Message ID | 20230417225857.2006561-3-bugaevc@gmail.com |
---|---|
State | New |
Headers | show |
Series | O_IGNORE_CTTY everywhere | expand |
On 17/04/23 19:58, Sergey Bugaev via Libc-alpha wrote: > When opening a temporary file without O_CLOEXEC we risk leaking the > file descriptor if another thread calls (fork and then) exec while we > have the fd open. Fix this by consistently passing O_CLOEXEC everywhere > where we open a file for internal use (and not to return it to the user, > in which case the API defines whether or not the close-on-exec flag > shall be set on the returned fd). > > Signed-off-by: Sergey Bugaev <bugaevc@gmail.com> This is BZ#15722 [1], so I think you should advertise on subject. Patch LGMT, thanks. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> [1] https://sourceware.org/bugzilla/show_bug.cgi?id=15722 > --- > catgets/open_catalog.c | 4 ++-- > elf/dl-profile.c | 3 ++- > gmon/gmon.c | 7 ++++--- > iconv/gconv_cache.c | 2 +- > login/utmp_file.c | 2 +- > sysdeps/pthread/sem_open.c | 9 ++++++--- > 6 files changed, 16 insertions(+), 11 deletions(-) > > diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c > index 242709db..46c444d2 100644 > --- a/catgets/open_catalog.c > +++ b/catgets/open_catalog.c > @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > char *buf = NULL; > > if (strchr (cat_name, '/') != NULL || nlspath == NULL) > - fd = __open_nocancel (cat_name, O_RDONLY); > + fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC); > else > { > const char *run_nlspath = nlspath; > @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, > > if (bufact != 0) > { > - fd = __open_nocancel (buf, O_RDONLY); > + fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC); > if (fd >= 0) > break; > } > diff --git a/elf/dl-profile.c b/elf/dl-profile.c > index 2ecac05f..d8345da2 100644 > --- a/elf/dl-profile.c > +++ b/elf/dl-profile.c > @@ -324,7 +324,8 @@ _dl_start_profile (void) > *cp++ = '/'; > __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile"); > > - fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE); > + fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW > + | O_CLOEXEC, DEFFILEMODE); > if (fd == -1) > { > char buf[400]; > diff --git a/gmon/gmon.c b/gmon/gmon.c > index bc0e2943..6439ed1c 100644 > --- a/gmon/gmon.c > +++ b/gmon/gmon.c > @@ -384,13 +384,14 @@ write_gmon (void) > size_t len = strlen (env); > char buf[len + 20]; > __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ()); > - fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666); > + fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW > + | O_CLOEXEC, 0666); > } > > if (fd == -1) > { > - fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, > - 0666); > + fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY > + | O_NOFOLLOW | O_CLOEXEC, 0666); > if (fd < 0) > { > char buf[300]; > diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c > index f2100ca8..87136e24 100644 > --- a/iconv/gconv_cache.c > +++ b/iconv/gconv_cache.c > @@ -58,7 +58,7 @@ __gconv_load_cache (void) > return -1; > > /* See whether the cache file exists. */ > - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); > + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); > if (__builtin_expect (fd, 0) == -1) > /* Not available. */ > return -1; > diff --git a/login/utmp_file.c b/login/utmp_file.c > index 53494595..1ef07821 100644 > --- a/login/utmp_file.c > +++ b/login/utmp_file.c > @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp) > int fd; > > /* Open WTMP file. */ > - fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE); > + fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC); > if (fd < 0) > return -1; > > diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c > index 2d32a135..e5db929d 100644 > --- a/sysdeps/pthread/sem_open.c > +++ b/sysdeps/pthread/sem_open.c > @@ -36,6 +36,7 @@ sem_t * > __sem_open (const char *name, int oflag, ...) > { > int fd; > + int open_flags; > sem_t *result; > > /* Check that shared futexes are supported. */ > @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...) > /* If the semaphore object has to exist simply open it. */ > if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0) > { > + open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC; > + open_flags |= (oflag & ~(O_CREAT|O_ACCMODE)); > try_again: > - fd = __open (dirname.name, > - (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR); > + fd = __open (dirname.name, open_flags); > > if (fd == -1) > { > @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...) > } > > /* Open the file. Make sure we do not overwrite anything. */ > - fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode); > + open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC; > + fd = __open (tmpfname, open_flags, mode); > if (fd == -1) > { > if (errno == EEXIST)
