open files O_CLOEXEC|O_EXCL

Dumb patch that adds O_CLOEXEC to all open/fopen
calls, even where it is obviously pointless.

While at it, also add O_EXCL where it might be
considered useful, for example to clear Coverity
warnings, or on files that subsequently are used
to configure a join sandbox.

Pure defense in depth, this patch should have no
observable effects.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 46f32d7ad..c7b87235a 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -130,7 +130,7 @@ static int store_xauthority(void) {
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
@@ -178,7 +178,7 @@ static int store_asoundrc(void) {
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);