841d9f125 · cryptotaxi247/netdata-1

aclk/mqtt_websockets/mqtt_wss_client.c

+1 -1

@@ -583,7 +583,7 @@ int mqtt_wss_connect(mqtt_wss_client client, char *host, int port, struct mqtt_c

583

584 if (client->sockfd > 0)

585 close(client->sockfd);

586 - client->sockfd = socket(AF_INET, SOCK_STREAM, 0);

586 + client->sockfd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);

587 if (client->sockfd < 0) {

588 mws_error(client->log, "Couldn't create socket()");

589 return -1;

aclk/mqtt_websockets/ws_client.c

+2 -2

@@ -72,7 +72,7 @@ ws_client *ws_client_new(size_t buf_size, char **host, mqtt_wss_log_ctx_t log)

72 if (!client->buf_to_mqtt)

73 goto cleanup_2;

74

75 - client->entropy_fd = open(ENTROPY_SOURCE, O_RDONLY);

75 + client->entropy_fd = open(ENTROPY_SOURCE, O_RDONLY | O_CLOEXEC);

76 if (client->entropy_fd < 1) {

77 ERROR("Error opening entropy source \"" ENTROPY_SOURCE "\". Reason: \"%s\"", strerror(errno));

78 goto cleanup_3;

@@ -164,7 +164,7 @@ static int ws_client_get_nonce(ws_client *client, char *dest, unsigned int size)

164 // we do not need crypto secure random here

165 // it's just used for protocol negotiation

166 int rd;

167 - int f = open(RAND_SRC, O_RDONLY);

167 + int f = open(RAND_SRC, O_RDONLY | O_CLOEXEC);

168 if (f < 0) {

169 ERROR("Error opening \"%s\". Err: \"%s\"", RAND_SRC, strerror(errno));

170 return -2;

claim/claim.c

+1 -1

@@ -256,7 +256,7 @@ bool netdata_random_session_id_generate(void) {

256 (void)unlink(filename);

257

258 // save it

259 - int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, 640);

259 + int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 640);

260 if(fd == -1) {

261 netdata_log_error("Cannot create random session id file '%s'.", filename);

262 ret = false;

collectors/apps.plugin/apps_groups.conf

+1

@@ -84,6 +84,7 @@ perf.plugin: perf.plugin

84 charts.d.plugin: *charts.d.plugin*

85 python.d.plugin: *python.d.plugin*

86 systemd-journal.plugin:*systemd-journal.plugin*

87 +network-viewer.plugin:*network-viewer.plugin*

88 tc-qos-helper: *tc-qos-helper.sh*

89 fping: fping

90 ioping: ioping

collectors/cgroups.plugin/cgroup-network.c

+1 -1

@@ -183,7 +183,7 @@ int proc_pid_fd(const char *prefix, const char *ns, pid_t pid) {

183

184 char filename[FILENAME_MAX + 1];

185 snprintfz(filename, FILENAME_MAX, "%s/proc/%d/%s", prefix, (int)pid, ns);

186 - int fd = open(filename, O_RDONLY);

186 + int fd = open(filename, O_RDONLY | O_CLOEXEC);

187

188 if(fd == -1)

189 collector_error("Cannot open proc_pid_fd() file '%s'", filename);

collectors/network-viewer.plugin/network-viewer.c

+1 -1

@@ -110,7 +110,7 @@ void network_viewer_function(const char *transaction, char *function __maybe_unu

110

111 buffer_json_member_add_uint64(wb, "status", HTTP_RESP_OK);

112 buffer_json_member_add_string(wb, "type", "table");

113 - buffer_json_member_add_time_t(wb, "update_every", 1);

113 + buffer_json_member_add_time_t(wb, "update_every", 5);

114 buffer_json_member_add_string(wb, "help", NETWORK_VIEWER_HELP);

115 buffer_json_member_add_array(wb, "data");

