Disable fd/handle sharing in base::ReadFileToString.

base/files/file_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains utility functions for dealing with the local
 // filesystem.
 
 #ifndef BASE_FILES_FILE_UTIL_H_
 #define BASE_FILES_FILE_UTIL_H_
 
@@ skipping 17 matching lines @@
 #include <sys/stat.h>
 #include <unistd.h>
 #endif
 
 #if defined(OS_POSIX)
 #include "base/file_descriptor_posix.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
 #endif
 
+// fopen() takes a mode string that is typically something along the lines of
+// "r" or "w+". By default, files opened via fopen() are opened such that they
+// spill into child processes via the normal platform features (e.g., the file
+// is opened with bInheritHandle=TRUE in its security descriptor on Windows).
+// The character for a mode string to disable this spillage is not consistent
+// across platforms. Define the macro FONE (i.e., "fopen 'N' or 'e'") for use in

[gab, 2017/02/06 21:13:19]

Why "FONE"?

[grt (UTC plus 2), 2017/02/06 21:51:21]

FO -> fopen
N -> 'N' on Windows
E -> 'e' on glibc platforms

I was trying to convey that in the comment with "fopen 'N' or 'e'". This was
somewhat inspired by base/format_macros.h, which uses the prefix PRI for macros
that pertain to printf.

[gab, 2017/02/07 19:42:59]

That's very obscure to me. How about NOINHERITANCE or something explicit?

[grt (UTC plus 2), 2017/02/07 20:36:06]

How does PRIuS sit with you
(https://cs.chromium.org/search/?q=PRIuS+file:src/base/format_macros%5C.h&type...
I could do that, but it's quite long. :-)

[gab, 2017/02/07 20:48:49]

I don't like it either :)
I don't think long matters, readable does. And if it becomes annoying that's one
more reason to flip the default ;)

+// cross platform code that calls base::OpenFile (or calls fopen directly).
+#if defined(OS_WIN)
+// "N" specifies that the underlying handle is not inherited by child processes
+// (bInheritHandle=FALSE).
+#define FONE "N"
+#else  // !defined(OS_WIN)

[gab, 2017/02/06 21:13:19]

Just use // defined(OS_WIN) everywhere (i.e. here and on #endif), that's more
common than toggling IMO (as toggling becomes complicated in complex #ifs)

[grt (UTC plus 2), 2017/02/06 21:51:21]

Done.

+// "e" specifies that the underlying descriptor is closed on exec (FD_CLOEXEC).
+#define FONE "e"
+#endif  // OS_WIN
+
 namespace base {
 
 class Environment;
 class Time;
 
 //-----------------------------------------------------------------------------
 // Functions that involve filesystem access or modification:
 
 // Returns an absolute version of a relative path. Returns an empty path on
 // error. On POSIX, this function fails if the path does not exist. This
@@ skipping 252 matching lines @@
 BASE_EXPORT bool IsLink(const FilePath& file_path);
 
 // Returns information about the given file path.
 BASE_EXPORT bool GetFileInfo(const FilePath& file_path, File::Info* info);
 
 // Sets the time of the last access and the time of the last modification.
 BASE_EXPORT bool TouchFile(const FilePath& path,
                            const Time& last_accessed,
                            const Time& last_modified);
 
-// Wrapper for fopen-like calls. Returns non-NULL FILE* on success.
+// Wrapper for fopen-like calls. Returns non-NULL FILE* on success. By default,
+// opened files will be inheritable by child processes. Append the FONE macro
+// (defined above) when composing a |mode| string to disable this.

[gab, 2017/02/07 19:42:59]

Mention that this is prefered for new callers and add TODO to flip default

 BASE_EXPORT FILE* OpenFile(const FilePath& filename, const char* mode);
 
 // Closes file opened by OpenFile. Returns true on success.
 BASE_EXPORT bool CloseFile(FILE* file);
 
 // Associates a standard FILE stream with an existing File. Note that this
 // functions take ownership of the existing File.
 BASE_EXPORT FILE* FileToFILE(File file, const char* mode);
 
 // Truncates an open file to end at the location of the current file pointer.
@@ skipping 127 matching lines @@
 // This function simulates Move(), but unlike Move() it works across volumes.
 // This function is not transactional.
 BASE_EXPORT bool CopyAndDeleteDirectory(const FilePath& from_path,
                                         const FilePath& to_path);
 #endif  // defined(OS_WIN)
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_FILES_FILE_UTIL_H_