Use O_CLOEXEC in {g_,}open () calls for race-free setting of the close-on-exec flag

The remaining call sites are either Windows-only, between fork () and
exec () or in xdgmime copylib.

Hope I haven't missed any site.

10 files changed, 56 insertions, 24 deletions

diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index fb6488a2a..c8aa08977 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -37,6 +37,10 @@
 #include "gwin32sid.h"
 #endif
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "gdbusauthmechanismsha1.h"
 #include "gcredentials.h"
 #include "gdbuserror.h"
@@ -519,7 +523,7 @@ create_lock_exclusive (const gchar  *lock_path,
   int errsv;
   gint ret;
 
-  ret = g_open (lock_path, O_CREAT | O_EXCL, 0600);
+  ret = g_open (lock_path, O_CREAT | O_EXCL | O_CLOEXEC, 0600);
   errsv = errno;
   if (ret < 0)
     {
diff --git a/gio/glocalfile.c b/gio/glocalfile.c
index a6fea94a2..2b43ff47c 100644
--- a/gio/glocalfile.c
+++ b/gio/glocalfile.c
@@ -51,6 +51,10 @@
 #define O_BINARY 0
 #endif
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "gfileattribute.h"
 #include "glocalfile.h"
 #include "glocalfileinfo.h"
@@ -1352,7 +1356,7 @@ g_local_file_read (GFile         *file,
   int fd, ret;
   GLocalFileStat buf;
   
-  fd = g_open (local->filename, O_RDONLY|O_BINARY, 0);
+  fd = g_open (local->filename, O_RDONLY | O_BINARY | O_CLOEXEC, 0);
   if (fd == -1)
     {
       int errsv = errno;
@@ -2227,7 +2231,7 @@ g_local_file_trash (GFile         *file,
     infofile = g_build_filename (infodir, infoname, NULL);
     g_free (infoname);
 
-    fd = g_open (infofile, O_CREAT | O_EXCL, 0666);
+    fd = g_open (infofile, O_CREAT | O_EXCL | O_CLOEXEC, 0666);
     errsv = errno;
   } while (fd == -1 && errsv == EEXIST);
 
@@ -2881,9 +2885,9 @@ g_local_file_measure_size_of_file (gint           parent_fd,
 
 #ifdef AT_FDCWD
 #ifdef HAVE_OPEN_O_DIRECTORY
-      dir_fd = openat (parent_fd, name->data, O_RDONLY|O_DIRECTORY);
+      dir_fd = openat (parent_fd, name->data, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
 #else
-      dir_fd = openat (parent_fd, name->data, O_RDONLY);
+      dir_fd = openat (parent_fd, name->data, O_RDONLY | O_CLOEXEC);
 #endif
       errsv = errno;
       if (dir_fd < 0)
diff --git a/gio/glocalfileinfo.c b/gio/glocalfileinfo.c
index 420e9d4b2..dab34c67b 100644
--- a/gio/glocalfileinfo.c
+++ b/gio/glocalfileinfo.c
@@ -92,6 +92,10 @@
 #endif
 #endif
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "glocalfileinfo.h"
 #include "gioerror.h"
 #include "gthemedicon.h"
@@ -1391,11 +1395,11 @@ get_content_type (const char          *basename,
 	    sniff_length = 4096;
 
 #ifdef O_NOATIME	  
-          fd = g_open (path, O_RDONLY | O_NOATIME, 0);
+          fd = g_open (path, O_RDONLY | O_NOATIME | O_CLOEXEC, 0);
           errsv = errno;
           if (fd < 0 && errsv == EPERM)
 #endif
-	    fd = g_open (path, O_RDONLY, 0);
+	    fd = g_open (path, O_RDONLY | O_CLOEXEC, 0);
 
 	  if (fd != -1)
 	    {
diff --git a/gio/glocalfileoutputstream.c b/gio/glocalfileoutputstream.c
index 3ce987fba..74a642da8 100644
--- a/gio/glocalfileoutputstream.c
+++ b/gio/glocalfileoutputstream.c
@@ -700,7 +700,7 @@ _g_local_file_output_stream_open  (const char        *filename,
   if (g_cancellable_set_error_if_cancelled (cancellable, error))
     return NULL;
 