116

collectors/plugins.d/local-sockets.h

+1 -1

@@ -811,7 +811,7 @@ static inline bool local_sockets_get_namespace_sockets(LS_STATE *ls, struct pid_

811 snprintfz(filename, sizeof(filename), "%s/proc/%d/ns/net", ls->config.host_prefix, ps->pid);

812

813 // verify the pid is in the target namespace

814 - int fd = open(filename, O_RDONLY);

814 + int fd = open(filename, O_RDONLY | O_CLOEXEC);

815 if (fd == -1) {

816 local_sockets_log(ls, "cannot open file '%s'", filename);

817 return false;

collectors/proc.plugin/proc_stat.c

+3 -3

@@ -68,7 +68,7 @@ static int read_per_core_files(struct cpu_chart *all_cpu_charts, size_t len, siz

68 continue;

69

70 if(unlikely(f->fd == -1)) {

71 - f->fd = open(f->filename, O_RDONLY);

71 + f->fd = open(f->filename, O_RDONLY | O_CLOEXEC);

72 if (unlikely(f->fd == -1)) {

73 collector_error("Cannot open file '%s'", f->filename);

74 continue;

@@ -412,7 +412,7 @@ static int read_cpuidle_states(char *cpuidle_name_filename , char *cpuidle_time_

412 char name_buf[50 + 1];

413 snprintfz(filename, FILENAME_MAX, cpuidle_name_filename, core, state);

414

415 - int fd = open(filename, O_RDONLY, 0666);

415 + int fd = open(filename, O_RDONLY | O_CLOEXEC, 0666);

416 if(unlikely(fd == -1)) {

417 collector_error("Cannot open file '%s'", filename);

418 cc->rescan_cpu_states = 1;

@@ -444,7 +444,7 @@ static int read_cpuidle_states(char *cpuidle_name_filename , char *cpuidle_time_

444 struct cpuidle_state *cs = &cc->cpuidle_state[state];

445

446 if(unlikely(cs->time_fd == -1)) {

447 - cs->time_fd = open(cs->time_filename, O_RDONLY);

447 + cs->time_fd = open(cs->time_filename, O_RDONLY | O_CLOEXEC);

448 if (unlikely(cs->time_fd == -1)) {

449 collector_error("Cannot open file '%s'", cs->time_filename);

450 cc->rescan_cpu_states = 1;

collectors/proc.plugin/sys_class_power_supply.c

+2 -2

@@ -245,7 +245,7 @@ int do_sys_class_power_supply(int update_every, usec_t dt) {

245 char buffer[30 + 1];

246

247 if(unlikely(ps->capacity->fd == -1)) {

248 - ps->capacity->fd = open(ps->capacity->filename, O_RDONLY, 0666);

248 + ps->capacity->fd = open(ps->capacity->filename, O_RDONLY | O_CLOEXEC, 0666);

249 if(unlikely(ps->capacity->fd == -1)) {

250 collector_error("Cannot open file '%s'", ps->capacity->filename);

251 power_supply_free(ps);

@@ -290,7 +290,7 @@ int do_sys_class_power_supply(int update_every, usec_t dt) {

290 char buffer[30 + 1];

291

292 if(unlikely(pd->fd == -1)) {

293 - pd->fd = open(pd->filename, O_RDONLY, 0666);

293 + pd->fd = open(pd->filename, O_RDONLY | O_CLOEXEC, 0666);

294 if(unlikely(pd->fd == -1)) {

295 collector_error("Cannot open file '%s'", pd->filename);

296 read_error = 1;

daemon/config/dyncfg-files.c

+1 -1

@@ -201,7 +201,7 @@ void dyncfg_load_all(void) {

201 // schemas loading

202

203 static bool dyncfg_read_file_to_buffer(const char *filename, BUFFER *dst) {

204 - int fd = open(filename, O_RDONLY, 0666);

204 + int fd = open(filename, O_RDONLY | O_CLOEXEC, 0666);

205 if(unlikely(fd == -1))

206 return false;

