Download raw body.
[PATCH]: Add POSIX O_CLOFORK flag
On Sat, Jun 21, 2025 at 4:44 PM Philip Guenther <guenther@gmail.com> wrote:
>
> On Sat, Jun 21, 2025 at 4:04 PM Ricardo Branco <rbranco@suse.de> wrote:
> >
> > This initial patch adds support for POSIX O_CLOFORK (close-on-fork) flag.
> >
> > If there's interest, I can update manpages and fill the TODO list in the PR:
> > https://github.com/openbsd/src/pull/46
> >
> > I uploaded the full test-suite from Illumos adapted to OpenBSD there.
> >
> > Work also being done to add this flag on:
> >
> > - FreeBSD: https://github.com/freebsd/freebsd-src/pull/1698
> > - DragonflyBSD: https://github.com/DragonFlyBSD/DragonFlyBSD/pull/28
> >
> > The discussion for adding this flag was done in the FreeBSD PR.
>
> Nope. I implemented this myself last summer, but after Damien Miller
> suggest that OpenSSH would want to clear the flag on inherited fds we
> decided the specified behavior of O_CLOFORK being inherited across
> exec is insecure, unnecessary for purpose, and kinda insane. I opened
> a ticket with austin group:
> https://austingroupbugs.net/view.php?id=1851
>
> Geoff Clare was going to reach out to other implementations to get
> feedback but nothing has happened since. <shrug>
>
> Maybe we should say that more than 10 months was sufficient for
> austin-group to address a potential security issue, in which case I'll
> rebase my diff, but with clearing the flag on exec because WTH were
> they thinking.
Rebased diff, with cleared-on-exec behavior, attached, in case you
want to play with it, Richardo.
Regress tests would be wonderful :)
Philip
Index: sys/sys/fcntl.h
===================================================================
RCS file: /data/src/openbsd/src/sys/sys/fcntl.h,v
diff -u -p -r1.22 fcntl.h
--- sys/sys/fcntl.h 21 Jan 2019 18:09:21 -0000 1.22
+++ sys/sys/fcntl.h 22 Jun 2025 00:08:45 -0000
@@ -83,22 +83,24 @@
#define O_EXLOCK 0x0020 /* open with exclusive file lock */
#define O_ASYNC 0x0040 /* signal pgrp when data ready */
#define O_FSYNC 0x0080 /* backwards compatibility */
-#define O_NOFOLLOW 0x0100 /* if path is a symlink, don't follow */
#endif
#if __POSIX_VISIBLE >= 199309 || __XPG_VISIBLE >= 420
#define O_SYNC 0x0080 /* synchronous writes */
-#endif
-#define O_CREAT 0x0200 /* create if nonexistent */
-#define O_TRUNC 0x0400 /* truncate to zero length */
-#define O_EXCL 0x0800 /* error if already exists */
-
/*
- * POSIX 1003.1 specifies a higher granularity for synchronous operations
+ * POSIX 1003.1 permits a higher granularity for synchronous operations
* than we support. Since synchronicity is all or nothing in OpenBSD
* we just define these to be the same as O_SYNC.
*/
#define O_DSYNC O_SYNC /* synchronous data writes */
#define O_RSYNC O_SYNC /* synchronous reads */
+#endif
+
+/* defined by POSIX Issue 7 */
+#define O_NOFOLLOW 0x0100 /* if path is a symlink, don't follow */
+
+#define O_CREAT 0x0200 /* create if nonexistent */
+#define O_TRUNC 0x0400 /* truncate to zero length */
+#define O_EXCL 0x0800 /* error if already exists */
/* defined by POSIX 1003.1; BSD default, this bit is not required */
#define O_NOCTTY 0x8000 /* don't assign controlling terminal */
@@ -107,6 +109,9 @@
#define O_CLOEXEC 0x10000 /* atomically set FD_CLOEXEC */
#define O_DIRECTORY 0x20000 /* fail if not a directory */
+/* defined by POSIX Issue 8 */
+#define O_CLOFORK 0x40000 /* atomically set FD_CLOFORK */
+
#ifdef _KERNEL
/*
* convert from open() flags to/from fflags; convert O_RD/WR to FREAD/FWRITE.
@@ -158,9 +163,30 @@
#if __BSD_VISIBLE
#define F_ISATTY 11 /* used by isatty(3) */
#endif
+#if __POSIX_VISIBLE >= 202405
+#define F_DUPFD_CLOFORK 12 /* duplicate with FD_CLOFORK set */
+#if __not_yet
+#define F_GETOWN_EX 13 /* get SIGIO/SIGURG proc/pgrp */
+#define F_SETOWN_EX 14 /* set SIGIO/SIGURG proc/pgrp */
+#define F_OFD_GETLK 15 /* get flock-style locking info */
+#define F_OFD_SETLK 16 /* set flock-style locking info */
+#define F_OFD_SETLKW 17 /* F_OFD_SETLK; wait if blocked */
+
+struct f_owner_ex {
+ int type;
+ pid_t pid;
+};
+/* type values */
+#define F_OWNER_PID 1 /* pid is process ID */
+#define F_OWNER_PGRP 2 /* pid is process group ID */
+#endif /* __not_yet */
+#endif
/* file descriptor flags (F_GETFD, F_SETFD) */
#define FD_CLOEXEC 1 /* close-on-exec flag */
+#if __POSIX_VISIBLE >= 202405
+#define FD_CLOFORK 4 /* close-on-fork flag */
+#endif
/* record locking flags (F_GETLK, F_SETLK, F_SETLKW) */
#define F_RDLCK 1 /* shared or read lock */
Index: sys/sys/filedesc.h
===================================================================
RCS file: /data/src/openbsd/src/sys/sys/filedesc.h,v
diff -u -p -r1.47 filedesc.h
--- sys/sys/filedesc.h 10 May 2025 09:44:39 -0000 1.47
+++ sys/sys/filedesc.h 22 Jun 2025 00:08:45 -0000
@@ -115,6 +115,7 @@ struct filedesc0 {
*/
#define UF_EXCLOSE 0x01 /* auto-close on exec */
#define UF_PLEDGED 0x02 /* open after pledge(2) */
+#define UF_FORKCLOSE 0x04 /* auto-close on fork */
/*
* Flags on the file descriptor table.