-  open_flags = O_BINARY;
+  open_flags = O_BINARY | O_CLOEXEC;
   if (readable)
     open_flags |= O_RDWR;
   else
@@ -737,7 +737,7 @@ _g_local_file_output_stream_create  (const char        *filename,
 
   mode = mode_from_flags_or_info (flags, reference_info);
 
-  open_flags = O_CREAT | O_EXCL | O_BINARY;
+  open_flags = O_CREAT | O_EXCL | O_BINARY | O_CLOEXEC;
   if (readable)
     open_flags |= O_RDWR;
   else
@@ -762,7 +762,7 @@ _g_local_file_output_stream_append  (const char        *filename,
   else
     mode = 0666;
 
-  return output_stream_open (filename, O_CREAT | O_APPEND | O_WRONLY | O_BINARY, mode,
+  return output_stream_open (filename, O_CREAT | O_APPEND | O_WRONLY | O_BINARY | O_CLOEXEC, mode,
                              cancellable, error);
 }
 
@@ -865,9 +865,9 @@ handle_overwrite_open (const char    *filename,
   /* We only need read access to the original file if we are creating a backup.
    * We also add O_CREAT to avoid a race if the file was just removed */
   if (create_backup || readable)
-    open_flags = O_RDWR | O_CREAT | O_BINARY;
+    open_flags = O_RDWR | O_CREAT | O_BINARY | O_CLOEXEC;
   else
-    open_flags = O_WRONLY | O_CREAT | O_BINARY;
+    open_flags = O_WRONLY | O_CREAT | O_BINARY | O_CLOEXEC;
   
   /* Some systems have O_NOFOLLOW, which lets us avoid some races
    * when finding out if the file we opened was a symlink */
@@ -1113,7 +1113,7 @@ handle_overwrite_open (const char    *filename,
 	}
 
       bfd = g_open (backup_filename,
-		    O_WRONLY | O_CREAT | O_EXCL | O_BINARY,
+		    O_WRONLY | O_CREAT | O_EXCL | O_BINARY | O_CLOEXEC,
 		    _g_stat_mode (&original_stat) & 0777);
 
       if (bfd == -1)
@@ -1208,9 +1208,9 @@ handle_overwrite_open (const char    *filename,
 	}
 
       if (readable)
-	open_flags = O_RDWR | O_CREAT | O_BINARY;
+	open_flags = O_RDWR | O_CREAT | O_BINARY | O_CLOEXEC;
       else
-	open_flags = O_WRONLY | O_CREAT | O_BINARY;
+	open_flags = O_WRONLY | O_CREAT | O_BINARY | O_CLOEXEC;
       fd = g_open (filename, open_flags, mode);
       if (fd == -1)
 	{
diff --git a/gio/kqueue/gkqueuefilemonitor.c b/gio/kqueue/gkqueuefilemonitor.c
index f69f98e1c..b664753a1 100644
--- a/gio/kqueue/gkqueuefilemonitor.c
+++ b/gio/kqueue/gkqueuefilemonitor.c
@@ -32,6 +32,10 @@
 #include <fcntl.h>
 #include <string.h>
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include <glib-object.h>
 #include <glib/gfileutils.h>
 #include <gio/gfilemonitor.h>
@@ -583,7 +587,7 @@ _kqsub_start_watching (kqueue_sub *sub)
   struct stat st;
   struct kevent ev;
 
-  sub->fd = open (sub->filename, O_KQFLAG);
+  sub->fd = open (sub->filename, O_KQFLAG | O_CLOEXEC);
   if (sub->fd == -1)
       return FALSE;
 
diff --git a/glib/gfileutils.c b/glib/gfileutils.c
index 826c5e242..ef3fc90f2 100644
--- a/glib/gfileutils.c
+++ b/glib/gfileutils.c
@@ -329,7 +329,7 @@ g_mkdir_with_parents (const gchar *pathname,
  *    }
  *
  *  // DO THIS INSTEAD
- *  fd = g_open (filename, O_WRONLY | O_NOFOLLOW);
+ *  fd = g_open (filename, O_WRONLY | O_NOFOLLOW | O_CLOEXEC);
  *  if (fd == -1)
  *    {
  *      // check error
@@ -908,7 +908,7 @@ get_contents_posix (const gchar  *filename,
   gint fd;
 
