diff options
| author | Andrei Vagin <avagin@gmail.com> | 2022-05-26 17:33:09 -0700 |
|---|---|---|
| committer | Aleksandr Nogikh <wp32pw@gmail.com> | 2022-05-27 19:29:19 +0200 |
| commit | 91c583067cd169dd9d245b9440be128f1dbf0474 (patch) | |
| tree | a1670209fc6e25f63bc833fd925a921207a04e89 /pkg/osutil | |
| parent | 116e7a7b1ef308fdbd067a06362c8bec9397e217 (diff) | |
osutil: create memfd with the MFD_CLOEXEC flag
Go-runtime opens all files with CLOEXEC by default.
exec.Cmd doesn't close file descriptors in a child process and so memfd without
CLOEXEC can leak to an executor process where its content can be corrupted by
one of test system calls.
Diffstat (limited to 'pkg/osutil')
| -rw-r--r-- | pkg/osutil/sharedmem_memfd.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pkg/osutil/sharedmem_memfd.go b/pkg/osutil/sharedmem_memfd.go index bdcea486f..9eb3a4075 100644 --- a/pkg/osutil/sharedmem_memfd.go +++ b/pkg/osutil/sharedmem_memfd.go @@ -16,7 +16,7 @@ import ( // In the case of Linux, we can just use the memfd_create syscall. func CreateSharedMemFile(size int) (f *os.File, err error) { // The name is actually irrelevant and can even be the same for all such files. - fd, err := unix.MemfdCreate("syz-shared-mem", 0) + fd, err := unix.MemfdCreate("syz-shared-mem", unix.MFD_CLOEXEC) if err != nil { err = fmt.Errorf("failed to do memfd_create: %v", err) return |