Use O_CLOEXEC in more places (BZ #15722)

When opening a temporary file without O_CLOEXEC we risk leaking the
file descriptor if another thread calls (fork and then) exec while we
have the fd open. Fix this by consistently passing O_CLOEXEC everywhere
where we open a file for internal use (and not to return it to the user,
in which case the API defines whether or not the close-on-exec flag
shall be set on the returned fd).

Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
Message-Id: <20230419160207.65988-4-bugaevc@gmail.com>

diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c
index 242709db73dab65a66b1f27160f9f0c611af5b28..46c444d25996aa33bed2380d7884481cee4dbb40 100644 (file)
--- a/catgets/open_catalog.c
+++ b/catgets/open_catalog.c
@@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
   char *buf = NULL;
 
   if (strchr (cat_name, '/') != NULL || nlspath == NULL)
-    fd = __open_nocancel (cat_name, O_RDONLY);
+    fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC);
   else
     {
       const char *run_nlspath = nlspath;
@@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
 
          if (bufact != 0)
            {
-             fd = __open_nocancel (buf, O_RDONLY);
+             fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC);
              if (fd >= 0)
                break;
            }

diff --git a/elf/dl-profile.c b/elf/dl-profile.c
index 2ecac05f8df2a301d8c90c1e4ae5f95ac8fabeda..d8345da22e503a6b8dacd5da9ada11e137366a06 100644 (file)
--- a/elf/dl-profile.c
+++ b/elf/dl-profile.c
@@ -324,7 +324,8 @@ _dl_start_profile (void)
   *cp++ = '/';
   __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile");
 
-  fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE);
+  fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW
+                         | O_CLOEXEC, DEFFILEMODE);
   if (fd == -1)
     {
       char buf[400];

diff --git a/gmon/gmon.c b/gmon/gmon.c
index bc0e29438a02cbe7db36e0a1d3b5495547277ec3..6439ed1caa1a6e5d9f885aff53cd374a986f6ea1 100644 (file)
--- a/gmon/gmon.c
+++ b/gmon/gmon.c
@@ -384,13 +384,14 @@ write_gmon (void)
        size_t len = strlen (env);
        char buf[len + 20];
        __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ());
-       fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666);
+       fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW
+                             | O_CLOEXEC, 0666);
       }
 
     if (fd == -1)
       {
-       fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW,
-                             0666);
+       fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY
+                             | O_NOFOLLOW | O_CLOEXEC, 0666);
        if (fd < 0)
          {
            char buf[300];

diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c
index f2100ca88f91c14644deb06891bb9331dca0672b..87136e2402c0d93ce2fc39b29564465141d64636 100644 (file)
--- a/iconv/gconv_cache.c
+++ b/iconv/gconv_cache.c
@@ -58,7 +58,7 @@ __gconv_load_cache (void)
     return -1;
 
   /* See whether the cache file exists.  */
-  fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0);
+  fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0);
   if (__builtin_expect (fd, 0) == -1)
     /* Not available.  */
     return -1;

diff --git a/login/utmp_file.c b/login/utmp_file.c
index 534945958122f97a3f8863c945d60b6b5eebb665..1ef07821397b1c612a9ad8ebff32467ea1e7cb32 100644 (file)
--- a/login/utmp_file.c
+++ b/login/utmp_file.c
@@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp)
   int fd;
 
   /* Open WTMP file.  */
-  fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE);
+  fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC);
   if (fd < 0)
     return -1;
 

diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c
index 2d32a13557ef29e26cf49256f70345d61ba11d2f..e5db929d205e05fbbc841d169b7af9baa70dbb05 100644 (file)
--- a/sysdeps/pthread/sem_open.c
+++ b/sysdeps/pthread/sem_open.c
@@ -36,6 +36,7 @@ sem_t *
 __sem_open (const char *name, int oflag, ...)
 {
   int fd;
+  int open_flags;
   sem_t *result;
 
   /* Check that shared futexes are supported.  */
@@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...)
   /* If the semaphore object has to exist simply open it.  */
   if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0)
     {
+      open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC;
+      open_flags |= (oflag & ~(O_CREAT|O_ACCMODE));
     try_again:
-      fd = __open (dirname.name,
-                  (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR);
+      fd = __open (dirname.name, open_flags);
 
       if (fd == -1)
        {
@@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...)
            }
 
          /* Open the file.  Make sure we do not overwrite anything.  */
-         fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode);
+         open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC;
+         fd = __open (tmpfname, open_flags, mode);
          if (fd == -1)
            {
              if (errno == EEXIST)