diff mbox series

[v4,05/24] crypto: Use O_CLOEXEC in qcrypto_random_init

Message ID 20190506173353.32206-6-richard.henderson@linaro.org
State Superseded
Headers show
Series Add qemu_getrandom and ARMv8.5-RNG etc | expand

Commit Message

Richard Henderson May 6, 2019, 5:33 p.m. UTC 
Avoids leaking the /dev/urandom fd into any child processes.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

---
 crypto/random-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.17.1

Comments

Laurent Vivier May 7, 2019, 9:28 a.m. UTC | #1 
On 06/05/2019 19:33, Richard Henderson wrote:
> Avoids leaking the /dev/urandom fd into any child processes.

> 

> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

> ---

>   crypto/random-platform.c | 4 ++--

>   1 file changed, 2 insertions(+), 2 deletions(-)


Reviewed-by: Laurent Vivier <lvivier@redhat.com>
diff mbox series

Patch

diff --git a/crypto/random-platform.c b/crypto/random-platform.c
index 260b64564d..6df40744c7 100644
--- a/crypto/random-platform.c
+++ b/crypto/random-platform.c
@@ -42,9 +42,9 @@  int qcrypto_random_init(Error **errp)
 #else
     /* TBD perhaps also add support for BSD getentropy / Linux
      * getrandom syscalls directly */
-    fd = open("/dev/urandom", O_RDONLY);
+    fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
     if (fd == -1 && errno == ENOENT) {
-        fd = open("/dev/random", O_RDONLY);
+        fd = open("/dev/random", O_RDONLY | O_CLOEXEC);
     }
 
     if (fd < 0) {