From: Kefu Chai <k.chai@proxmox.com>
Date: Sun, 29 Mar 2026 11:42:25 +0000 (+0800)
Subject: crimson/osd: use O_CLOEXEC with pipe2() in get_early_config
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F68223%2Fhead;p=ceph.git

crimson/osd: use O_CLOEXEC with pipe2() in get_early_config

Without O_CLOEXEC the pipe fds are inherited across any future exec()
calls. While the child in get_early_config does not exec, using
O_CLOEXEC is standard practice to prevent inadvertent fd leaks into
subprocesses spawned later in the OSD lifetime.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---

diff --git a/src/crimson/osd/main_config_bootstrap_helpers.cc b/src/crimson/osd/main_config_bootstrap_helpers.cc
index b701247ae7ff..158e33d26130 100644
--- a/src/crimson/osd/main_config_bootstrap_helpers.cc
+++ b/src/crimson/osd/main_config_bootstrap_helpers.cc
@@ -22,7 +22,8 @@
 #include "crimson/mon/MonClient.h"
 #include "crimson/net/Messenger.h"
 
-#include <sys/wait.h> // for waitpid()
+#include <fcntl.h>
+#include <sys/wait.h>
 
 using namespace std::literals;
 using crimson::common::local_conf;
@@ -286,7 +287,7 @@ get_early_config(int argc, const char *argv[])
     exit(0);
   }
   int pipes[2];
-  int r = pipe2(pipes, 0);
+  int r = pipe2(pipes, O_CLOEXEC);
   if (r < 0) {
     std::cerr << "get_early_config: failed to create pipes: "
 	      << -errno << std::endl;