@@ -143,7 +144,7 @@ void fdfree(struct proc *p);
int fdrelease(struct proc *p, int);
void fdinsert(struct filedesc *, int, int, struct file *);
void fdremove(struct filedesc *, int);
-void fdcloseexec(struct proc *);
+void fdprepforexec(struct proc *);
struct file *fd_iterfile(struct file *, struct proc *);
struct file *fd_getfile(struct filedesc *, int);
struct file *fd_getfile_mode(struct filedesc *, int, int);
Index: sys/sys/socket.h
===================================================================
RCS file: /data/src/openbsd/src/sys/sys/socket.h,v
diff -u -p -r1.107 socket.h
--- sys/sys/socket.h 19 Apr 2025 04:12:36 -0000 1.107
+++ sys/sys/socket.h 22 Jun 2025 00:08:45 -0000
@@ -72,14 +72,19 @@ typedef __sa_family_t sa_family_t; /* so
/*
* Socket creation flags
*/
-#if __BSD_VISIBLE
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
#define SOCK_CLOEXEC 0x8000 /* set FD_CLOEXEC */
#define SOCK_NONBLOCK 0x4000 /* set O_NONBLOCK */
+#endif
+#if __BSD_VISIBLE
#ifdef _KERNEL
#define SOCK_NONBLOCK_INHERIT 0x2000 /* inherit O_NONBLOCK from listener */
#endif
#define SOCK_DNS 0x1000 /* set SS_DNS */
#endif /* __BSD_VISIBLE */
+#if __POSIX_VISIBLE >= 202405
+#define SOCK_CLOFORK 0x0800 /* set FD_CLOFORK */
+#endif
/*
* Option flags per-socket.
@@ -511,6 +516,7 @@ struct timespec;
#define MSG_NOSIGNAL 0x400 /* do not send SIGPIPE */
#define MSG_CMSG_CLOEXEC 0x800 /* set FD_CLOEXEC on received fds */
#define MSG_WAITFORONE 0x1000 /* nonblocking but wait for one msg */
+#define MSG_CMSG_CLOFORK 0x2000 /* set FD_CLOFORK on received fds */
/*
* Header for ancillary data objects in msg_control buffer.
@@ -586,7 +592,7 @@ int sockatmark(int);
int socket(int, int, int);
int socketpair(int, int, int, int *);
-#if __BSD_VISIBLE
+#if __POSIX_VISIBLE >= 202405 || __BSD_VISIBLE
int accept4(int, struct sockaddr *__restrict, socklen_t *__restrict, int);
#endif
Index: sys/kern/kern_descrip.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/kern_descrip.c,v
diff -u -p -r1.211 kern_descrip.c
--- sys/kern/kern_descrip.c 10 May 2025 09:44:39 -0000 1.211
+++ sys/kern/kern_descrip.c 22 Jun 2025 00:08:45 -0000
@@ -80,6 +80,7 @@ int dodup3(struct proc *, int, int, int,
#define DUPF_CLOEXEC 0x01
#define DUPF_DUP2 0x02
+#define DUPF_CLOFORK 0x04
struct pool file_pool;
struct pool fdesc_pool;
@@ -336,7 +337,7 @@ sys_dup3(struct proc *p, void *v, regist
if (SCARG(uap, from) == SCARG(uap, to))
return (EINVAL);
- if (SCARG(uap, flags) & ~O_CLOEXEC)
+ if (SCARG(uap, flags) & ~(O_CLOEXEC | O_CLOFORK))
return (EINVAL);
return (dodup3(p, SCARG(uap, from), SCARG(uap, to),
SCARG(uap, flags), retval));
@@ -388,6 +389,8 @@ restart:
dupflags = DUPF_DUP2;
if (flags & O_CLOEXEC)
dupflags |= DUPF_CLOEXEC;
+ if (flags & O_CLOFORK)
+ dupflags |= DUPF_CLOFORK;
/* No need for FRELE(), finishdup() uses current ref. */
return (finishdup(p, fp, old, new, retval, dupflags));
@@ -423,6 +426,7 @@ restart:
case F_DUPFD:
case F_DUPFD_CLOEXEC:
+ case F_DUPFD_CLOFORK:
newmin = (long)SCARG(uap, arg);
if ((u_int)newmin >= lim_cur(RLIMIT_NOFILE) ||
(u_int)newmin >= atomic_load_int(&maxfiles)) {
@@ -444,6 +448,8 @@ restart:
if (SCARG(uap, cmd) == F_DUPFD_CLOEXEC)
dupflags |= DUPF_CLOEXEC;
+ if (SCARG(uap, cmd) == F_DUPFD_CLOFORK)
+ dupflags |= DUPF_CLOFORK;
/* No need for FRELE(), finishdup() uses current ref. */
error = finishdup(p, fp, fd, i, retval, dupflags);
@@ -452,16 +458,17 @@ restart:
case F_GETFD:
fdplock(fdp);
- *retval = fdp->fd_ofileflags[fd] & UF_EXCLOSE ? 1 : 0;
+ *retval = (fdp->fd_ofileflags[fd] & UF_EXCLOSE ? FD_CLOEXEC : 0)
+ | (fdp->fd_ofileflags[fd] & UF_FORKCLOSE ? FD_CLOFORK : 0);
fdpunlock(fdp);
break;
case F_SETFD:
fdplock(fdp);
- if ((long)SCARG(uap, arg) & 1)
- fdp->fd_ofileflags[fd] |= UF_EXCLOSE;
- else
- fdp->fd_ofileflags[fd] &= ~UF_EXCLOSE;
+ i = ((long)SCARG(uap, arg) & FD_CLOEXEC ? UF_EXCLOSE : 0) |
+ ((long)SCARG(uap, arg) & FD_CLOFORK ? UF_FORKCLOSE : 0);
+ fdp->fd_ofileflags[fd] = (fdp->fd_ofileflags[fd] &
+ ~(UF_EXCLOSE | UF_FORKCLOSE)) | i;
fdpunlock(fdp);
break;
@@ -667,9 +674,12 @@ finishdup(struct proc *p, struct file *f
fdp->fd_ofiles[new] = fp;
mtx_leave(&fdp->fd_fplock);
- fdp->fd_ofileflags[new] = fdp->fd_ofileflags[old] & ~UF_EXCLOSE;
+ fdp->fd_ofileflags[new] = fdp->fd_ofileflags[old] &
+ ~(UF_EXCLOSE | UF_FORKCLOSE);
if (dupflags & DUPF_CLOEXEC)
fdp->fd_ofileflags[new] |= UF_EXCLOSE;
+ if (dupflags & DUPF_CLOFORK)
+ fdp->fd_ofileflags[new] |= UF_FORKCLOSE;
*retval = new;
if (oldfp != NULL) {
@@ -711,7 +721,7 @@ fdinsert(struct filedesc *fdp, int fd, i
fdp->fd_ofiles[fd] = fp;
mtx_leave(&fdp->fd_fplock);
- fdp->fd_ofileflags[fd] |= (flags & UF_EXCLOSE);
+ fdp->fd_ofileflags[fd] |= (flags & (UF_EXCLOSE | UF_FORKCLOSE));
}
void
@@ -1141,7 +1151,9 @@ fdcopy(struct process *pr)
struct file *fp = fdp->fd_ofiles[i];
if (fp != NULL) {
+ int fileflags = fdp->fd_ofileflags[i];
/*
+ * If the UF_FORKCLOSE flag is set, skip the fd.
