From f4e5a730002fa7ed714b89775c3e5fae6d003aae Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 26 Feb 2025 09:10:16 +0100 Subject: [PATCH 1/2] tpm2-setup: add missing O_CLOEXEC at two places --- src/tpm2-setup/tpm2-setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tpm2-setup/tpm2-setup.c b/src/tpm2-setup/tpm2-setup.c index ab5bd9bff9..43771a28ca 100644 --- a/src/tpm2-setup/tpm2-setup.c +++ b/src/tpm2-setup/tpm2-setup.c @@ -338,7 +338,7 @@ static int run(int argc, char *argv[]) { /* Write out public key (note that we only do that as a help to the user, we don't make use of this ever */ _cleanup_(unlink_and_freep) char *t = NULL; _cleanup_fclose_ FILE *f = NULL; - r = fopen_tmpfile_linkable(pem_path, O_WRONLY, &t, &f); + r = fopen_tmpfile_linkable(pem_path, O_WRONLY|O_CLOEXEC, &t, &f); if (r < 0) return log_error_errno(r, "Failed to open SRK public key file '%s' for writing: %m", pem_path); @@ -365,7 +365,7 @@ static int run(int argc, char *argv[]) { (void) mkdir_parents(tpm2b_public_path, 0755); /* Now also write this out in TPM2B_PUBLIC format */ - r = fopen_tmpfile_linkable(tpm2b_public_path, O_WRONLY, &t, &f); + r = fopen_tmpfile_linkable(tpm2b_public_path, O_WRONLY|O_CLOEXEC, &t, &f); if (r < 0) return log_error_errno(r, "Failed to open SRK public key file '%s' for writing: %m", tpm2b_public_path); From d10d5a050866dd70942201b55df59407017b7fd0 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 26 Feb 2025 09:12:39 +0100 Subject: [PATCH 2/2] tpm2-setup: remove redundant fflush_and_check() The immediately following flink_tmpfile() does that anyway, hence no need to do so explicitly beforehand. (Also the log message was wrong: it says "sync" but here we "flush", which is a much weaker operation) --- src/tpm2-setup/tpm2-setup.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/src/tpm2-setup/tpm2-setup.c b/src/tpm2-setup/tpm2-setup.c index 43771a28ca..6a9a7852e2 100644 --- a/src/tpm2-setup/tpm2-setup.c +++ b/src/tpm2-setup/tpm2-setup.c @@ -348,10 +348,6 @@ static int run(int argc, char *argv[]) { if (fchmod(fileno(f), 0444) < 0) return log_error_errno(errno, "Failed to adjust access mode of SRK public key file '%s' to 0444: %m", pem_path); - r = fflush_and_check(f); - if (r < 0) - return log_error_errno(r, "Failed to sync SRK key to disk: %m"); - r = flink_tmpfile(f, t, pem_path, LINK_TMPFILE_SYNC|LINK_TMPFILE_REPLACE); if (r < 0) return log_error_errno(r, "Failed to move SRK public key file to '%s': %m", pem_path); @@ -382,10 +378,6 @@ static int run(int argc, char *argv[]) { if (fchmod(fileno(f), 0444) < 0) return log_error_errno(errno, "Failed to adjust access mode of SRK public key file '%s' to 0444: %m", tpm2b_public_path); - r = fflush_and_check(f); - if (r < 0) - return log_error_errno(r, "Failed to sync SRK key to disk: %m"); - r = flink_tmpfile(f, t, tpm2b_public_path, LINK_TMPFILE_SYNC|LINK_TMPFILE_REPLACE); if (r < 0) return log_error_errno(r, "Failed to move SRK public key file to '%s': %m", tpm2b_public_path);