Dan Walsh's Blog

Got SELinux?

Previous Entry Share Next Entry
Excuse me son, but your code is leaking !!!
I have written over the years about leaked file descriptors, and what a pain they have been to SELinux.

C on Unix many many years ago was designed to leak by default.  A file descriptor is leaked if you open a file descriptor or socket and then do a fork/exec.  The new process will automatically get access to the file descriptor unless SELinux blocks it. 

When SELinux blocks the leaked file descriptor you usually end up with a strange looking AVC about the new domain trying to read or write a random file or a socket owned by the parent or even worse an ancestor.

Talking with Uli Drepper the other day about leaked file descriptors.  He reminded me that the gcc/glibc teams had added a flags to open,fopen, socket, accept4 to change the default.

man open

Sadly this can not be made the default, but as a good programing practice all open/socket,accept and fopen calls should use this flag in order to close the file descriptor by default.

open(path, O_CLOEXEC | flags)
accept4(int sockfd, struct sockaddr *addr, socklen_t *addrlen, SOCK_CLOEXEC | flags);
fopen(path, "re")

If you can not open a file descriptor with one of these commands then you can execute

fctnl(fd, F_SETFD, FD_CLOEXEC)

He gcc developers or code analysys tools, you probably should catch when leaks happen, especially if they are not STDIN, STDOUT, STDERR.

Just be neat and stop leaking all over the place.

No HTML allowed in subject


(will be screened)

You are viewing danwalsh