NetBSD Problem Report #60238

From www@netbsd.org  Fri May  8 01:50:04 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 3BC3D1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  8 May 2026 01:50:04 +0000 (UTC)
Message-Id: <20260508015003.3A0251A923A@mollari.NetBSD.org>
Date: Fri,  8 May 2026 01:50:03 +0000 (UTC)
From: cmhanson@eschatologist.net
Reply-To: cmhanson@eschatologist.net
To: gnats-bugs@NetBSD.org
Subject: Add posix_spawn_file_actions_addclosefrom_np
X-Send-Pr-Version: www-1.0
X-From4GNATS: "cmhanson@eschatologist.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60238
>Category:       kern
>Synopsis:       Add posix_spawn_file_actions_addclosefrom_np
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Fri May 08 01:55:00 +0000 2026
>Originator:     Chris Hanson
>Release:        10.1
>Organization:
-
>Environment:
NetBSD core.eschatologist.net 10.1_STABLE NetBSD 10.1_STABLE (GENERIC) #5: Sun Apr 19 19:14:28 PDT 2026  cmh@core.eschatologist.net:/usr/obj-10/amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:
The posix_spawn(3) API as standardized is inherently racy with respect to ensuring only desired file descriptors are inherited by the spawned process: In an application using many libraries, or an application using multiple threads, it’s not necessarily possible to know at the posix_spawn(3) point of call exactly which descriptors are will need to be explicitly closed. In particular, not all calls to open(2) in libraries can be counted on to be careful about specifying O_CLOEXEC.

>How-To-Repeat:
Create a process with multiple threads where one process is invoking posix_spawn and another is opening file descriptors without O_CLOEXEC. It's essentially impossible for the call site of posix_spawn to ensure all descriptors it doesn't want to pass to the child are closed.

>Fix:
Solaris and FreeBSD have a posix_spawn_file_actions_addclosefrom_np(3) API that adds a closefrom(3) action to close all file descriptors at or above a certain numeric value, which allows the caller of posix_spawn(3) to ensure only the descriptors they want to pass to the child remain open in it.

Home	PR Database Search