set the close-on-exec flag on all file descriptors

Added the "fd_util" library, which attempts to use the new thread-safe
Linux system calls pipe2(), accept4() and the options O_CLOEXEC,
SOCK_CLOEXEC.  Without these, it falls back to FD_CLOEXEC, which is
not thread safe.

This is particularly important for the "pipe" output plugin (and
others, such as JACK/PulseAudio), because we were heavily leaking file
descriptors to child processes.

6 files changed, 22 insertions, 12 deletions

diff --git a/src/output/fifo_output_plugin.c b/src/output/fifo_output_plugin.c
index d3145748f..0217c2675 100644
--- a/src/output/fifo_output_plugin.c
+++ b/src/output/fifo_output_plugin.c
@@ -20,6 +20,7 @@
 #include "output_api.h"
 #include "utils.h"
 #include "timer.h"
+#include "fd_util.h"
 
 #include <glib.h>
 
@@ -152,7 +153,7 @@ fifo_open(struct fifo_data *fd, GError **error)
 	if (!fifo_check(fd, error))
 		return false;
 
-	fd->input = open(fd->path, O_RDONLY|O_NONBLOCK);
+	fd->input = open_cloexec(fd->path, O_RDONLY|O_NONBLOCK);
 	if (fd->input < 0) {
 		g_set_error(error, fifo_output_quark(), errno,
 			    "Could not open FIFO \"%s\" for reading: %s",
@@ -161,7 +162,7 @@ fifo_open(struct fifo_data *fd, GError **error)
 		return false;
 	}
 
-	fd->output = open(fd->path, O_WRONLY|O_NONBLOCK);
+	fd->output = open_cloexec(fd->path, O_WRONLY|O_NONBLOCK);
 	if (fd->output < 0) {
 		g_set_error(error, fifo_output_quark(), errno,
 			    "Could not open FIFO \"%s\" for writing: %s",
diff --git a/src/output/httpd_output_plugin.c b/src/output/httpd_output_plugin.c
index 5b0331257..6d5e99c57 100644
--- a/src/output/httpd_output_plugin.c
+++ b/src/output/httpd_output_plugin.c
@@ -25,6 +25,7 @@
 #include "socket_util.h"
 #include "page.h"
 #include "icy_server.h"
+#include "fd_util.h"
 
 #include <assert.h>
 
@@ -187,14 +188,14 @@ httpd_listen_in_event(G_GNUC_UNUSED GIOChannel *source,
 	struct httpd_output *httpd = data;
 	int fd;
 	struct sockaddr_storage sa;
-	socklen_t sa_length = sizeof(sa);
+	size_t sa_length = sizeof(sa);
 
 	g_mutex_lock(httpd->mutex);
 
 	/* the listener socket has become readable - a client has
 	   connected */
 
-	fd = accept(httpd->fd, (struct sockaddr*)&sa, &sa_length);
+	fd = accept_cloexec(httpd->fd, (struct sockaddr*)&sa, &sa_length);
 	if (fd >= 0) {
 		/* can we allow additional client */
 		if (httpd->open &&
diff --git a/src/output/mvp_plugin.c b/src/output/mvp_plugin.c
index 96f9435a8..f5fbadbee 100644
--- a/src/output/mvp_plugin.c
+++ b/src/output/mvp_plugin.c
@@ -22,7 +22,8 @@
  * http://mvpmc.sourceforge.net/
  */
 
-#include "../output_api.h"
+#include "output_api.h"
+#include "fd_util.h"
 
 #include <glib.h>
 
@@ -115,7 +116,7 @@ mvp_output_test_default_device(void)
 {
 	int fd;
 
-	fd = open("/dev/adec_pcm", O_WRONLY);
+	fd = open_cloexec("/dev/adec_pcm", O_WRONLY);
 
 	if (fd >= 0) {
 		close(fd);
@@ -230,7 +231,8 @@ mvp_output_open(void *data, struct audio_format *audio_format, GError **error)
 	int mix[5] = { 0, 2, 7, 1, 0 };
 	bool success;
 
-	if ((md->fd = open("/dev/adec_pcm", O_RDWR | O_NONBLOCK)) < 0) {
+	md->fd = open_cloexec("/dev/adec_pcm", O_RDWR | O_NONBLOCK);
+	if (md->fd < 0) {
 		g_set_error(error, mvp_output_quark(), errno,
 			    "Error opening /dev/adec_pcm: %s",
 			    strerror(errno));
diff --git a/src/output/oss_plugin.c b/src/output/oss_plugin.c
index 258fbfa9d..f308c293e 100644
--- a/src/output/oss_plugin.c
+++ b/src/output/oss_plugin.c
@@ -17,8 +17,9 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#include "../output_api.h"
+#include "output_api.h"
 #include "mixer_list.h"
+#include "fd_util.h"
 
 #include <glib.h>
 
@@ -343,7 +344,9 @@ oss_output_test_default_device(void)
 	int fd, i;
 
 	for (i = G_N_ELEMENTS(default_devices); --i >= 0; ) {
-		if ((fd = open(default_devices[i], O_WRONLY)) >= 0) {
+		fd = open_cloexec(default_devices[i], O_WRONLY);
+
+		if (fd >= 0) {
 			close(fd);
 			return true;
 		}
@@ -516,7 +519,8 @@ oss_open(struct oss_data *od, GError **error)
 {
 	bool success;
 
-	if ((od->fd = open(od->device, O_WRONLY)) < 0) {
+	od->fd = open_cloexec(od->device, O_WRONLY);
+	if (od->fd < 0) {
 		g_set_error(error, oss_output_quark(), errno,
 			    "Error opening OSS device \"%s\": %s",
 			    od->device, strerror(errno));
diff --git a/src/output/recorder_output_plugin.c b/src/output/recorder_output_plugin.c
index 413e5d0d1..202b56073 100644
--- a/src/output/recorder_output_plugin.c
+++ b/src/output/recorder_output_plugin.c
@@ -20,6 +20,7 @@
 #include "output_api.h"
 #include "encoder_plugin.h"
 #include "encoder_list.h"
+#include "fd_util.h"
 
 #include <assert.h>
 #include <sys/types.h>
@@ -156,7 +157,7 @@ recorder_output_open(void *data, struct audio_format *audio_format,
 
 	/* create the output file */
 
-	recorder->fd = creat(recorder->path, 0666);
+	recorder->fd = creat_cloexec(recorder->path, 0666);
 	if (recorder->fd < 0) {
 		g_set_error(error_r, recorder_output_quark(), 0,
 			    "Failed to create '%s': %s",
diff --git a/src/output/solaris_output_plugin.c b/src/output/solaris_output_plugin.c
index 5febf0afc..4f3d86835 100644
--- a/src/output/solaris_output_plugin.c
+++ b/src/output/solaris_output_plugin.c
@@ -18,6 +18,7 @@
  */
 
 #include "output_api.h"
+#include "fd_util.h"
 
 #include <glib.h>
 
@@ -91,7 +92,7 @@ solaris_output_open(void *data, struct audio_format *audio_format,
 
 	/* open the device in non-blocking mode */
 
-	so->fd = open(so->device, O_WRONLY|O_NONBLOCK);
+	so->fd = open_cloexec(so->device, O_WRONLY|O_NONBLOCK);
 	if (so->fd < 0) {
 		g_set_error(error, solaris_output_quark(), errno,
 			    "Failed to open %s: %s",