Stop base::OpenFile from leaking fds/handles into child procs.

base/files/file_util_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_util.h"
 
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
@@ skipping 167 matching lines @@
       if (mprotect(mapping, pagesize, PROT_READ | PROT_EXEC) == 0)
         result = true;
       munmap(mapping, pagesize);
     }
   }
   return result;
 }
 #endif  // defined(OS_LINUX)
 #endif  // !defined(OS_NACL_NONSFI)
 
+#if !defined(OS_MACOSX)
+// Appends |mode_char| to |mode| before the optional character set encoding; see
+// https://www.gnu.org/software/libc/manual/html_node/Opening-Streams.html for
+// details.
+std::string AppendModeCharacter(StringPiece mode, char mode_char) {
+  // Add |mode_char| immediately before the comma or at the end of the string.

[Mark Mentovai, 2017/02/11 00:52:29]

This comment says basically the same thing as the other comment. Pick one!

[grt (UTC plus 2), 2017/02/13 07:53:28]

Done.

+  std::string result(mode.as_string());
+  size_t comma_pos = result.find(',');
+  result.insert(comma_pos == std::string::npos ? result.length() : comma_pos, 1,
+                mode_char);
+  return result;
+}
+#endif
+
 }  // namespace
 
 #if !defined(OS_NACL_NONSFI)
 FilePath MakeAbsoluteFilePath(const FilePath& input) {
   ThreadRestrictions::AssertIOAllowed();
   char full_path[PATH_MAX];
   if (realpath(input.value().c_str(), full_path) == NULL)
     return FilePath();
   return FilePath(full_path);
 }
@@ skipping 505 matching lines @@
 #if defined(OS_ANDROID)
   }
 #endif  // defined(OS_ANDROID)
 
   results->FromStat(file_info);
   return true;
 }
 #endif  // !defined(OS_NACL_NONSFI)
 
 FILE* OpenFile(const FilePath& filename, const char* mode) {
+  // 'e' is unconditionally added below, so be sure there is not one already
+  // present before a comma in |mode|.
+  DCHECK(
+      strchr(mode, 'e') == nullptr ||
+      (strchr(mode, ',') != nullptr && strchr(mode, 'e') > strchr(mode, ',')));
   ThreadRestrictions::AssertIOAllowed();
   FILE* result = NULL;
+#if defined(OS_MACOSX)
+  // macOS does not provide a mode character to set O_CLOEXEC; see
+  // https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man3/fopen.3.html.
+  const char* the_mode = mode;
+#else
+  std::string mode_with_e(AppendModeCharacter(mode, 'e'));
+  const char* the_mode = mode_with_e.c_str();
+#endif
   do {
-    result = fopen(filename.value().c_str(), mode);
+    result = fopen(filename.value().c_str(), the_mode);
   } while (!result && errno == EINTR);
+#if defined(OS_MACOSX)
+  // Mark the descriptor as close-on-exec.
+  if (result)
+    SetCloseOnExec(fileno(result));
+#endif
   return result;
 }
 
 // NaCl doesn't implement system calls to open files directly.
 #if !defined(OS_NACL)
 FILE* FileToFILE(File file, const char* mode) {
   FILE* stream = fdopen(file.GetPlatformFile(), mode);
   if (stream)
     file.TakePlatformFile();
   return stream;
@@ skipping 254 matching lines @@
     return false;
 
   DeleteFile(from_path, true);
   return true;
 }
 
 }  // namespace internal
 
 #endif  // !defined(OS_NACL_NONSFI)
 }  // namespace base