[shadow-maint/shadow] Add cheap defense mechanisms (PR #1171)

[Alejandro Colomar]

Hi,

On Mon, Feb 17, 2025 at 10:42:11AM +0100, Alejandro Colomar wrote:
> On Sun, Feb 16, 2025 at 06:15:18PM -0800, Karlson2k wrote:
> > Karlson2k left a comment (shadow-maint/shadow#1171)
> > 
> > Doesn't use of glibc extensions break functioning with non-glibc, like musl?

After reading musl's source code, it does support 'e'.  And it does so
since 2012.  Which libc are you using?  And which version?

	alx@devuan:~/src/musl/libc/master$ grepc fopen .
	./include/stdio.h:FILE *fopen(const char *__restrict, const char *__restrict);
	./src/stdio/fopen.c:FILE *fopen(const char *restrict filename, const char *restrict mode)
	{
		FILE *f;
		int fd;
		int flags;

		/* Check for valid initial mode character */
		if (!strchr("rwa", *mode)) {
			errno = EINVAL;
			return 0;
		}

		/* Compute the flags to pass to open() */
		flags = __fmodeflags(mode);

		fd = sys_open(filename, flags, 0666);
		if (fd < 0) return 0;
		if (flags & O_CLOEXEC)
			__syscall(SYS_fcntl, fd, F_SETFD, FD_CLOEXEC);

		f = __fdopen(fd, mode);
		if (f) return f;

		__syscall(SYS_close, fd);
		return 0;
	}
	alx@devuan:~/src/musl/libc/master$ grepc __fmodeflags .
	./src/stdio/__fmodeflags.c:int __fmodeflags(const char *mode)
	{
		int flags;
		if (strchr(mode, '+')) flags = O_RDWR;
		else if (*mode == 'r') flags = O_RDONLY;
		else flags = O_WRONLY;
		if (strchr(mode, 'x')) flags |= O_EXCL;
		if (strchr(mode, 'e')) flags |= O_CLOEXEC;
		if (*mode != 'r') flags |= O_CREAT;
		if (*mode == 'w') flags |= O_TRUNC;
		if (*mode == 'a') flags |= O_APPEND;
		return flags;
	}
	./src/internal/stdio_impl.h:hidden int __fmodeflags(const char *);
	alx@devuan:~/src/musl/libc/master$ git blame -- src/stdio/__fmodeflags.c | grep CLOEXEC
	892cafff6 (Rich Felker 2012-10-24 21:16:06 -0400 11) 	if (strchr(mode, 'e')) flags |= O_CLOEXEC;
	alx@devuan:~/src/musl/libc/master$ git show 892cafff6 | grep -e CLOEXEC -e ^diff | head -n5
	diff --git a/src/internal/stdio_impl.h b/src/internal/stdio_impl.h
	diff --git a/src/stdio/__fmodeflags.c b/src/stdio/__fmodeflags.c
	+	if (strchr(mode, 'e')) flags |= O_CLOEXEC;
	diff --git a/src/stdio/fopen.c b/src/stdio/fopen.c
	-	if (strchr(mode, 'e')) flags |= O_CLOEXEC;
	alx@devuan:~/src/musl/libc/master$ git blame 892cafff6^ -- src/stdio/fopen.c | grep CLOEXEC
	8582a6e9f (Rich Felker 2012-09-29 18:09:34 -0400 20) 	if (strchr(mode, 'e')) flags |= O_CLOEXEC;
	alx@devuan:~/src/musl/libc/master$ git log -1 8582a6e9f
	commit 8582a6e9f25dd7b87d72961f58008052a4cac473
	Author: Rich Felker <dalias@aerifal.cx>
	Date:   Sat Sep 29 18:09:34 2012 -0400

	    add 'e' modifier (close-on-exec) to fopen and fdopen
	    
	    this feature will be in the next version of POSIX, and can be used
	    internally immediately. there are many internal uses of fopen where
	    close-on-exec is needed to fix bugs.


Cheers,
Alex

-- 
<https://www.alejandro-colomar.es/>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-help/attachments/20250217/5f4ee26e/attachment.sig>