From ba52b3b624e4a1a976908552364eba924ca45430 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Tue, 7 May 2024 12:05:58 +0100 Subject: [PATCH] tools/xl: Open xldevd.log with O_CLOEXEC MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit `xl devd` has been observed leaking /var/log/xldevd.log into children. Note this is specifically safe; dup2() leaves O_CLOEXEC disabled on newfd, so after setting up stdout/stderr, it's only the logfile fd which will close on exec(). Link: https://github.com/QubesOS/qubes-issues/issues/8292 Reported-by: Demi Marie Obenour Signed-off-by: Andrew Cooper Reviewed-by: Marek Marczykowski-Górecki Reviewed-by: Demi Marie Obenour Acked-by: Anthony PERARD Release-Acked-by: Oleksii Kurochko --- tools/xl/xl_utils.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/xl/xl_utils.c b/tools/xl/xl_utils.c index 17489d1829..b0d23b2cdb 100644 --- a/tools/xl/xl_utils.c +++ b/tools/xl/xl_utils.c @@ -27,6 +27,10 @@ #include "xl.h" #include "xl_utils.h" +#ifndef O_CLOEXEC +#define O_CLOEXEC 0 +#endif + void dolog(const char *file, int line, const char *func, const char *fmt, ...) { va_list ap; @@ -270,7 +274,7 @@ int do_daemonize(const char *name, const char *pidfile) exit(-1); } - CHK_SYSCALL(logfile = open(fullname, O_WRONLY|O_CREAT|O_APPEND, 0644)); + CHK_SYSCALL(logfile = open(fullname, O_WRONLY | O_CREAT | O_APPEND | O_CLOEXEC, 0644)); free(fullname); assert(logfile >= 3); -- 2.39.5