diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2019-03-13 21:05:54 -0700 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2019-05-22 12:38:54 -0400 |
| commit | e9979ca64e5e4a150f5346de3982f02f54c41076 (patch) | |
| tree | 805b55dc96771648f51a8a2a3782fa9abf8e994c /crypto | |
| parent | 25fb26e4f4b7cd50b9a7314400a2f800a4082b71 (diff) | |
crypto: Use O_CLOEXEC in qcrypto_random_init
Avoids leaking the /dev/urandom fd into any child processes.
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/random-platform.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/crypto/random-platform.c b/crypto/random-platform.c index 260b64564d..6df40744c7 100644 --- a/crypto/random-platform.c +++ b/crypto/random-platform.c @@ -42,9 +42,9 @@ int qcrypto_random_init(Error **errp) #else /* TBD perhaps also add support for BSD getentropy / Linux * getrandom syscalls directly */ - fd = open("/dev/urandom", O_RDONLY); + fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC); if (fd == -1 && errno == ENOENT) { - fd = open("/dev/random", O_RDONLY); + fd = open("/dev/random", O_RDONLY | O_CLOEXEC); } if (fd < 0) { |