From 533deafbdf189f5fbb280c28562dd43ace2f4b0f Mon Sep 17 00:00:00 2001 From: Sergey Bugaev Date: Wed, 19 Apr 2023 19:02:03 +0300 Subject: Use O_CLOEXEC in more places (BZ #15722) When opening a temporary file without O_CLOEXEC we risk leaking the file descriptor if another thread calls (fork and then) exec while we have the fd open. Fix this by consistently passing O_CLOEXEC everywhere where we open a file for internal use (and not to return it to the user, in which case the API defines whether or not the close-on-exec flag shall be set on the returned fd). Reviewed-by: Adhemerval Zanella Signed-off-by: Sergey Bugaev Message-Id: <20230419160207.65988-4-bugaevc@gmail.com> --- iconv/gconv_cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'iconv') diff --git a/iconv/gconv_cache.c b/iconv/gconv_cache.c index f2100ca88f..87136e2402 100644 --- a/iconv/gconv_cache.c +++ b/iconv/gconv_cache.c @@ -58,7 +58,7 @@ __gconv_load_cache (void) return -1; /* See whether the cache file exists. */ - fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY, 0); + fd = __open_nocancel (GCONV_MODULES_CACHE, O_RDONLY | O_CLOEXEC, 0); if (__builtin_expect (fd, 0) == -1) /* Not available. */ return -1; -- cgit v1.2.3