[RFC,2/5] Use O_CLOEXEC in more places

When opening a temporary file without O_CLOEXEC we risk leaking the
file descriptor if another thread calls (fork and then) exec while we
have the fd open. Fix this by consistently passing O_CLOEXEC everywhere
where we open a file for internal use (and not to return it to the user,
in which case the API defines whether or not the close-on-exec flag
shall be set on the returned fd).

Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
---
 catgets/open_catalog.c     | 4 ++--
 elf/dl-profile.c           | 3 ++-
 gmon/gmon.c                | 7 ++++---
 iconv/gconv_cache.c        | 2 +-
 login/utmp_file.c          | 2 +-
 sysdeps/pthread/sem_open.c | 9 ++++++---
 6 files changed, 16 insertions(+), 11 deletions(-)

On 17/04/23 19:58, Sergey Bugaev via Libc-alpha wrote:
> When opening a temporary file without O_CLOEXEC we risk leaking the
> file descriptor if another thread calls (fork and then) exec while we
> have the fd open. Fix this by consistently passing O_CLOEXEC everywhere
> where we open a file for internal use (and not to return it to the user,
> in which case the API defines whether or not the close-on-exec flag
> shall be set on the returned fd).
> 
> Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>

This is BZ#15722 [1], so I think you should advertise on subject. Patch
LGMT, thanks.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=15722

> ---
>  catgets/open_catalog.c     | 4 ++--
>  elf/dl-profile.c           | 3 ++-
>  gmon/gmon.c                | 7 ++++---
>  iconv/gconv_cache.c        | 2 +-
>  login/utmp_file.c          | 2 +-
>  sysdeps/pthread/sem_open.c | 9 ++++++---
>  6 files changed, 16 insertions(+), 11 deletions(-)
> 
> diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c
> index 242709db..46c444d2 100644
> --- a/catgets/open_catalog.c
> +++ b/catgets/open_catalog.c
> @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
>    char *buf = NULL;
>  
>    if (strchr (cat_name, '/') != NULL || nlspath == NULL)
> -    fd = __open_nocancel (cat_name, O_RDONLY);
> +    fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC);
>    else
>      {
>        const char *run_nlspath = nlspath;
> @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var,
>  
>  	  if (bufact != 0)
>  	    {
> -	      fd = __open_nocancel (buf, O_RDONLY);
> +	      fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC);
>  	      if (fd >= 0)
>  		break;
>  	    }
> diff --git a/elf/dl-profile.c b/elf/dl-profile.c
> index 2ecac05f..d8345da2 100644
> --- a/elf/dl-profile.c
> +++ b/elf/dl-profile.c
> @@ -324,7 +324,8 @@ _dl_start_profile (void)
>    *cp++ = '/';
>    __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile");
>  
> -  fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE);
> +  fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW
> +			  | O_CLOEXEC, DEFFILEMODE);
>    if (fd == -1)
>      {
>        char buf[400];
> diff --git a/gmon/gmon.c b/gmon/gmon.c
> index bc0e2943..6439ed1c 100644
> --- a/gmon/gmon.c
> +++ b/gmon/gmon.c
> @@ -384,13 +384,14 @@ write_gmon (void)
>  	size_t len = strlen (env);
>  	char buf[len + 20];
>  	__snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ());
> -	fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666);
> +	fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW
> +			      | O_CLOEXEC, 0666);
>        }
>  
>      if (fd == -1)
>        {
> -	fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW,
> -			      0666);
> +	fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY
> +			      | O_NOFOLLOW | O_CLOEXEC, 0666);
>  	if (fd < 0)
>  	  {
>  	    char buf[300];
> diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c
> index f2100ca8..87136e24 100644
> --- a/iconv/gconv_cache.c
> +++ b/iconv/gconv_cache.c
> @@ -58,7 +58,7 @@ __gconv_load_cache (void)
>      return -1;
>  
>    /* See whether the cache file exists.  */
> -  fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0);
> +  fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0);
>    if (__builtin_expect (fd, 0) == -1)
>      /* Not available.  */
>      return -1;
> diff --git a/login/utmp_file.c b/login/utmp_file.c
> index 53494595..1ef07821 100644
> --- a/login/utmp_file.c
> +++ b/login/utmp_file.c
> @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp)
>    int fd;
>  
>    /* Open WTMP file.  */
> -  fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE);
> +  fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC);
>    if (fd < 0)
>      return -1;
>  
> diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c
> index 2d32a135..e5db929d 100644
> --- a/sysdeps/pthread/sem_open.c
> +++ b/sysdeps/pthread/sem_open.c
> @@ -36,6 +36,7 @@ sem_t *
>  __sem_open (const char *name, int oflag, ...)
>  {
>    int fd;
> +  int open_flags;
>    sem_t *result;
>  
>    /* Check that shared futexes are supported.  */
> @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...)
>    /* If the semaphore object has to exist simply open it.  */
>    if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0)
>      {
> +      open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC;
> +      open_flags |= (oflag & ~(O_CREAT|O_ACCMODE));
>      try_again:
> -      fd = __open (dirname.name,
> -		   (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR);
> +      fd = __open (dirname.name, open_flags);
>  
>        if (fd == -1)
>  	{
> @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...)
>  	    }
>  
>  	  /* Open the file.  Make sure we do not overwrite anything.  */
> -	  fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode);
> +	  open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC;
> +	  fd = __open (tmpfname, open_flags, mode);
>  	  if (fd == -1)
>  	    {
>  	      if (errno == EEXIST)