* XXX Gruesome hack. If count gets too high, fail
* to copy an fd, since fdcopy()'s callers do not
* permit it to indicate failure yet.
@@ -1150,6 +1162,7 @@ fdcopy(struct process *pr)
* their internal consistency, so close them here.
*/
if (fp->f_count >= FDUP_MAX_COUNT ||
+ (fileflags & UF_FORKCLOSE) ||
fp->f_type == DTYPE_KQUEUE) {
if (i < newfdp->fd_freefile)
newfdp->fd_freefile = i;
@@ -1158,7 +1171,7 @@ fdcopy(struct process *pr)
FREF(fp);
newfdp->fd_ofiles[i] = fp;
- newfdp->fd_ofileflags[i] = fdp->fd_ofileflags[i];
+ newfdp->fd_ofileflags[i] = fileflags;
fd_used(newfdp, i);
}
}
@@ -1414,17 +1427,18 @@ dupfdopen(struct proc *p, int indx, int
}
/*
- * Close any files on exec?
+ * Doing an exec, so handle fd flags: do close-on-exec and clear
+ * pledged and close-on-fork
*/
void
-fdcloseexec(struct proc *p)
+fdprepforexec(struct proc *p)
{
struct filedesc *fdp = p->p_fd;
int fd;
fdplock(fdp);
for (fd = 0; fd <= fdp->fd_lastfile; fd++) {
- fdp->fd_ofileflags[fd] &= ~UF_PLEDGED;
+ fdp->fd_ofileflags[fd] &= ~(UF_PLEDGED | UF_FORKCLOSE);
if (fdp->fd_ofileflags[fd] & UF_EXCLOSE) {
/* fdrelease() unlocks fdp. */
(void) fdrelease(p, fd);
Index: sys/kern/kern_exec.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/kern_exec.c,v
diff -u -p -r1.264 kern_exec.c
--- sys/kern/kern_exec.c 31 May 2025 12:40:33 -0000 1.264
+++ sys/kern/kern_exec.c 22 Jun 2025 00:08:45 -0000
@@ -272,6 +272,7 @@ sys_execve(struct proc *p, void *v, regi
struct ps_strings arginfo;
struct vmspace *vm = p->p_vmspace;
struct vnode *otvp;
+ int i;
/*
* Get other threads to stop, if contested return ERESTART,
@@ -531,7 +532,7 @@ sys_execve(struct proc *p, void *v, regi
}
stopprofclock(pr); /* stop profiling */
- fdcloseexec(p); /* handle close on exec */
+ fdprepforexec(p); /* handle close on exec and close on fork */
execsigs(p); /* reset caught signals */
TCB_SET(p, NULL); /* reset the TCB address */
pr->ps_kbind_addr = 0; /* reset the kbind bits */
@@ -601,8 +602,6 @@ sys_execve(struct proc *p, void *v, regi
* MNT_NOEXEC has already been used to disable s[ug]id.
*/
if ((attr.va_mode & (VSUID | VSGID)) && proc_cansugid(p)) {
- int i;
-
atomic_setbits_int(&pr->ps_flags, PS_SUGID|PS_SUGIDEXEC);
#ifdef KTRACE
@@ -618,66 +617,63 @@ sys_execve(struct proc *p, void *v, regi
cred->cr_uid = attr.va_uid;
if (attr.va_mode & VSGID)
cred->cr_gid = attr.va_gid;
+ } else
+ atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
+
+ /*
+ * A few caveats apply to stdin, stdout, and stderr.
+ */
+ fdplock(p->p_fd);
+ for (i = 0; i < 3; i++) {
+ struct file *fp = NULL;
+
+ /*
+ * NOTE - This will never return NULL because of immature fds
+ * since only kernel-threads share the file descriptor table.
+ */
+ fp = fd_getfile(p->p_fd, i);
/*
- * For set[ug]id processes, a few caveats apply to
- * stdin, stdout, and stderr.
+ * Ensure that stdin, stdout, and stderr are already
+ * allocated. We do not want userland to accidentally
+ * allocate descriptors in this range which has implied
+ * meaning to libc.
*/
- error = 0;
- fdplock(p->p_fd);
- for (i = 0; i < 3; i++) {
- struct file *fp = NULL;
-
- /*
- * NOTE - This will never return NULL because of
- * immature fds. The file descriptor table is not
- * shared because we're suid.
- */
- fp = fd_getfile(p->p_fd, i);
-
- /*
- * Ensure that stdin, stdout, and stderr are already
- * allocated. We do not want userland to accidentally
- * allocate descriptors in this range which has implied
- * meaning to libc.