207

daemon/daemon.c

+2 -2

@@ -245,7 +245,7 @@ static void oom_score_adj(void) {

245 }

246

247 int written = 0;

248 - int fd = open("/proc/self/oom_score_adj", O_WRONLY);

248 + int fd = open("/proc/self/oom_score_adj", O_WRONLY | O_CLOEXEC);

249 if(fd != -1) {

250 snprintfz(buf, sizeof(buf) - 1, "%d", (int)wanted_score);

251 ssize_t len = strlen(buf);

@@ -478,7 +478,7 @@ int become_daemon(int dont_fork, const char *user)

478 // generate our pid file

479 int pidfd = -1;

480 if(pidfile[0]) {

481 - pidfd = open(pidfile, O_WRONLY | O_CREAT, 0644);

481 + pidfd = open(pidfile, O_WRONLY | O_CREAT | O_CLOEXEC, 0644);

482 if(pidfd >= 0) {

483 if(ftruncate(pidfd, 0) != 0)

484 netdata_log_error("Cannot truncate pidfile '%s'.", pidfile);

daemon/main.c

+1 -1

@@ -2174,7 +2174,7 @@ int main(int argc, char **argv) {

2174 int incomplete_shutdown_detected = (unlink(agent_incomplete_shutdown_file) == 0);

2175 snprintfz(agent_crash_file, FILENAME_MAX, "%s/.agent_crash", netdata_configured_varlib_dir);

2176 int crash_detected = (unlink(agent_crash_file) == 0);

2177 - int fd = open(agent_crash_file, O_WRONLY | O_CREAT | O_TRUNC, 444);

2177 + int fd = open(agent_crash_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 444);

2178 if (fd >= 0)

2179 close(fd);

2180

database/engine/journalfile.c

+1 -1

@@ -1045,7 +1045,7 @@ int journalfile_v2_load(struct rrdengine_instance *ctx, struct rrdengine_journal

1045 journal_v1_file_size = (uint32_t)statbuf.st_size;

1046

1047 journalfile_v2_generate_path(datafile, path_v2, sizeof(path_v2));

1048 - fd = open(path_v2, O_RDONLY);

1048 + fd = open(path_v2, O_RDONLY | O_CLOEXEC);

1049 if (fd < 0) {

1050 if (errno == ENOENT)

1051 return 1;

database/sqlite/sqlite_functions.c

+1 -1

@@ -143,7 +143,7 @@ static bool mark_database_to_recover(sqlite3_stmt *res, sqlite3 *database)

143 if (db_meta == database) {

144 char recover_file[FILENAME_MAX + 1];

145 snprintfz(recover_file, FILENAME_MAX, "%s/.netdata-meta.db.recover", netdata_configured_cache_dir);

146 - int fd = open(recover_file, O_WRONLY | O_CREAT | O_TRUNC, 444);

146 + int fd = open(recover_file, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 444);

147 if (fd >= 0) {

148 close(fd);

149 return true;

libnetdata/ebpf/ebpf.c

+2 -2

@@ -77,7 +77,7 @@ int ebpf_get_kernel_version()

77 char ver[VERSION_STRING_LEN];

78 char *version = ver;

79

80 - int fd = open("/proc/sys/kernel/osrelease", O_RDONLY);

80 + int fd = open("/proc/sys/kernel/osrelease", O_RDONLY | O_CLOEXEC);

81 if (fd < 0)

82 return -1;

83

@@ -1480,7 +1480,7 @@ void ebpf_histogram_dimension_cleanup(char **ptr, size_t length)

1480 static inline int ebpf_open_tracepoint_path(char *filename, size_t length, char *subsys, char *eventname, int flags)

1481 {

1482 snprintfz(filename, length, "%s/events/%s/%s/enable", NETDATA_DEBUGFS, subsys, eventname);

1483 - return open(filename, flags, 0);

1483 + return open(filename, flags | O_CLOEXEC, 0);

