19 lines
485 B
ReStructuredText
19 lines
485 B
ReStructuredText
|
.. title:: clang-tidy - android-cloexec-memfd-create
|
||
|
|
|
||
|
|
android-cloexec-memfd-create
|
||
|
|
============================
|
||
|
|
|
||
|
|
``memfd_create()`` should include ``MFD_CLOEXEC`` in its type argument to avoid
|
||
|
|
the file descriptor leakage. Without this flag, an opened sensitive file would
|
||
|
|
remain open across a fork+exec to a lower-privileged SELinux domain.
|
||
|
|
|
||
|
|
Examples:
|
||
|
|
|
||
|
|
.. code-block:: c++
|
||
|
|
|
||
|
|
memfd_create(name, MFD_ALLOW_SEALING);
|
||
|
|
|
||
|
|
// becomes
|
||
|
|
|
||
|
|
memfd_create(name, MFD_ALLOW_SEALING | MFD_CLOEXEC);
|