From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id CF91D27479 for ; Mon, 11 Mar 2024 22:21:13 +0100 (CET) Received: (qmail 3072 invoked by uid 550); 11 Mar 2024 21:17:02 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 2028 invoked from network); 11 Mar 2024 21:17:02 -0000 From: "Laurent Bercot" To: musl@lists.openwall.com, "Skyler Ferrante (RIT Student)" Cc: "Andreas Schwab" , "Alejandro Colomar" , "Thorsten Glaser" , musl@lists.openwall.com, NRK , "Guillem Jover" , libc-alpha@sourceware.org, libbsd@lists.freedesktop.org, "Serge E. Hallyn" , "Iker Pedrosa" , "Christian Brauner" Date: Mon, 11 Mar 2024 21:21:00 +0000 Message-Id: In-Reply-To: <20240311194756.GY4163@brightrain.aerifal.cx> References: <20240310193956.GU4163@brightrain.aerifal.cx> <20240310234410.GW4163@brightrain.aerifal.cx> <20240311194756.GY4163@brightrain.aerifal.cx> User-Agent: eM_Client/9.2.2157.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Subject: Re: [musl] Re: Tweaking the program name for functions >(Aside: making _FORTIFY_SOURCE>1 trap close(n) with n<3 would be an >interesting idea... :) Please don't. close(0); if (open("something", O_RDONLY)) fail(); (only when single-threaded, obviously) is a valid pattern, and uses one fewer descriptor than fd=3Dopen("something", O_RDONLY); dup2(fd, 0); Also, running with stdin or stdout closed (or even stderr but what kind of monster would do that) is fine for a process that is internal to a project, that isn't user-facing; it's on the project to know the fd states of its various components. Private APIs should not have the same constraints as public ones. (And yes, for user-facing programs, i.e. 99% of them, it is a good idea to always sanitize around 0, 1 and 2.) -- Laurent