- */
- if (fp == NULL) {
- short flags = FREAD | (i == 0 ? 0 : FWRITE);
- struct vnode *vp;
- int indx;
+ if (fp == NULL) {
+ short flags = FREAD | (i == 0 ? 0 : FWRITE);
+ struct vnode *vp;
+ int indx;
- if ((error = falloc(p, &fp, &indx)) != 0)
- break;
+ if ((error = falloc(p, &fp, &indx)) != 0)
+ break;
#ifdef DIAGNOSTIC
- if (indx != i)
- panic("sys_execve: falloc indx != i");
+ if (indx != i)
+ panic("sys_execve: falloc indx != i");
#endif
- if ((error = cdevvp(getnulldev(), &vp)) != 0) {
- fdremove(p->p_fd, indx);
- closef(fp, p);
- break;
- }
- if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
- fdremove(p->p_fd, indx);
- closef(fp, p);
- vrele(vp);
- break;
- }
- if (flags & FWRITE)
- vp->v_writecount++;
- fp->f_flag = flags;
- fp->f_type = DTYPE_VNODE;
- fp->f_ops = &vnops;
- fp->f_data = (caddr_t)vp;
- fdinsert(p->p_fd, indx, 0, fp);
+ if ((error = cdevvp(getnulldev(), &vp)) != 0) {
+ fdremove(p->p_fd, indx);
+ closef(fp, p);
+ break;
}
- FRELE(fp, p);
+ if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
+ fdremove(p->p_fd, indx);
+ closef(fp, p);
+ vrele(vp);
+ break;
+ }
+ if (flags & FWRITE)
+ vp->v_writecount++;
+ fp->f_flag = flags;
+ fp->f_type = DTYPE_VNODE;
+ fp->f_ops = &vnops;
+ fp->f_data = (caddr_t)vp;
+ fdinsert(p->p_fd, indx, 0, fp);
}
- fdpunlock(p->p_fd);
- if (error)
- goto exec_abort;
- } else
- atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
+ FRELE(fp, p);
+ }
+ fdpunlock(p->p_fd);
+ if (error)
+ goto exec_abort;
/*
* Reset the saved ugids and update the process's copy of the
Index: sys/kern/sys_pipe.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/sys_pipe.c,v
diff -u -p -r1.148 sys_pipe.c
--- sys/kern/sys_pipe.c 30 Dec 2024 02:46:00 -0000 1.148
+++ sys/kern/sys_pipe.c 22 Jun 2025 00:08:45 -0000
@@ -162,7 +162,7 @@ sys_pipe2(struct proc *p, void *v, regis
syscallarg(int) flags;
} */ *uap = v;
- if (SCARG(uap, flags) & ~(O_CLOEXEC | FNONBLOCK))
+ if (SCARG(uap, flags) & ~(O_CLOEXEC | O_CLOFORK | FNONBLOCK))
return (EINVAL);
return (dopipe(p, SCARG(uap, fdp), SCARG(uap, flags)));
@@ -175,9 +175,10 @@ dopipe(struct proc *p, int *ufds, int fl
struct file *rf, *wf;
struct pipe_pair *pp;
struct pipe *rpipe, *wpipe = NULL;
- int fds[2], cloexec, error;
+ int fds[2], fdflags, error;
- cloexec = (flags & O_CLOEXEC) ? UF_EXCLOSE : 0;
+ fdflags = ((flags & O_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((flags & O_CLOFORK) ? UF_FORKCLOSE : 0);
pp = pipe_pair_create();
if (pp == NULL)
@@ -203,8 +204,8 @@ dopipe(struct proc *p, int *ufds, int fl
wf->f_data = wpipe;
wf->f_ops = &pipeops;
- fdinsert(fdp, fds[0], cloexec, rf);
- fdinsert(fdp, fds[1], cloexec, wf);
+ fdinsert(fdp, fds[0], fdflags, rf);
+ fdinsert(fdp, fds[1], fdflags, wf);
error = copyout(fds, ufds, sizeof(fds));
if (error == 0) {
Index: sys/kern/uipc_syscalls.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/uipc_syscalls.c,v
diff -u -p -r1.223 uipc_syscalls.c
--- sys/kern/uipc_syscalls.c 20 Jun 2025 14:34:34 -0000 1.223
+++ sys/kern/uipc_syscalls.c 22 Jun 2025 00:10:23 -0000
@@ -81,7 +81,7 @@ sys_socket(struct proc *p, void *v, regi
struct file *fp;
int type = SCARG(uap, type);
int domain = SCARG(uap, domain);
- int fd, cloexec, nonblock, fflag, error;
+ int fd, fdflags, nonblock, fflag, error;
unsigned int ss = 0;
if ((type & SOCK_DNS) && !(domain == AF_INET || domain == AF_INET6))
@@ -93,8 +93,9 @@ sys_socket(struct proc *p, void *v, regi
if (error)
return (error);
- type &= ~(SOCK_CLOEXEC | SOCK_NONBLOCK | SOCK_DNS);
- cloexec = (SCARG(uap, type) & SOCK_CLOEXEC) ? UF_EXCLOSE : 0;
+ type &= ~(SOCK_CLOEXEC | SOCK_CLOFORK | SOCK_NONBLOCK | SOCK_DNS);
+ fdflags = ((SCARG(uap, type) & SOCK_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((SCARG(uap, type) & SOCK_CLOFORK) ? UF_FORKCLOSE : 0);
nonblock = SCARG(uap, type) & SOCK_NONBLOCK;
fflag = FREAD | FWRITE | (nonblock ? FNONBLOCK : 0);
@@ -113,7 +114,7 @@ sys_socket(struct proc *p, void *v, regi
fp->f_ops = &socketops;
so->so_state |= ss;
fp->f_data = so;
- fdinsert(fdp, fd, cloexec, fp);
+ fdinsert(fdp, fd, fdflags, fp);
fdpunlock(fdp);
FRELE(fp, p);
*retval = fd;
@@ -240,7 +241,7 @@ sys_accept4(struct proc *p, void *v, reg
syscallarg(socklen_t *) int flags;
} */ *uap = v;
- if (SCARG(uap, flags) & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
+ if (SCARG(uap, flags) & ~(SOCK_CLOEXEC | SOCK_CLOFORK | SOCK_NONBLOCK))
