everywhere: always use O_CLOEXEC where it makes sense

14 files changed, 19 insertions, 20 deletions

diff --git a/src/bootchart/bootchart.c b/src/bootchart/bootchart.c
index 630f9c5d15..305a31ae94 100644
--- a/src/bootchart/bootchart.c
+++ b/src/bootchart/bootchart.c
@@ -259,7 +259,7 @@ static void do_journal_append(char *file) {
 
         memcpy(p, "BOOTCHART=", 10);
 
-        f = open(file, O_RDONLY);
+        f = open(file, O_RDONLY|O_CLOEXEC);
         if (f < 0) {
                 log_error("Failed to read bootchart data: %m");
                 return;
@@ -356,11 +356,11 @@ int main(int argc, char *argv[]) {
                         t = time(NULL);
                         strftime(datestr, sizeof(datestr), "%Y%m%d-%H%M", localtime(&t));
                         snprintf(output_file, PATH_MAX, "%s/bootchart-%s.svg", arg_output_path, datestr);
-                        of = fopen(output_file, "w");
+                        of = fopen(output_file, "we");
                 }
 
                 if (sysfd < 0)
-                        sysfd = open("/sys", O_RDONLY);
+                        sysfd = open("/sys", O_RDONLY|O_CLOEXEC);
 
                 if (!build)
                         parse_env_file("/etc/os-release", NEWLINE,
@@ -424,7 +424,7 @@ int main(int argc, char *argv[]) {
                 t = time(NULL);
                 strftime(datestr, sizeof(datestr), "%Y%m%d-%H%M", localtime(&t));
                 snprintf(output_file, PATH_MAX, "%s/bootchart-%s.svg", arg_output_path, datestr);
-                of = fopen(output_file, "w");
+                of = fopen(output_file, "we");
         }
 
         if (!of) {
diff --git a/src/bootchart/store.c b/src/bootchart/store.c
index 3e0052d212..78c5cf85ec 100644
--- a/src/bootchart/store.c
+++ b/src/bootchart/store.c
@@ -61,7 +61,7 @@ void log_uptime(void) {
         char str[32];
         double uptime;
 
-        f = fopen("/proc/uptime", "r");
+        f = fopen("/proc/uptime", "re");
 
         if (!f)
                 return;
diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
index 9170768cec..8facc88bb4 100644
--- a/src/fsck/fsck.c
+++ b/src/fsck/fsck.c
@@ -155,7 +155,7 @@ static int process_progress(int fd) {
                 return -errno;
         }
 
-        console = fopen("/dev/console", "w");
+        console = fopen("/dev/console", "we");
         if (!console)
                 return -ENOMEM;
 
diff --git a/src/shared/fileio.c b/src/shared/fileio.c
index b81eeb272a..0d3f2e90c7 100644
--- a/src/shared/fileio.c
+++ b/src/shared/fileio.c
@@ -130,7 +130,7 @@ ssize_t sendfile_full(int out_fd, const char *fn) {
         assert(out_fd > 0);
         assert(fn);
 
-        f = fopen(fn, "r");
+        f = fopen(fn, "re");
         if (!f)
                 return -errno;
 
diff --git a/src/shared/sleep-config.c b/src/shared/sleep-config.c
index 70a0896069..b9b6643066 100644
--- a/src/shared/sleep-config.c
+++ b/src/shared/sleep-config.c
@@ -174,7 +174,7 @@ static int hibernation_partition_size(size_t *size, size_t *used) {
         assert(size);
         assert(used);
 
-        f = fopen("/proc/swaps", "r");
+        f = fopen("/proc/swaps", "re");
         if (!f) {
                 log_full(errno == ENOENT ? LOG_DEBUG : LOG_WARNING,
                          "Failed to retrieve open /proc/swaps: %m");
diff --git a/src/udev/accelerometer/accelerometer.c b/src/udev/accelerometer/accelerometer.c
index babd66f6b5..925d38de1f 100644
--- a/src/udev/accelerometer/accelerometer.c
+++ b/src/udev/accelerometer/accelerometer.c
@@ -197,7 +197,7 @@ static void test_orientation(struct udev *udev,
 
         old = get_prev_orientation(dev);
 
-        fd = open(devpath, O_RDONLY);
+        fd = open(devpath, O_RDONLY|O_CLOEXEC);
         if (fd < 0)
                 return;
 
diff --git a/src/udev/ata_id/ata_id.c b/src/udev/ata_id/ata_id.c
index 649890618e..f84281dd1a 100644
--- a/src/udev/ata_id/ata_id.c
+++ b/src/udev/ata_id/ata_id.c
@@ -468,7 +468,7 @@ int main(int argc, char *argv[])
                 goto exit;
         }
 
-        fd = open(node, O_RDONLY|O_NONBLOCK);
+        fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC);
         if (fd < 0) {
                 log_error("unable to open '%s'", node);
                 rc = 1;
diff --git a/src/udev/cdrom_id/cdrom_id.c b/src/udev/cdrom_id/cdrom_id.c
index 02a4d399e7..93467c2d35 100644
--- a/src/udev/cdrom_id/cdrom_id.c
+++ b/src/udev/cdrom_id/cdrom_id.c
@@ -930,7 +930,7 @@ int main(int argc, char *argv[])
         for (cnt = 20; cnt > 0; cnt--) {
                 struct timespec duration;
 