1484 }

1485

1486 /**

libnetdata/inlined.h

+2 -2

@@ -472,7 +472,7 @@ static inline bool sanitize_command_argument_string(char *dst, const char *src,

472 static inline int read_txt_file(const char *filename, char *buffer, size_t size) {

473 if(unlikely(!size)) return 3;

474

475 - int fd = open(filename, O_RDONLY, 0666);

475 + int fd = open(filename, O_RDONLY | O_CLOEXEC, 0666);

476 if(unlikely(fd == -1)) {

477 buffer[0] = '\0';

478 return 1;

@@ -493,7 +493,7 @@ static inline int read_txt_file(const char *filename, char *buffer, size_t size)

493 static inline int read_proc_cmdline(const char *filename, char *buffer, size_t size) {

494 if (unlikely(!size)) return 3;

495

496 - int fd = open(filename, O_RDONLY, 0666);

496 + int fd = open(filename, O_RDONLY | O_CLOEXEC, 0666);

497 if (unlikely(fd == -1)) {

498 buffer[0] = '\0';

499 return 1;

libnetdata/libnetdata.c

+1 -1

@@ -1087,7 +1087,7 @@ void netdata_fix_chart_id(char *s) {

1087 static int memory_file_open(const char *filename, size_t size) {

1088 // netdata_log_info("memory_file_open('%s', %zu", filename, size);

1089

1090 - int fd = open(filename, O_RDWR | O_CREAT | O_NOATIME, 0664);

1090 + int fd = open(filename, O_RDWR | O_CREAT | O_NOATIME | O_CLOEXEC, 0664);

1091 if (fd != -1) {

1092 if (lseek(fd, size, SEEK_SET) == (off_t) size) {

1093 if (write(fd, "", 1) == 1) {

libnetdata/log/journal.c

+1 -1

@@ -48,7 +48,7 @@ int journal_direct_fd(const char *path) {

48 if(!is_path_unix_socket(path))

49 return -1;

50

51 - int fd = socket(AF_UNIX, SOCK_DGRAM, 0);

51 + int fd = socket(AF_UNIX, SOCK_DGRAM| SOCK_CLOEXEC, 0);

52 if (fd < 0) return -1;

53

54 struct sockaddr_un addr;

libnetdata/procfile/procfile.c

+1 -1

@@ -8,7 +8,7 @@

8 #define PFLINES_INCREASE_STEP 200

9 #define PROCFILE_INCREMENT_BUFFER 4096

10

11 -int procfile_open_flags = O_RDONLY;

11 +int procfile_open_flags = O_RDONLY | O_CLOEXEC;

12

13 int procfile_adaptive_initial_allocation = 0;

14

libnetdata/socket/socket.c

+5 -5

@@ -262,7 +262,7 @@ char *strdup_client_description(int family, const char *protocol, const char *ip

262 int create_listen_socket_unix(const char *path, int listen_backlog) {

263 int sock;

264

265 - sock = socket(AF_UNIX, SOCK_STREAM, 0);

265 + sock = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);

266 if(sock < 0) {

267 nd_log(NDLS_DAEMON, NDLP_ERR,

268 "LISTENER: UNIX socket() on path '%s' failed.",

@@ -316,7 +316,7 @@ int create_listen_socket_unix(const char *path, int listen_backlog) {

316 int create_listen_socket4(int socktype, const char *ip, uint16_t port, int listen_backlog) {

317 int sock;

318

319 - sock = socket(AF_INET, socktype, 0);

319 + sock = socket(AF_INET, socktype | SOCK_CLOEXEC, 0);

320 if(sock < 0) {

321 nd_log(NDLS_DAEMON, NDLP_ERR,

322 "LISTENER: IPv4 socket() on ip '%s' port %d, socktype %d failed.",

@@ -374,7 +374,7 @@ int create_listen_socket6(int socktype, uint32_t scope_id, const char *ip, int p

374 int sock;

375 int ipv6only = 1;

376

377 - sock = socket(AF_INET6, socktype, 0);

