From 9d3344b8089b67bcf98cbdbcfd899d9dd644e0dd Mon Sep 17 00:00:00 2001 From: Isaku Yamahata Date: Mon, 19 Aug 2019 18:09:43 -0700 Subject: [PATCH] [Pal/Linux-SGX] Set CLOEXEC on /dev/isgx and /dev/gsgx On host exec, file descriptors for /dev/isgx and /dev/gsgx are leaked. Set CLOEXEC for them to be closed when emulating fork/exec by using host exec. --- Pal/src/host/Linux-SGX/sgx_framework.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Pal/src/host/Linux-SGX/sgx_framework.c b/Pal/src/host/Linux-SGX/sgx_framework.c index a8257b7f..b806534e 100644 --- a/Pal/src/host/Linux-SGX/sgx_framework.c +++ b/Pal/src/host/Linux-SGX/sgx_framework.c @@ -15,17 +15,19 @@ void * zero_page; int open_gsgx(void) { - gsgx_device = INLINE_SYSCALL(open, 3, GSGX_FILE, O_RDWR, 0); + gsgx_device = INLINE_SYSCALL(open, 3, GSGX_FILE, O_RDWR | O_CLOEXEC, 0); if (IS_ERR(gsgx_device)) { SGX_DBG(DBG_E, "Cannot open device " GSGX_FILE ". Please make sure the" " \'graphene_sgx\' kernel module is loaded.\n"); return -ERRNO(gsgx_device); } - isgx_device = INLINE_SYSCALL(open, 3, ISGX_FILE, O_RDWR, 0); + isgx_device = INLINE_SYSCALL(open, 3, ISGX_FILE, O_RDWR | O_CLOEXEC, 0); if (IS_ERR(isgx_device)) { SGX_DBG(DBG_E, "Cannot open device " ISGX_FILE ". Please make sure the" " Intel SGX kernel module is loaded.\n"); + INLINE_SYSCALL(close, 1, gsgx_device); + gsgx_device = -1; return -ERRNO(isgx_device); }