return (EINVAL);
return (doaccept(p, SCARG(uap, s), SCARG(uap, name),
@@ -257,9 +258,10 @@ doaccept(struct proc *p, int sock, struc
socklen_t namelen;
int error, tmpfd;
struct socket *head, *so;
- int cloexec, nflag;
+ int fdflags, nflag;
- cloexec = (flags & SOCK_CLOEXEC) ? UF_EXCLOSE : 0;
+ fdflags = ((flags & SOCK_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((flags & SOCK_CLOFORK) ? UF_FORKCLOSE : 0);
if (name && (error = copyin(anamelen, &namelen, sizeof (namelen))))
return (error);
@@ -346,7 +348,7 @@ doaccept(struct proc *p, int sock, struc
}
fdplock(fdp);
- fdinsert(fdp, tmpfd, cloexec, fp);
+ fdinsert(fdp, tmpfd, fdflags, fp);
fdpunlock(fdp);
FRELE(fp, p);
*retval = tmpfd;
@@ -457,10 +459,11 @@ sys_socketpair(struct proc *p, void *v,
struct filedesc *fdp = p->p_fd;
struct file *fp1 = NULL, *fp2 = NULL;
struct socket *so1, *so2;
- int type, cloexec, nonblock, fflag, error, sv[2];
+ int type, fdflags, nonblock, fflag, error, sv[2];
- type = SCARG(uap, type) & ~(SOCK_CLOEXEC | SOCK_NONBLOCK);
- cloexec = (SCARG(uap, type) & SOCK_CLOEXEC) ? UF_EXCLOSE : 0;
+ type = SCARG(uap, type) & ~(SOCK_CLOEXEC | SOCK_CLOFORK | SOCK_NONBLOCK);
+ fdflags = ((SCARG(uap, type) & SOCK_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((SCARG(uap, type) & SOCK_CLOFORK) ? UF_FORKCLOSE : 0);
nonblock = SCARG(uap, type) & SOCK_NONBLOCK;
fflag = FREAD | FWRITE | (nonblock ? FNONBLOCK : 0);
@@ -498,8 +501,8 @@ sys_socketpair(struct proc *p, void *v,
fp2->f_data = so2;
error = copyout(sv, SCARG(uap, rsv), 2 * sizeof (int));
if (error == 0) {
- fdinsert(fdp, sv[0], cloexec, fp1);
- fdinsert(fdp, sv[1], cloexec, fp2);
+ fdinsert(fdp, sv[0], fdflags, fp1);
+ fdinsert(fdp, sv[1], fdflags, fp2);
fdpunlock(fdp);
#ifdef KTRACE
if (KTRPOINT(p, KTR_STRUCT))
Index: sys/kern/uipc_usrreq.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/uipc_usrreq.c,v
diff -u -p -r1.220 uipc_usrreq.c
--- sys/kern/uipc_usrreq.c 12 Jun 2025 20:37:58 -0000 1.220
+++ sys/kern/uipc_usrreq.c 22 Jun 2025 00:08:45 -0000
@@ -1146,6 +1146,8 @@ restart:
fdp->fd_ofileflags[fds[i]] = (rp->flags & UF_PLEDGED);
if (flags & MSG_CMSG_CLOEXEC)
fdp->fd_ofileflags[fds[i]] |= UF_EXCLOSE;
+ if (flags & MSG_CMSG_CLOFORK)
+ fdp->fd_ofileflags[fds[i]] |= UF_FORKCLOSE;
rp++;
}
Index: sys/kern/vfs_syscalls.c
===================================================================
RCS file: /data/src/openbsd/src/sys/kern/vfs_syscalls.c,v
diff -u -p -r1.375 vfs_syscalls.c
--- sys/kern/vfs_syscalls.c 27 Apr 2025 00:58:55 -0000 1.375
+++ sys/kern/vfs_syscalls.c 22 Jun 2025 00:08:45 -0000
@@ -1086,7 +1086,7 @@ doopenat(struct proc *p, int fd, const c
struct file *fp;
struct vnode *vp;
struct vattr vattr;
- int flags, cloexec, cmode;
+ int flags, fdflags, cmode;
int type, indx, error, localtrunc = 0;
struct flock lf;
struct nameidata nd;
@@ -1099,7 +1099,8 @@ doopenat(struct proc *p, int fd, const c
return (error);
}
- cloexec = (oflags & O_CLOEXEC) ? UF_EXCLOSE : 0;
+ fdflags = ((oflags & O_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((oflags & O_CLOFORK) ? UF_FORKCLOSE : 0);
fdplock(fdp);
if ((error = falloc(p, &fp, &indx)) != 0) {
@@ -1200,7 +1201,7 @@ doopenat(struct proc *p, int fd, const c
KERNEL_UNLOCK();
*retval = indx;
fdplock(fdp);
- fdinsert(fdp, indx, cloexec, fp);
+ fdinsert(fdp, indx, fdflags, fp);
fdpunlock(fdp);
FRELE(fp, p);
return (error);
@@ -1224,7 +1225,7 @@ sys___tmpfd(struct proc *p, void *v, reg
struct file *fp;
struct vnode *vp;
int oflags = SCARG(uap, flags);
- int flags, cloexec, cmode;
+ int flags, fdflags, cmode;
int indx, error;
unsigned int i;
struct nameidata nd;
@@ -1232,9 +1233,11 @@ sys___tmpfd(struct proc *p, void *v, reg
static const char *letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-";
/* most flags are hardwired */
- oflags = O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW | (oflags & O_CLOEXEC);
+ oflags = O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW |
+ (oflags & (O_CLOEXEC | O_CLOFORK));
- cloexec = (oflags & O_CLOEXEC) ? UF_EXCLOSE : 0;
+ fdflags = ((oflags & O_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((oflags & O_CLOFORK) ? UF_FORKCLOSE : 0);
fdplock(fdp);
if ((error = falloc(p, &fp, &indx)) != 0) {
@@ -1270,7 +1273,7 @@ sys___tmpfd(struct proc *p, void *v, reg
VOP_UNLOCK(vp);
*retval = indx;
fdplock(fdp);
- fdinsert(fdp, indx, cloexec, fp);
