Re: [Qemu-devel] [PATCH v2 04/14] crypto: Use O_CLOEXEC in qcrypto_random_init

[Daniel P . Berrangé]

On Wed, Mar 13, 2019 at 09:55:16PM -0700, Richard Henderson wrote:
> Avoids leaking the /dev/urandom fd into any child processes.
> 
> Cc: Daniel P. Berrangé <address@hidden>
> Signed-off-by: Richard Henderson <address@hidden>
> ---
>  crypto/random-platform.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/crypto/random-platform.c b/crypto/random-platform.c
> index 0866f216dc..8bfce99a65 100644
> --- a/crypto/random-platform.c
> +++ b/crypto/random-platform.c
> @@ -42,9 +42,9 @@ int qcrypto_random_init(Error **errp)
>  #else
>      /* TBD perhaps also add support for BSD getentropy / Linux
>       * getrandom syscalls directly */
> -    fd = open("/dev/urandom", O_RDONLY);
> +    fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
>      if (fd == -1 && errno == ENOENT) {
> -        fd = open("/dev/random", O_RDONLY);
> +        fd = open("/dev/random", O_RDONLY | O_CLOEXEC);
>      }
>  
>      if (fd < 0) {

Reviewed-by: Daniel P. Berrangé <address@hidden>

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|