Disable fd/handle sharing in base::ReadFileToString.

base/files/file_util.h

Index: base/files/file_util.h
diff --git a/base/files/file_util.h b/base/files/file_util.h
index 77a87e7dade7df8db204dfd33aaafe7209c8a06b..fb066554c4c9e4450c4ea6269398969b3a815c6a 100644
--- a/base/files/file_util.h
+++ b/base/files/file_util.h
@@ -35,6 +35,22 @@
 #include "base/posix/eintr_wrapper.h"
 #endif
 
+// fopen() takes a mode string that is typically something along the lines of
+// "r" or "w+". By default, files opened via fopen() are opened such that they
+// spill into child processes via the normal platform features (e.g., the file
+// is opened with bInheritHandle=TRUE in its security descriptor on Windows).
+// The character for a mode string to disable this spillage is not consistent
+// across platforms. Define the macro FONE (i.e., "fopen 'N' or 'e'") for use in

[gab, 2017/02/06 21:13:19]

Why "FONE"?

[grt (UTC plus 2), 2017/02/06 21:51:21]

FO -> fopen
N -> 'N' on Windows
E -> 'e' on glibc platforms

I was trying to convey that in the comment with "fopen 'N' or 'e'". This was
somewhat inspired by base/format_macros.h, which uses the prefix PRI for macros
that pertain to printf.

[gab, 2017/02/07 19:42:59]

That's very obscure to me. How about NOINHERITANCE or something explicit?

[grt (UTC plus 2), 2017/02/07 20:36:06]

How does PRIuS sit with you
(https://cs.chromium.org/search/?q=PRIuS+file:src/base/format_macros%5C.h&type...
I could do that, but it's quite long. :-)

[gab, 2017/02/07 20:48:49]

I don't like it either :)
I don't think long matters, readable does. And if it becomes annoying that's one
more reason to flip the default ;)

+// cross platform code that calls base::OpenFile (or calls fopen directly).
+#if defined(OS_WIN)
+// "N" specifies that the underlying handle is not inherited by child processes
+// (bInheritHandle=FALSE).
+#define FONE "N"
+#else  // !defined(OS_WIN)

[gab, 2017/02/06 21:13:19]

Just use // defined(OS_WIN) everywhere (i.e. here and on #endif), that's more
common than toggling IMO (as toggling becomes complicated in complex #ifs)

[grt (UTC plus 2), 2017/02/06 21:51:21]

Done.

+// "e" specifies that the underlying descriptor is closed on exec (FD_CLOEXEC).
+#define FONE "e"
+#endif  // OS_WIN
+
 namespace base {
 
 class Environment;
@@ -307,7 +323,9 @@ BASE_EXPORT bool TouchFile(const FilePath& path,
                            const Time& last_accessed,
                            const Time& last_modified);
 
-// Wrapper for fopen-like calls. Returns non-NULL FILE* on success.
+// Wrapper for fopen-like calls. Returns non-NULL FILE* on success. By default,
+// opened files will be inheritable by child processes. Append the FONE macro
+// (defined above) when composing a |mode| string to disable this.

[gab, 2017/02/07 19:42:59]

Mention that this is prefered for new callers and add TODO to flip default

 BASE_EXPORT FILE* OpenFile(const FilePath& filename, const char* mode);
 
 // Closes file opened by OpenFile. Returns true on success.