+ fdinsert(fdp, indx, fdflags, fp);
fdpunlock(fdp);
FRELE(fp, p);
@@ -1352,7 +1355,7 @@ sys_fhopen(struct proc *p, void *v, regi
struct vnode *vp = NULL;
struct mount *mp;
struct ucred *cred = p->p_ucred;
- int flags, cloexec;
+ int flags, fdflags;
int type, indx, error=0;
struct flock lf;
struct vattr va;
@@ -1370,7 +1373,8 @@ sys_fhopen(struct proc *p, void *v, regi
if ((flags & O_CREAT))
return (EINVAL);
- cloexec = (flags & O_CLOEXEC) ? UF_EXCLOSE : 0;
+ fdflags = ((flags & O_CLOEXEC) ? UF_EXCLOSE : 0)
+ | ((flags & O_CLOFORK) ? UF_FORKCLOSE : 0);
fdplock(fdp);
if ((error = falloc(p, &fp, &indx)) != 0) {
@@ -1456,7 +1460,7 @@ sys_fhopen(struct proc *p, void *v, regi
VOP_UNLOCK(vp);
*retval = indx;
fdplock(fdp);
- fdinsert(fdp, indx, cloexec, fp);
+ fdinsert(fdp, indx, fdflags, fp);
fdpunlock(fdp);
FRELE(fp, p);
return (0);
Index: lib/libc/gen/opendir.c
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/gen/opendir.c,v
diff -u -p -r1.31 opendir.c
--- lib/libc/gen/opendir.c 15 Apr 2024 15:47:58 -0000 1.31
+++ lib/libc/gen/opendir.c 22 Jun 2025 00:08:45 -0000
@@ -82,7 +82,9 @@ fdopendir(int fd)
* POSIX doesn't require fdopendir() to set
* FD_CLOEXEC, so it's okay for this to fail.
*/
- (void)fcntl(fd, F_SETFD, FD_CLOEXEC);
+ flags = fcntl(fd, F_GETFD);
+ if (flags != -1 && (flags & FD_CLOEXEC) == 0)
+ (void)fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
}
return (dirp);
}
Index: lib/libc/gen/shm_open.3
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/gen/shm_open.3,v
diff -u -p -r1.5 shm_open.3
--- lib/libc/gen/shm_open.3 5 May 2015 06:29:15 -0000 1.5
+++ lib/libc/gen/shm_open.3 22 Jun 2025 00:08:45 -0000
@@ -45,7 +45,7 @@ and must include at least
or
.Dv O_RDWR
and may also include a combination of
-.Dv O_CREAT , O_EXCL , O_CLOEXEC , O_NOFOLLOW ,
+.Dv O_CREAT , O_EXCL , O_CLOEXEC , O_CLOFORK , O_NOFOLLOW ,
or
.Dv O_TRUNC .
This implementation forces the
@@ -82,7 +82,8 @@ and
appear in
.St -p1003.1-2001 .
Using
-.Dv O_CLOEXEC
+.Dv O_CLOEXEC ,
+.Dv O_CLOFORK ,
or
.Dv O_NOFOLLOW
with
Index: lib/libc/gen/shm_open.c
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/gen/shm_open.c,v
diff -u -p -r1.9 shm_open.c
--- lib/libc/gen/shm_open.c 10 Sep 2017 18:20:00 -0000 1.9
+++ lib/libc/gen/shm_open.c 22 Jun 2025 00:08:45 -0000
@@ -31,8 +31,9 @@
/* "/tmp/" + sha256 + ".shm" */
#define SHM_PATH_SIZE (5 + SHA256_DIGEST_STRING_LENGTH + 4)
-/* O_CLOEXEC and O_NOFOLLOW are extensions to POSIX */
-#define OK_FLAGS (O_CREAT | O_EXCL | O_TRUNC | O_CLOEXEC | O_NOFOLLOW)
+/* O_CLOEXEC, O_CLOFORK, and O_NOFOLLOW are extensions to POSIX */
+#define OK_FLAGS \
+ (O_CREAT | O_EXCL | O_TRUNC | O_CLOEXEC | O_CLOFORK | O_NOFOLLOW)
static void
makeshmpath(const char *origpath, char *shmpath, size_t len)
Index: lib/libc/sys/accept.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/accept.2,v
diff -u -p -r1.30 accept.2
--- lib/libc/sys/accept.2 11 Sep 2022 06:38:11 -0000 1.30
+++ lib/libc/sys/accept.2 22 Jun 2025 00:08:45 -0000
@@ -58,19 +58,18 @@ call extracts the first connection reque
connections, creates a new socket with the same non-blocking I/O mode as
.Fa s ,
and allocates a new file descriptor for the socket with the
-close-on-exec flag clear.
+close-on-exec and close-on-fork flags clear.
.Pp
The
.Fn accept4
-system call is similar, however the non-blocking I/O mode of the
-new socket is determined by the
-.Dv SOCK_NONBLOCK
-flag in the
-.Fa flags
-argument and the close-on-exec flag on the new file descriptor is
+system call is similar, however the non-blocking I/O mode,
+close-on-exec flag,
+and close-on-fork flag on the new file descriptor are
determined by the
-.Dv SOCK_CLOEXEC
-flag in the
+.Dv SOCK_NONBLOCK , SOCK_CLOEXEC ,
+and
+.Dv SOCK_CLOFORK
+flags, respectively, in the
.Fa flags
argument.
.Pp
@@ -204,11 +203,10 @@ is invalid.
.Sh STANDARDS
The
.Fn accept
-function conforms to
-.St -p1003.1-2008 .
-The
+and
.Fn accept4
-function is expected to conform to a future revision of that standard.
+functions conform to
+.St -p1003.1-2024 .
.Sh HISTORY
The
.Fn accept
Index: lib/libc/sys/dup.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/dup.2,v
diff -u -p -r1.20 dup.2
--- lib/libc/sys/dup.2 25 Jun 2018 16:06:27 -0000 1.20
+++ lib/libc/sys/dup.2 22 Jun 2025 00:08:45 -0000
@@ -86,7 +86,8 @@ object reference to the file must be obt
additional
.Xr open 2
call.
