From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 30 Oct 2014 15:23:34 +0000 (+0100)
Subject: memfd: always create our memfds with CLOEXEC set
X-Git-Tag: v218~659
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=45071fcaa03eafc27352987fa2277b2792725036;ds=sidebyside

memfd: always create our memfds with CLOEXEC set

We really shouldn't create fds ever that have the flag unset.
---

diff --git a/src/libsystemd/sd-bus/bus-kernel.c b/src/libsystemd/sd-bus/bus-kernel.c
index 032761474..3f8b0ab65 100644
--- a/src/libsystemd/sd-bus/bus-kernel.c
+++ b/src/libsystemd/sd-bus/bus-kernel.c
@@ -1129,7 +1129,7 @@ int bus_kernel_pop_memfd(sd_bus *bus, void **address, size_t *mapped, size_t *al
                 if (!g)
                         return -ENOMEM;
 
-                r = memfd_create(g, MFD_ALLOW_SEALING);
+                r = memfd_create(g, MFD_ALLOW_SEALING|MFD_CLOEXEC);
                 if (r < 0)
                         return -errno;
 
diff --git a/src/shared/memfd.c b/src/shared/memfd.c
index 162c12f7a..f3ce8f84d 100644
--- a/src/shared/memfd.c
+++ b/src/shared/memfd.c
@@ -65,7 +65,7 @@ int memfd_new(const char *name) {
                 }
         }
 
-        fd = memfd_create(name, MFD_ALLOW_SEALING);
+        fd = memfd_create(name, MFD_ALLOW_SEALING | MFD_CLOEXEC);
         if (fd < 0)
                 return -errno;
 
diff --git a/src/shared/missing.h b/src/shared/missing.h
index 7725e4729..0d7c55952 100644
--- a/src/shared/missing.h
+++ b/src/shared/missing.h
@@ -74,7 +74,11 @@
 #endif
 
 #ifndef MFD_ALLOW_SEALING
-#define MFD_ALLOW_SEALING 0x0002ULL
+#define MFD_ALLOW_SEALING 0x0002U
+#endif
+
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
 #endif
 
 #ifndef IP_FREEBIND