os.RemoveAll: openFdAt function without O_CLOEXEC and cause fd escape to child process [1.12 backport]

[gopherbot]

@oiooj requested issue #33405 to be considered for backport to the next 1.12 minor release.

Yes, I think it should be backport to 1.12. Hi, @gopherbot please open backport to 1.12

[gopherbot]

Change https://golang.org/cl/188538 mentions this issue: [release-branch.go1.12] os: enable the close-on-exec flag for openFdAt

[oiooj]

Ping @ianlancetaylor

[gopherbot]

Closed by merging 047a326 to release-branch.go1.12.

[dmitshur]

This backport has been approved and merged to the release branch; updating label to CherryPickApproved to reflect that. The rationale was that this was a serious problem with no workaround.

[oiooj]

@dmitshur I was surprised that this fix is not in the 1.12.8 release. https://groups.google.com/forum/m/#!topic/golang-dev/CL4in60FCuA

[dmitshur]

@oiooj It's because Go 1.12.8 was a security release, so its contents are just Go 1.12.7 with the security fixes applied. The next point release, Go 1.12.9, will include both the security fixes from 1.12.8 and all other changes that have been backported to the 1.12 release branch (release-branch.go1.12) since 1.12.7. This backport will be included.

[oiooj]

@dmitshur Thanks, but the users need to wait for another month? and some users thought that this fixed in v1.12.8 release, see kubernetes/minikube#5087 and kubernetes/kubernetes#79912.

[dmitshur]

The Go 1.12.9 point release is coming out very soon after the security release. It's planned to be released today.

[fuweid]

@dmitshur I was thinking it is in the .8 point release. Is it good idea to have pre-release note about the coming point release? I checked https://groups.google.com/forum/#!topic/golang-nuts/-Ba7cHufTKc and considered the fd leaking is one of security issue. But it didn't. So if there is any pre-release note, it will be helpful! thanks

[dmitshur]

For security releases, we can't include the details of the security fixes in the pre-announcement until the security release is available. For all other releases, you can look at the upcoming milestone, e.g., Go1.12.9, and see which cherry-pick candidates have been approved to get a sense what's coming in the next point release. See https://golang.org/wiki/MinorReleases and https://golang.org/security for more information about this process.

If you'd like to discuss the release process further or make suggestions, please start a new thread in the golang-dev mailing list.

[fuweid]

@dmitshur thanks for the reply.