diff --git a/catgets/open_catalog.c b/catgets/open_catalog.c index 242709db..46c444d2 100644 --- a/catgets/open_catalog.c +++ b/catgets/open_catalog.c @@ -49,7 +49,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, char *buf = NULL; if (strchr (cat_name, '/') != NULL || nlspath == NULL) - fd = __open_nocancel (cat_name, O_RDONLY); + fd = __open_nocancel (cat_name, O_RDONLY | O_CLOEXEC); else { const char *run_nlspath = nlspath; @@ -177,7 +177,7 @@ __open_catalog (const char *cat_name, const char *nlspath, const char *env_var, if (bufact != 0) { - fd = __open_nocancel (buf, O_RDONLY); + fd = __open_nocancel (buf, O_RDONLY | O_CLOEXEC); if (fd >= 0) break; } diff --git a/elf/dl-profile.c b/elf/dl-profile.c index 2ecac05f..d8345da2 100644 --- a/elf/dl-profile.c +++ b/elf/dl-profile.c @@ -324,7 +324,8 @@ _dl_start_profile (void) *cp++ = '/'; __stpcpy (__stpcpy (cp, GLRO(dl_profile)), ".profile"); - fd = __open64_nocancel (filename, O_RDWR|O_CREAT|O_NOFOLLOW, DEFFILEMODE); + fd = __open64_nocancel (filename, O_RDWR | O_CREAT | O_NOFOLLOW + | O_CLOEXEC, DEFFILEMODE); if (fd == -1) { char buf[400]; diff --git a/gmon/gmon.c b/gmon/gmon.c index bc0e2943..6439ed1c 100644 --- a/gmon/gmon.c +++ b/gmon/gmon.c @@ -384,13 +384,14 @@ write_gmon (void) size_t len = strlen (env); char buf[len + 20]; __snprintf (buf, sizeof (buf), "%s.%u", env, __getpid ()); - fd = __open_nocancel (buf, O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, 0666); + fd = __open_nocancel (buf, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW + | O_CLOEXEC, 0666); } if (fd == -1) { - fd = __open_nocancel ("gmon.out", O_CREAT|O_TRUNC|O_WRONLY|O_NOFOLLOW, - 0666); + fd = __open_nocancel ("gmon.out", O_CREAT | O_TRUNC | O_WRONLY + | O_NOFOLLOW | O_CLOEXEC, 0666); if (fd < 0) { char buf[300]; diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c index f2100ca8..87136e24 100644 --- a/iconv/gconv_cache.c +++ b/iconv/gconv_cache.c @@ -58,7 +58,7 @@ __gconv_load_cache (void) return -1; /* See whether the cache file exists. */ - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); if (__builtin_expect (fd, 0) == -1) /* Not available. */ return -1; diff --git a/login/utmp_file.c b/login/utmp_file.c index 53494595..1ef07821 100644 --- a/login/utmp_file.c +++ b/login/utmp_file.c @@ -463,7 +463,7 @@ __libc_updwtmp (const char *file, const struct utmp *utmp) int fd; /* Open WTMP file. */ - fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE); + fd = __open_nocancel (file, O_WRONLY | O_LARGEFILE | O_CLOEXEC); if (fd < 0) return -1; diff --git a/sysdeps/pthread/sem_open.c b/sysdeps/pthread/sem_open.c index 2d32a135..e5db929d 100644 --- a/sysdeps/pthread/sem_open.c +++ b/sysdeps/pthread/sem_open.c @@ -36,6 +36,7 @@ sem_t * __sem_open (const char *name, int oflag, ...) { int fd; + int open_flags; sem_t *result; /* Check that shared futexes are supported. */ @@ -64,9 +65,10 @@ __sem_open (const char *name, int oflag, ...) /* If the semaphore object has to exist simply open it. */ if ((oflag & O_CREAT) == 0 || (oflag & O_EXCL) == 0) { + open_flags = O_RDWR | O_NOFOLLOW | O_CLOEXEC; + open_flags |= (oflag & ~(O_CREAT|O_ACCMODE)); try_again: - fd = __open (dirname.name, - (oflag & ~(O_CREAT|O_ACCMODE)) | O_NOFOLLOW | O_RDWR); + fd = __open (dirname.name, open_flags); if (fd == -1) { @@ -133,7 +135,8 @@ __sem_open (const char *name, int oflag, ...) } /* Open the file. Make sure we do not overwrite anything. */ - fd = __open (tmpfname, O_RDWR | O_CREAT | O_EXCL, mode); + open_flags = O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC; + fd = __open (tmpfname, open_flags, mode); if (fd == -1) { if (errno == EEXIST)
When opening a temporary file without O_CLOEXEC we risk leaking the file descriptor if another thread calls (fork and then) exec while we have the fd open. Fix this by consistently passing O_CLOEXEC everywhere where we open a file for internal use (and not to return it to the user, in which case the API defines whether or not the close-on-exec flag shall be set on the returned fd). Signed-off-by: Sergey Bugaev <bugaevc@gmail.com> --- catgets/open_catalog.c | 4 ++-- elf/dl-profile.c | 3 ++- gmon/gmon.c | 7 ++++--- iconv/gconv_cache.c | 2 +- login/utmp_file.c | 2 +- sysdeps/pthread/sem_open.c | 9 ++++++--- 6 files changed, 16 insertions(+), 11 deletions(-)