[Webkit-unassigned] [Bug 275690] New: [WPE][GTK] IPC socket should use SOCK_CLOEXEC on Linux

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=275690

            Bug ID: 275690
           Summary: [WPE][GTK] IPC socket should use SOCK_CLOEXEC on Linux
           Product: WebKit
           Version: Other
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKitGTK
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mcatanzaro at redhat.com
                CC: bugs-noreply at webkitgtk.org

Instead of creating the IPC socket without CLOEXEC and then setting it afterwards if requested, instead create the socket with CLOEXEC and unset it afterwards if not requested. This closes the race window where the socket may leak into a subprocess spawned by another thread (which seems unlikely, but you never know what applications will do).

There is still a race if using a custom WPE backend with the libwpe process launching API (which is inadvisable, because this means no sandbox).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240620/8de519bc/attachment.htm>