tree 46cbc813051cfe7f4c2be64e977916c94caa11f9
parent 80f232121b69cc69a31ccb2b38c1665d770b0710
author Christian Brauner <christian@brauner.io> 1557319669 +0200
committer Christian Brauner <christian@brauner.io> 1557327795 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE7btrcuORLb1XUhEwjrBW1T7ssS0FAlzS8CYACgkQjrBW1T7s
 sS0dkw/+P7c14NHcpb67ATt1xcjVTyVkcYJMh/XvH3+ObNpLPvq3PU/AN4p4jYe1
 6L9Bt8nxMBwyb8bWcmgPPFR7+h6y6804ETe+46sI7XR5rdveIvT/+d1uIXFDYd/1
 4ZZ7sD1qjOdZNecuLob4dZZs3DtW0x25vdfFXVUEgCzmAYyJ/KjmfZF9Ve+sPf4V
 CmGvOZkSXx8yZOUKb7IBIOMFzndbwxVYjCldXa4TxLrJ/pRsyVgy1/uKH2PLg9JA
 9x256PUV8P/v8erEABgLE4d7bN59Ke3rdasDiG1PGG0/fj3D9e8WtqUyW6zJNVcN
 RfShWhs9oL1WSM+x2E0yGMXEQLwJ9gP1mnid+pGf20h4nyv6nEKxyeJ3DDOo2ip6
 ucDkT8gbpvAiPsaey7+N34SDdbdmBkKJjzLZabB0EMqxxXlUlPUq8/Lx1CRwnrU/
 S/31WflL93MDKxekgLx8/HFIOxFcCWJwYnnSWw2WY7VZgH+F6pYh4nnDuUIgox6u
 Lsdx4Qe70CzlLkFqCsNGuc+pvPwBVL0bNV3wDCSMPU7/uAjt7pDgA/Aoqqq+oqGv
 dHRYsEOUllm0IrZe/voChlHBQbYI6REWI1zWiBZPdw0sWKsLo8vVmUAER6pB6xP4
 Q4sK4PCipl/i1BLUOwugjO0xYb86uFzVhkB5sGB1hahp85d9ajM=
 =kTD5
 -----END PGP SIGNATURE-----

fs: make all new mount api fds cloexec by default

This makes all file descriptors returned from new syscalls of the new mount
api cloexec by default.

From a userspace perspective it is rarely the case that fds are supposed to
be inherited across exec. In fact, most of the time userspace either needs
to remember to pass the <SPECIFIC>_CLOEXEC flag along or needs to invoke
fcntl() on the fd to prevent leaking the fd. This is a much bigger issue
than forgetting to remove the cloexec flag to inherit the fd.
For old fd types we can't break userspace. But for new ones we should
whenever reasonable make them cloexec by default (Examples of this policy
are the new seccomp notify fds and also pidfds.). If userspace wants to
inherit fds across exec they can remove the O_CLOEXEC flag and need to opt
in to inheritance explicitly.

Note, this also has the advantage that we can get rid of all the special
flags per file descriptor type for the new mount api. In total this lets us
remove 4 flags:
- FSMOUNT_CLOEXEC
- FSOPEN_CLOEXEC
- FSPICK_CLOEXEC
- OPEN_TREE_CLOEXEC

Signed-off-by: Christian Brauner <christian@brauner.io>
---
v1:
- David Howells <dhowells@redhat.com>:
  - ensure that only O_CLOEXEC is passed so that fd allocation doesn't
    break when new flags are added to a syscall