-The close-on-exec flag on the new file descriptor is unset.
+The close-on-exec and close-on-fork flags on the new file descriptor
+are unset.
.Pp
In
.Fn dup2 ,
@@ -101,18 +102,21 @@ When
equals
.Fa oldd ,
.Fn dup2
-just returns without affecting the close-on-exec flag.
+just returns without affecting the close-on-exec or close-on-fork flags.
.Pp
In
.Fn dup3 ,
-both the value of the new descriptor and the close-on-exec flag on
-the new file descriptor are specified:
+the value of the new descriptor and the close-on-exec and close-on-fork
+flags on
+the new file descriptor are all specified:
.Fa newd
specifies the value and the
.Dv O_CLOEXEC
-bit in
+and
+.Dv O_CLOFORK
+bits in
.Fa flags
-specifies the close-on-exec flag.
+specify the close-on-exec and close-on-forks flag, respectively.
Unlike
.Fn dup2 ,
if
@@ -192,14 +196,13 @@ is invalid.
.Xr socketpair 2 ,
.Xr getdtablesize 3
.Sh STANDARDS
-.Fn dup
-and
-.Fn dup2
-conform to
-.St -p1003.1-2008 .
The
+.Fn dup ,
+.Fn dup2 ,
+and
.Fn dup3
-function is expected to conform to a future revision of that standard.
+functions conform to
+.St -p1003.1-2024 .
.Sh HISTORY
The
.Fn dup
Index: lib/libc/sys/fcntl.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/fcntl.2,v
diff -u -p -r1.36 fcntl.2
--- lib/libc/sys/fcntl.2 29 Dec 2022 02:12:41 -0000 1.36
+++ lib/libc/sys/fcntl.2 22 Jun 2025 00:08:45 -0000
@@ -95,22 +95,47 @@ flag associated with the new file descri
is closed when
.Xr execve 2
is called.
+.It Dv F_DUPFD_CLOFORK
+Like
+.Dv F_DUPFD ,
+but the
+.Dv FD_CLOFORK
+flag associated with the new file descriptor is set, so the file descriptor
+is closed when
+.Xr fork 2
+or
+.Xr vfork 2
+is called.
.It Dv F_GETFD
-Get the close-on-exec flag associated with the file descriptor
+Get the close-on-exec and close-on-fork flags associated with the
+file descriptor
.Fa fd
as
-.Dv FD_CLOEXEC .
+.Dv FD_CLOEXEC
+and
+.Dv FD_CLOFORK .
If the returned value ANDed with
.Dv FD_CLOEXEC
is 0,
the file will remain open across
.Fn exec ,
otherwise the file will be closed upon execution of
-.Fn exec
+.Fn exec ;
+if the returned value ANDed with
+.Dv FD_CLOFORK
+is 0,
+the file will remain open across
+.Fn fork
+and
+.Fn vfork ,
+otherwise the file will be closed upon execution of
+.Fn fork
+or
+.Fn vfork
.Fa ( arg
is ignored).
.It Dv F_SETFD
-Set the close-on-exec flag associated with
+Set the close-on-exec and close-on-fork flags associated with
.Fa fd
to
.Fa arg ,
@@ -118,8 +143,10 @@ where
.Fa arg
(interpreted as an
.Vt int )
-is either 0 or
-.Dv FD_CLOEXEC ,
+is the bitwise OR of zero or more of
+.Dv FD_CLOEXEC
+and
+.Dv FD_CLOFORK ,
as described above.
.It Dv F_GETFL
Get file status flags associated with the file descriptor
@@ -392,8 +419,14 @@ as follows:
A new file descriptor.
.It Dv F_DUPFD_CLOEXEC
A new file descriptor.
+.It Dv F_DUPFD_CLOFORK
+A new file descriptor.
.It Dv F_GETFD
-Value of flag (only the low-order bit is defined).
+Value of file descriptor flags (only the
+.Dv FD_CLOEXEC
+and
+.Dv FD_CLOFORK
+bits are defined).
.It Dv F_GETFL
Value of flags.
.It Dv F_GETOWN
Index: lib/libc/sys/open.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/open.2,v
diff -u -p -r1.51 open.2
--- lib/libc/sys/open.2 31 Mar 2022 17:27:16 -0000 1.51
+++ lib/libc/sys/open.2 22 Jun 2025 00:08:45 -0000
@@ -109,6 +109,11 @@ Set
.Dv FD_CLOEXEC
(the close-on-exec flag)
on the new file descriptor.
+.It Dv O_CLOFORK
+Set
+.Dv FD_CLOFORK
+(the close-on-fork flag)
+on the new file descriptor.
.It Dv O_DIRECTORY
Error if
.Fa path
Index: lib/libc/sys/pipe.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/pipe.2,v
diff -u -p -r1.18 pipe.2
--- lib/libc/sys/pipe.2 10 Dec 2014 19:30:22 -0000 1.18
+++ lib/libc/sys/pipe.2 22 Jun 2025 00:08:45 -0000
@@ -79,15 +79,14 @@ The
.Fn pipe2
function is identical to
.Fn pipe
-except that the non-blocking I/O mode on both ends of the pipe is
+except that the non-blocking I/O mode,
+close-on-exec flag,
+and close-on-fork flag are
determined by the
-.Dv O_NONBLOCK
-flag in the
-.Fa flags
-argument and the close-on-exec flag on both the new file descriptors
-is determined by the
-.Dv O_CLOEXEC
-flag in the
+.Dv O_NONBLOCK , O_CLOEXEC ,
+and
+.Dv O_CLOFORK
+flags, respectively, in the
.Fa flags
argument.
.Sh RETURN VALUES
@@ -125,11 +124,10 @@ is invalid.
.Sh STANDARDS
The
.Fn pipe
-function conforms to
-.St -p1003.1-2008 .
-The
+and
.Fn pipe2
-function is expected to conform to a future revision of that standard.
+functions conform to
+.St -p1003.1-2024 .
.Pp
As an extension, the pipe provided is actually capable of moving
data bidirectionally.
