWC2TrOp3tH+EDG94MZCzd3N8Yccr6cyPSXX5eDlC V8jC/p93h+LXKE5EcLl7QbGudOKIQjqY48zuoI9pq28dQhQEVVyAuqE4Ifi96hYU1+7X mhOg== X-Gm-Message-State: AAQBX9e9+38076T2IqU9PBiKy7Jp2HSNkaKoxy/o/0lyTpX3QBz6dS/e ctZV8Qc92JXXd0jq+f+WlMlC8I3Sno93Ig== X-Google-Smtp-Source: AKy350bFR40AwylSBUU0ohelo1axAFjWiaqC+PVl8pVx7ALCoZhYZoCaqw3Bfnet0YO+zu4pST7Ecg== X-Received: by 2002:a2e:9004:0:b0:2a8:adf6:b0e2 with SMTP id h4-20020a2e9004000000b002a8adf6b0e2mr128736ljg.13.1681772347119; Mon, 17 Apr 2023 15:59:07 -0700 (PDT) Received: from surface-pro-6.. ([2a00:1370:818c:4a57:d907:80f6:db70:646a]) by smtp.gmail.com with ESMTPSA id f7-20020a2ea0c7000000b002a8b5310642sm1463539ljm.5.2023.04.17.15.59.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Apr 2023 15:59:06 -0700 (PDT) To: libc-alpha@sourceware.org, bug-hurd@gnu.org Cc: Samuel Thibault , Sergey Bugaev Subject: [RFC PATCH 2/5] Use O_CLOEXEC in more places Date: Tue, 18 Apr 2023 01:58:54 +0300 Message-Id: <20230417225857.2006561-3-bugaevc@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230417225857.2006561-1-bugaevc@gmail.com> References: <20230417225857.2006561-1-bugaevc@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-11.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Sergey Bugaev via Libc-alpha From: Sergey Bugaev Reply-To: Sergey Bugaev Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Sender: "Libc-alpha" When opening a temporary file without O_CLOEXEC we risk leaking the file descriptor if another thread calls (fork and then) exec while we have the fd open. Fix this by consistently passing O_CLOEXEC everywhere where we open a file for internal use (and not to return it to the user, in which case the API defines whether or not the close-on-exec flag shall be set on the returned fd). Signed-off-by: Sergey Bugaev Reviewed-by: Adhemerval Zanella --- catgets/open_catalog.c | 4 ++-- elf/dl-profile.c | 3 ++- gmon/gmon.c | 7 ++++--- iconv/gconv_cache.c | 2 +- login/utmp_file.c | 2 +- sysdeps/pthread/sem_open.c | 9 ++++++--- 6 files changed, 16 insertions(+), 11 deletions(-) diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c index 242709db..46c444d2 100644 --- a/catgets/open_catalog.c +++ b/catgets/open_catalog.c @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, char *buf = NULL; if (strchr (cat_name, '/') != NULL || nlspath == NULL) - fd = __open_nocancel (cat_name, O_RDONLY); + fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC); else { const char *run_nlspath = nlspath; @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, if (bufact != 0) { - fd = __open_nocancel (buf, O_RDONLY); + fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC); if (fd >= 0) break; } diff --git a/elf/dl-profile.c b/elf/dl-profile.c index 2ecac05f..d8345da2 100644 --- a/elf/dl-profile.c +++ b/elf/dl-profile.c @@ -324,7 +324,8 @@ _dl_start_profile (void) *cp++ = '/'; __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile"); - fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE); + fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW + | O_CLOEXEC, DEFFILEMODE); if (fd == -1) { char buf[400]; diff --git a/gmon/gmon.c b/gmon/gmon.c index bc0e2943..6439ed1c 100644 --- a/gmon/gmon.c +++ b/gmon/gmon.c @@ -384,13 +384,14 @@ write_gmon (void) size_t len = strlen (env); char buf[len + 20]; __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ()); - fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666); + fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW + | O_CLOEXEC, 0666); } if (fd == -1) { - fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, - 0666); + fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY + | O_NOFOLLOW | O_CLOEXEC, 0666); if (fd < 0) { char buf[300]; diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c index f2100ca8..87136e24 100644 --- a/iconv/gconv_cache.c +++ b/iconv/gconv_cache.c @@ -58,7 +58,7 @@ __gconv_load_cache (void) return -1; /* See whether the cache file exists. */ - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); if (__builtin_expect (fd, 0) == -1) /* Not available. */ return -1; diff --git a/login/utmp_file.c b/login/utmp_file.c index 53494595..1ef07821 100644 --- a/login/utmp_file.c +++ b/login/utmp_file.c @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp) int fd; /* Open WTMP file. */ - fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE); + fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC); if (fd < 0) return -1; diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c index 2d32a135..e5db929d 100644 --- a/sysdeps/pthread/sem_open.c +++ b/sysdeps/pthread/sem_open.c @@ -36,6 +36,7 @@ sem_t * __sem_open (const char *name, int oflag, ...) { int fd; + int open_flags; sem_t *result; /* Check that shared futexes are supported. */ @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...) /* If the semaphore object has to exist simply open it. */ if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0) { + open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC; + open_flags |= (oflag & ~(O_CREAT|O_ACCMODE)); try_again: - fd = __open (dirname.name, - (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR); + fd = __open (dirname.name, open_flags); if (fd == -1) { @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...) } /* Open the file. Make sure we do not overwrite anything. */ - fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode); + open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC; + fd = __open (tmpfname, open_flags, mode); if (fd == -1) { if (errno == EEXIST)