From 0a8c1c5f3d866d3a3c0f95653416f5f72587ce3a Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe.macdonald@windriver.com>
Date: Fri, 11 Oct 2013 09:56:25 -0400
Subject: [PATCH 2/2] libselinux: make O_CLOEXEC optional

Various commits in the selinux tree in the current release added O_CLOEXEC
to open() calls in an attempt to address file descriptor leaks as
described:

   http://danwalsh.livejournal.com/53603.html

However O_CLOEXEC isn't available on all platforms, so make it a
compile-time option and generate a warning when it is not available.  The
actual impact of leaking these file descriptors is minimal, though it does
produce curious AVC Denied messages.

Uptream-Status: Inappropriate [O_CLOEXEC has been in Linux since 2007 and POSIX since 2008]

Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
---
 src/label_file.c |    8 +++++++-
 src/procattr.c   |    8 +++++++-
 src/sestatus.c   |    8 +++++++-
 src/stringrep.c  |    8 +++++++-
 4 files changed, 28 insertions(+), 4 deletions(-)

Index: libselinux-2.5/src/label_file.c
===================================================================
--- libselinux-2.5.orig/src/label_file.c	2016-02-25 13:10:00.159980383 -0500
+++ libselinux-2.5/src/label_file.c	2016-02-25 13:10:00.155980383 -0500
@@ -124,7 +124,13 @@
 			return -1;
 	}
 
-	mmapfd = open(mmap_path, O_RDONLY | O_CLOEXEC);
+	mmapfd = open(mmap_path, O_RDONLY 
+#ifdef O_CLOEXEC
+                 | O_CLOEXEC
+#else
+#warning O_CLOEXEC undefined on this platform, this may leak file descriptors
+#endif
+                 );
 	if (mmapfd < 0)
 		return -1;
 
Index: libselinux-2.5/src/procattr.c
===================================================================
--- libselinux-2.5.orig/src/procattr.c	2016-02-25 13:10:00.159980383 -0500
+++ libselinux-2.5/src/procattr.c	2016-02-25 13:11:58.527980013 -0500
@@ -76,7 +76,13 @@
 		rc = asprintf(&path, "/proc/thread-self/attr/%s", attr);
 		if (rc < 0)
 			return -1;
-		fd = open(path, flags | O_CLOEXEC);
+		fd = open(path, flags
+#ifdef O_CLOEXEC
+			  | O_CLOEXEC
+#else
+#warning O_CLOEXEC undefined on this platform, this may leak file descriptors
+#endif
+			);
 		if (fd >= 0 || errno != ENOENT)
 			goto out;
 		free(path);
Index: libselinux-2.5/src/sestatus.c
===================================================================
--- libselinux-2.5.orig/src/sestatus.c	2016-02-25 13:10:00.159980383 -0500
+++ libselinux-2.5/src/sestatus.c	2016-02-25 13:10:00.155980383 -0500
@@ -268,7 +268,13 @@
 		return -1;
 
 	snprintf(path, sizeof(path), "%s/status", selinux_mnt);
-	fd = open(path, O_RDONLY | O_CLOEXEC);
+	fd = open(path, O_RDONLY
+#ifdef O_CLOEXEC
+             | O_CLOEXEC
+#else
+#warning O_CLOEXEC undefined on this platform, this may leak file descriptors
+#endif
+             );
 	if (fd < 0)
 		goto error;
 
Index: libselinux-2.5/src/stringrep.c
===================================================================
--- libselinux-2.5.orig/src/stringrep.c	2016-02-25 13:10:00.159980383 -0500
+++ libselinux-2.5/src/stringrep.c	2016-02-25 13:10:00.155980383 -0500
@@ -105,7 +105,13 @@
 		struct stat m;
 
 		snprintf(path, sizeof path, "%s/class/%s/perms/%s", selinux_mnt,s,dentry->d_name);
-		fd = open(path, O_RDONLY | O_CLOEXEC);
+		fd = open(path, O_RDONLY
+#ifdef O_CLOEXEC
+                | O_CLOEXEC
+#else
+#warning O_CLOEXEC undefined on this platform, this may leak file descriptors
+#endif
+                );
 		if (fd < 0)
 			goto err4;