377 + sock = socket(AF_INET6, socktype | SOCK_CLOEXEC, 0);

378 if (sock < 0) {

379 nd_log(NDLS_DAEMON, NDLP_ERR,

380 "LISTENER: IPv6 socket() on ip '%s' port %d, socktype %d, failed.",

@@ -781,7 +781,7 @@ int listen_sockets_setup(LISTEN_SOCKETS *sockets) {

781 // timeout the timeout for establishing a connection

782

783 static inline int connect_to_unix(const char *path, struct timeval *timeout) {

784 - int fd = socket(AF_UNIX, SOCK_STREAM, 0);

784 + int fd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);

785 if(fd == -1) {

786 nd_log(NDLS_DAEMON, NDLP_ERR,

787 "Failed to create UNIX socket() for '%s'",

@@ -894,7 +894,7 @@ int connect_to_this_ip46(int protocol, int socktype, const char *host, uint32_t

894 }

895 }

896

897 - fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);

897 + fd = socket(ai->ai_family, ai->ai_socktype | SOCK_CLOEXEC, ai->ai_protocol);

898 if(fd != -1) {

899 if(timeout) {

900 if(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (char *) timeout, sizeof(struct timeval)) < 0)

registry/registry_internals.c

+2 -2

@@ -277,7 +277,7 @@ char *registry_get_this_machine_guid(void) {

277 return guid;

278

279 // read it from disk

280 - int fd = open(registry.machine_guid_filename, O_RDONLY);

280 + int fd = open(registry.machine_guid_filename, O_RDONLY | O_CLOEXEC);

281 if(fd != -1) {

282 char buf[GUID_LEN + 1];

283 if(read(fd, buf, GUID_LEN) != GUID_LEN)

@@ -305,7 +305,7 @@ char *registry_get_this_machine_guid(void) {

305 guid[GUID_LEN] = '\0';

306

307 // save it

308 - fd = open(registry.machine_guid_filename, O_WRONLY|O_CREAT|O_TRUNC, 444);

308 + fd = open(registry.machine_guid_filename, O_WRONLY|O_CREAT|O_TRUNC | O_CLOEXEC, 444);

309 if(fd == -1)

310 fatal("Cannot create unique machine id file '%s'. Please fix this.", registry.machine_guid_filename);

311

web/api/web_api_v1.c

+2 -2

@@ -159,7 +159,7 @@ char *get_mgmt_api_key(void) {

159 return guid;

160

161 // read it from disk

162 - int fd = open(api_key_filename, O_RDONLY);

162 + int fd = open(api_key_filename, O_RDONLY | O_CLOEXEC);

163 if(fd != -1) {

164 char buf[GUID_LEN + 1];

165 if(read(fd, buf, GUID_LEN) != GUID_LEN)

@@ -185,7 +185,7 @@ char *get_mgmt_api_key(void) {

185 guid[GUID_LEN] = '\0';

186

187 // save it

188 - fd = open(api_key_filename, O_WRONLY|O_CREAT|O_TRUNC, 444);

188 + fd = open(api_key_filename, O_WRONLY|O_CREAT|O_TRUNC | O_CLOEXEC, 444);

189 if(fd == -1) {

190 netdata_log_error("Cannot create unique management API key file '%s'. Please adjust config parameter 'netdata management api key file' to a proper path and file.", api_key_filename);

191 goto temp_key;

web/server/web_client.c

+1 -1

@@ -512,7 +512,7 @@ static int mysendfile(struct web_client *w, char *filename) {

512 return append_slash_to_url_and_redirect(w);

513

514 // open the file

515 - w->ifd = open(web_filename, O_NONBLOCK, O_RDONLY);

515 + w->ifd = open(web_filename, O_NONBLOCK, O_RDONLY | O_CLOEXEC);

516 if(w->ifd == -1) {

517 w->ifd = w->ofd;

518

add the CLOEXEC flag to all sockets and files (#16881)