[xen master] tools/xl: Open xldevd.log with O_CLOEXEC

[patchbot@xxxxxxx]

commit ba52b3b624e4a1a976908552364eba924ca45430
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue May 7 12:05:58 2024 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Mon Jun 24 16:22:59 2024 +0100

    tools/xl: Open xldevd.log with O_CLOEXEC
    
    `xl devd` has been observed leaking /var/log/xldevd.log into children.
    
    Note this is specifically safe; dup2() leaves O_CLOEXEC disabled on newfd, 
so
    after setting up stdout/stderr, it's only the logfile fd which will close on
    exec().
    
    Link: https://github.com/QubesOS/qubes-issues/issues/8292
    Reported-by: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>
    Acked-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
    Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
---
 tools/xl/xl_utils.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/xl/xl_utils.c b/tools/xl/xl_utils.c
index 17489d1829..b0d23b2cdb 100644
--- a/tools/xl/xl_utils.c
+++ b/tools/xl/xl_utils.c
@@ -27,6 +27,10 @@
 #include "xl.h"
 #include "xl_utils.h"
 
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
 void dolog(const char *file, int line, const char *func, const char *fmt, ...)
 {
     va_list ap;
@@ -270,7 +274,7 @@ int do_daemonize(const char *name, const char *pidfile)
         exit(-1);
     }
 
-    CHK_SYSCALL(logfile = open(fullname, O_WRONLY|O_CREAT|O_APPEND, 0644));
+    CHK_SYSCALL(logfile = open(fullname, O_WRONLY | O_CREAT | O_APPEND | 
O_CLOEXEC, 0644));
     free(fullname);
     assert(logfile >= 3);
 
--
generated by git-patchbot for /home/xen/git/xen.git#master