Index: lib/libc/sys/socket.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/socket.2,v
diff -u -p -r1.44 socket.2
--- lib/libc/sys/socket.2 31 Mar 2022 17:27:16 -0000 1.44
+++ lib/libc/sys/socket.2 22 Jun 2025 00:08:45 -0000
@@ -103,6 +103,8 @@ argument:
.Bl -tag -width "SOCK_NONBLOCKX" -offset indent -compact
.It SOCK_CLOEXEC
Set close-on-exec flag on the new descriptor.
+.It SOCK_CLOFORK
+Set close-on-fork flag on the new descriptor.
.It SOCK_NONBLOCK
Set non-blocking I/O mode on the new socket.
.It SOCK_DNS
@@ -282,12 +284,7 @@ is denied.
The
.Fn socket
function conforms to
-.St -p1003.1-2008 .
-The
-.Dv SOCK_CLOEXEC
-and
-.Dv SOCK_NONBLOCK
-flags are expected to conform to a future revision of that standard.
+.St -p1003.1-2024 .
.Pp
The
.Dv SOCK_DNS
Index: lib/libc/sys/socketpair.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/socketpair.2,v
diff -u -p -r1.21 socketpair.2
--- lib/libc/sys/socketpair.2 8 Apr 2018 18:46:43 -0000 1.21
+++ lib/libc/sys/socketpair.2 22 Jun 2025 00:08:45 -0000
@@ -75,6 +75,8 @@ argument:
.Bl -tag -width "SOCK_NONBLOCKX" -offset indent -compact
.It SOCK_CLOEXEC
Set close-on-exec flag on both the new descriptors.
+.It SOCK_CLOFORK
+Set close-on-fork flag on both the new descriptors.
.It SOCK_NONBLOCK
Set non-blocking I/O mode on both the new sockets.
.El
@@ -113,12 +115,7 @@ process address space.
The
.Fn socketpair
function conforms to
-.St -p1003.1-2008 .
-The
-.Dv SOCK_CLOEXEC
-and
-.Dv SOCK_NONBLOCK
-flags are expected to conform to a future revision of that standard.
+.St -p1003.1-2024 .
.Sh HISTORY
The
.Fn socketpair
Index: lib/libc/sys/w_fcntl.c
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/w_fcntl.c,v
diff -u -p -r1.1 w_fcntl.c
--- lib/libc/sys/w_fcntl.c 7 May 2016 19:05:22 -0000 1.1
+++ lib/libc/sys/w_fcntl.c 22 Jun 2025 00:08:45 -0000
@@ -29,6 +29,7 @@ fcntl(int fd, int cmd, ...)
switch (cmd) {
case F_DUPFD:
case F_DUPFD_CLOEXEC:
+ case F_DUPFD_CLOFORK:
case F_SETFD:
case F_SETFL:
case F_SETOWN:
Index: lib/libc/sys/execve.2
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/sys/execve.2,v
diff -u -p -r1.58 execve.2
--- lib/libc/sys/execve.2 13 Oct 2022 21:37:05 -0000 1.58
+++ lib/libc/sys/execve.2 22 Jun 2025 00:32:58 -0000
@@ -108,9 +108,10 @@ flag is set (see
.Xr close 2
and
.Xr fcntl 2 ) .
-Descriptors that remain open are unaffected by
-.Fn execve .
-In the case of a new setuid or setgid executable being executed, if
+Other descriptors remain open after
+.Fn execve ,
+however the close-on-fork flag is cleared.
+If
file descriptors 0, 1, or 2 (representing stdin, stdout, and stderr)
are currently unallocated, these descriptors will be opened to point to
some system file like
@@ -329,6 +330,15 @@ The
.Fn execve
function first appeared in
.At v7 .
+.Pp
+In
+.Ox 2.4 ,
+.Fn execve
+started ensuring that file descriptors 0, 1, and 2 are open when
+starting a setuid or setgid process.
+In
+.Ox 7.8
+that was extended to all processes.
.Sh CAVEATS
If a program is
.Em setuid
Index: lib/libc/stdlib/mkstemp.c
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/stdlib/mkstemp.c,v
diff -u -p -r1.1 mkstemp.c
--- lib/libc/stdlib/mkstemp.c 19 Jan 2024 19:45:02 -0000 1.1
+++ lib/libc/stdlib/mkstemp.c 22 Jun 2025 00:08:45 -0000
@@ -20,7 +20,8 @@
#include <fcntl.h>
#include <stdlib.h>
-#define MKOSTEMP_FLAGS (O_APPEND | O_CLOEXEC | O_DSYNC | O_RSYNC | O_SYNC)
+#define MKOSTEMP_FLAGS \
+ (O_APPEND | O_CLOEXEC | O_CLOFORK | O_DSYNC | O_RSYNC | O_SYNC)
static int
mkstemp_cb(const char *path, int flags)
Index: lib/libc/stdlib/mktemp.3
===================================================================
RCS file: /data/src/openbsd/src/lib/libc/stdlib/mktemp.3,v
diff -u -p -r1.2 mktemp.3
--- lib/libc/stdlib/mktemp.3 1 Mar 2024 21:30:40 -0000 1.2
+++ lib/libc/stdlib/mktemp.3 22 Jun 2025 00:08:45 -0000
@@ -119,6 +119,8 @@ system call:
Append on each write.
.It Dv O_CLOEXEC
Set the close-on-exec flag on the new file descriptor.
+.It Dv O_CLOFORK
+Set the close-on-fork flag on the new file descriptor.
.It Dv O_SYNC
Perform synchronous I/O operations.
.El
@@ -345,18 +347,16 @@ function.
.Xr tmpnam 3
.Sh STANDARDS
The
-.Fn mkdtemp
+.Fn mkdtemp ,
+.Fn mkostemp ,
and
.Fn mkstemp
functions conform to the
-.St -p1003.1-2008
+.St -p1003.1-2024
specification.
The ability to specify more than six
.Em X Ns s
is an extension to that standard.
-The
-.Fn mkostemp
-function is expected to conform to a future revision of that standard.
.Pp
The
.Fn mktemp
[PATCH]: Add POSIX O_CLOFORK flag