   /* O_BINARY useful on Cygwin */
-  fd = open (filename, O_RDONLY|O_BINARY);
+  fd = open (filename, O_RDONLY | O_BINARY | O_CLOEXEC);
 
   if (fd < 0)
     {
@@ -1083,7 +1083,7 @@ rename_file (const char  *old_name,
   if (do_fsync)
     {
       gchar *dir = g_path_get_dirname (new_name);
-      int dir_fd = g_open (dir, O_RDONLY, 0);
+      int dir_fd = g_open (dir, O_RDONLY | O_CLOEXEC, 0);
 
       if (dir_fd >= 0)
         {
diff --git a/glib/giounix.c b/glib/giounix.c
index 067cecf9a..9d9492b28 100644
--- a/glib/giounix.c
+++ b/glib/giounix.c
@@ -44,6 +44,10 @@
 #include <fcntl.h>
 #include <glib/gstdio.h>
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "giochannel.h"
 
 #include "gerror.h"
@@ -527,7 +531,7 @@ g_io_channel_new_file (const gchar *filename,
 
   create_mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH;
 
-  fid = g_open (filename, flags, create_mode);
+  fid = g_open (filename, flags | O_CLOEXEC, create_mode);
   if (fid == -1)
     {
       int err = errno;
diff --git a/glib/gkeyfile.c b/glib/gkeyfile.c
index fb65d55c5..9a4821bc5 100644
--- a/glib/gkeyfile.c
+++ b/glib/gkeyfile.c
@@ -53,6 +53,10 @@
 
 #endif  /* G_OS_WIN23 */
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "gconvert.h"
 #include "gdataset.h"
 #include "gerror.h"
@@ -761,7 +765,7 @@ find_file_in_data_dirs (const gchar   *file,
           path = g_build_filename (data_dir, sub_dir,
                                    candidate_file, NULL);
 
-          fd = g_open (path, O_RDONLY, 0);
+          fd = g_open (path, O_RDONLY | O_CLOEXEC, 0);
 
           if (fd == -1)
             {
@@ -917,7 +921,7 @@ g_key_file_load_from_file (GKeyFile       *key_file,
   g_return_val_if_fail (key_file != NULL, FALSE);
   g_return_val_if_fail (file != NULL, FALSE);
 
-  fd = g_open (file, O_RDONLY, 0);
+  fd = g_open (file, O_RDONLY | O_CLOEXEC, 0);
   errsv = errno;
 
   if (fd == -1)
diff --git a/glib/gmappedfile.c b/glib/gmappedfile.c
index 16b38b358..4d7a89eb2 100644
--- a/glib/gmappedfile.c
+++ b/glib/gmappedfile.c
@@ -50,6 +50,10 @@
 
 #endif
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "gconvert.h"
 #include "gerror.h"
 #include "gfileutils.h"
@@ -252,7 +256,7 @@ g_mapped_file_new (const gchar  *filename,
   g_return_val_if_fail (filename != NULL, NULL);
   g_return_val_if_fail (!error || *error == NULL, NULL);
 
-  fd = g_open (filename, (writable ? O_RDWR : O_RDONLY) | _O_BINARY, 0);
+  fd = g_open (filename, (writable ? O_RDWR : O_RDONLY) | _O_BINARY | O_CLOEXEC, 0);
   if (fd == -1)
     {
       int save_errno = errno;
diff --git a/gmodule/gmodule.c b/gmodule/gmodule.c
index 00a2c055f..aafaaf0ad 100644
--- a/gmodule/gmodule.c
+++ b/gmodule/gmodule.c
@@ -45,6 +45,10 @@
 #include <io.h>		/* For open() and close() prototypes. */
 #endif
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 #include "gmoduleconf.h"
 #include "gstdio.h"
 
@@ -388,7 +392,7 @@ parse_libtool_archive (const gchar* libtool_name)
   GTokenType token;
   GScanner *scanner;
   
-  int fd = g_open (libtool_name, O_RDONLY, 0);
+  int fd = g_open (libtool_name, O_RDONLY | O_CLOEXEC, 0);
   if (fd < 0)
     {
       gchar *display_libtool_name = g_filename_display_name (libtool_name);