Re: [musl] Feasibility of FD_CLOEXEC on all streams

[Rich Felker <dalias@libc.org>]

On Sun, Dec 19, 2021 at 09:54:32AM -0500, Alex Xu (Hello71) wrote:
> Excerpts from Rich Felker's message of December 18, 2021 12:26 pm:
> > On Sat, Dec 18, 2021 at 12:14:15PM -0500, Rich Felker wrote:
> >> On Sat, Dec 18, 2021 at 05:33:20PM +0100, Markus Wichmann wrote:
> >> > Hi all,
> >> > 
> >> > I was recently reading the source code of popen(), and noticed that it
> >> > has to iterate over all open files to close all the open pipe FDs the
> >> > child might inherit. And that made me wonder:
> >> > 
> >> > 1. Does POSIX allow for all FILE streams to have FD_CLOEXEC applied by
> >> > default?
> >> 
> >> No. Accessing fileno(f) is permissible subject to following the rules
> >> for active handle:
> >> 
> >> https://pubs.opengroup.org/onlinepubs/9699919799/functions/V2_chap02.html#tag_15_05_01
> >> 
> >> and that entails being able to use them according to the rules for how
> >> fds are inherited across exec.
> > 
> > Also, the POSIX spec for fopen is rather explicit:
> > 
> >     "[CX] The file descriptor associated with the opened stream shall
> >     be allocated and opened as if by a call to open() with the
> >     following flags: ..."
> > 
> > https://pubs.opengroup.org/onlinepubs/9699919799/functions/fopen.html
> 
> Playing devil's advocate here, can't the implementation unset FD_CLOEXEC 
> when fileno is called? This doesn't fix the latter issue, but if that's 
> the only problem then I would argue that it can be sufficiently covered 
> by the as-if rule.

No, because file descriptors are required to be assigned in
lowest-unused order and some really bad software could skip fileno and
just assume it got the fd number it wanted(*). In fact this is somewhat
common practice for the standard streams, albeit awful, and usually
with just plain open not fopen.

(*) One could argue that this is invalid usage, as library functions
are allowed to open and close file descriptors for their own internal
use as long as it's not visible to the application. However,
interpreted too loosely, that would effectively nullify the
lowest-unused requirement, so I would read that allowance with an
as-if rule, that the "lowest-unused" has to be assigned as if the set
of already-used fds was the same as at the time of call.

> It also wouldn't fix the popen loop, but would still 
> add some hardening for poorly written programs.

This "hardening" should be understood as avoiding a potential fd leak
in erroneous programs at the expense of *introducing use-after-close
bugs* in very-bad-style-but-correct programs. This does not seem like
a reasonable tradeoff at all.

Rich