lib/: Set O_CLOEXEC for static FILE handles

With glibc we can use "e" in mode argument to set O_CLOEXEC on opened files. The /etc/shadow and /etc/gshadow file handles should be protected to make sure that they are never passed to child processes by accident. Reviewed-by: Alejandro Colomar <alx@kernel.org> Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
shadow-maint · Jan 10, 2025 · aebc4dd · aebc4dd
1 parent a772484
commit aebc4dd
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/gshadow.c b/lib/gshadow.c
@@ -55,7 +55,7 @@ void setsgent (void)
 	if (NULL != shadow) {
 		rewind (shadow);
 	} else {
-		shadow = fopen (SGROUP_FILE, "r");
+		shadow = fopen (SGROUP_FILE, "re");
 	}
 }
 

diff --git a/lib/shadow.c b/lib/shadow.c
@@ -41,7 +41,7 @@ void setspent (void)
 	if (NULL != shadow) {
 		rewind (shadow);
 	}else {
-		shadow = fopen (SHADOW_FILE, "r");
+		shadow = fopen (SHADOW_FILE, "re");
 	}
 }