diff options
| author | Richard Henderson | 2019-03-14 05:05:54 +0100 |
|---|---|---|
| committer | Richard Henderson | 2019-05-22 18:38:54 +0200 |
| commit | e9979ca64e5e4a150f5346de3982f02f54c41076 (patch) | |
| tree | 805b55dc96771648f51a8a2a3782fa9abf8e994c /crypto/random-platform.c | |
| parent | crypto: Do not fail for EINTR during qcrypto_random_bytes (diff) | |
| download | qemu-e9979ca64e5e4a150f5346de3982f02f54c41076.tar.gz qemu-e9979ca64e5e4a150f5346de3982f02f54c41076.tar.xz qemu-e9979ca64e5e4a150f5346de3982f02f54c41076.zip | |
crypto: Use O_CLOEXEC in qcrypto_random_init
Avoids leaking the /dev/urandom fd into any child processes.
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'crypto/random-platform.c')
| -rw-r--r-- | crypto/random-platform.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/crypto/random-platform.c b/crypto/random-platform.c index 260b64564d..6df40744c7 100644 --- a/crypto/random-platform.c +++ b/crypto/random-platform.c @@ -42,9 +42,9 @@ int qcrypto_random_init(Error **errp) #else /* TBD perhaps also add support for BSD getentropy / Linux * getrandom syscalls directly */ - fd = open("/dev/urandom", O_RDONLY); + fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC); if (fd == -1 && errno == ENOENT) { - fd = open("/dev/random", O_RDONLY); + fd = open("/dev/random", O_RDONLY | O_CLOEXEC); } if (fd < 0) { |