-                fd = open(node, O_RDONLY|O_NONBLOCK|(is_mounted(node) ? 0 : O_EXCL));
+                fd = open(node, O_RDONLY|O_NONBLOCK|O_CLOEXEC|(is_mounted(node) ? 0 : O_EXCL));
                 if (fd >= 0 || errno != EBUSY)
                         break;
                 duration.tv_sec = 0;
diff --git a/src/udev/collect/collect.c b/src/udev/collect/collect.c
index cb5df01c6a..4ecb6b0d19 100644
--- a/src/udev/collect/collect.c
+++ b/src/udev/collect/collect.c
@@ -95,7 +95,7 @@ static int prepare(char *dir, char *filename)
 
         snprintf(buf, sizeof(buf), "%s/%s", dir, filename);
 
-        fd = open(buf,O_RDWR|O_CREAT, S_IRUSR|S_IWUSR);
+        fd = open(buf,O_RDWR|O_CREAT|O_CLOEXEC, S_IRUSR|S_IWUSR);
         if (fd < 0)
                 fprintf(stderr, "Cannot open %s: %m\n", buf);
 
diff --git a/src/udev/mtd_probe/mtd_probe.c b/src/udev/mtd_probe/mtd_probe.c
index 70c04db40b..13c757bd1c 100644
--- a/src/udev/mtd_probe/mtd_probe.c
+++ b/src/udev/mtd_probe/mtd_probe.c
@@ -37,7 +37,7 @@ int main(int argc, char** argv)
                 return 1;
         }
 
-        mtd_fd = open(argv[1], O_RDONLY);
+        mtd_fd = open(argv[1], O_RDONLY|O_CLOEXEC);
         if (mtd_fd == -1) {
                 perror("open");
                 exit(-1);
diff --git a/src/udev/scsi_id/scsi_serial.c b/src/udev/scsi_id/scsi_serial.c
index 2f2afcee6e..378a73d863 100644
--- a/src/udev/scsi_id/scsi_serial.c
+++ b/src/udev/scsi_id/scsi_serial.c
@@ -818,7 +818,7 @@ int scsi_std_inquiry(struct udev *udev,
         struct stat statbuf;
         int err = 0;
 
-        fd = open(devname, O_RDONLY | O_NONBLOCK);
+        fd = open(devname, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
         if (fd < 0) {
                 log_debug("scsi_id: cannot open %s: %m", devname);
                 return 1;
@@ -866,7 +866,7 @@ int scsi_get_serial(struct udev *udev,
         for (cnt = 20; cnt > 0; cnt--) {
                 struct timespec duration;
 
-                fd = open(devname, O_RDONLY | O_NONBLOCK);
+                fd = open(devname, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
                 if (fd >= 0 || errno != EBUSY)
                         break;
                 duration.tv_sec = 0;
diff --git a/src/udev/udev-builtin-btrfs.c b/src/udev/udev-builtin-btrfs.c
index f7bea69b26..2baafe6131 100644
--- a/src/udev/udev-builtin-btrfs.c
+++ b/src/udev/udev-builtin-btrfs.c
@@ -38,19 +38,18 @@ struct btrfs_ioctl_vol_args {
 static int builtin_btrfs(struct udev_device *dev, int argc, char *argv[], bool test)
 {
         struct  btrfs_ioctl_vol_args args;
-        int fd;
+        _cleanup_close_ int fd = -1;
         int err;
 
         if (argc != 3 || !streq(argv[1], "ready"))
                 return EXIT_FAILURE;
 
-        fd = open("/dev/btrfs-control", O_RDWR);
+        fd = open("/dev/btrfs-control", O_RDWR|O_CLOEXEC);
         if (fd < 0)
                 return EXIT_FAILURE;
 
         strscpy(args.name, sizeof(args.name), argv[2]);
         err = ioctl(fd, BTRFS_IOC_DEVICES_READY, &args);
-        close(fd);
         if (err < 0)
                 return EXIT_FAILURE;
 
diff --git a/src/udev/udevadm-trigger.c b/src/udev/udevadm-trigger.c
index 087ee4bfae..0ee27bb408 100644
--- a/src/udev/udevadm-trigger.c
+++ b/src/udev/udevadm-trigger.c
@@ -51,7 +51,7 @@ static void exec_list(struct udev_enumerate *udev_enumerate, const char *action)
                 if (dry_run)
                         continue;
                 strscpyl(filename, sizeof(filename), udev_list_entry_get_name(entry), "/uevent", NULL);
-                fd = open(filename, O_WRONLY);
+                fd = open(filename, O_WRONLY|O_CLOEXEC);
                 if (fd < 0)
                         continue;
                 if (write(fd, action, strlen(action)) < 0)
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index 9d7fa033b6..f21c227d17 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -734,7 +734,7 @@ static int handle_inotify(struct udev *udev)
 
                                 log_debug("device %s closed, synthesising 'change'", udev_device_get_devnode(dev));
                                 strscpyl(filename, sizeof(filename), udev_device_get_syspath(dev), "/uevent", NULL);
-                                fd = open(filename, O_WRONLY);
+                                fd = open(filename, O_WRONLY|O_CLOEXEC);
                                 if (fd >= 0) {
                                         if (write(fd, "change", 6) < 0)
                                                 log_debug("error writing uevent: %m");