open files O_CLOEXEC|O_EXCL

Dumb patch that adds O_CLOEXEC to all open/fopen
calls, even where it is obviously pointless.

While at it, also add O_EXCL where it might be
considered useful, for example to clear Coverity
warnings, or on files that subsequently are used
to configure a join sandbox.

Pure defense in depth, this patch should have no
observable effects.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/firejail/network.c b/src/firejail/network.c
index f7142cefd..289e164c6 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -217,7 +217,7 @@ int net_add_route(uint32_t ip, uint32_t mask, uint32_t gw) {
 
 #define BUFSIZE 1024
 uint32_t network_get_defaultgw(void) {
-        FILE *fp = fopen("/proc/self/net/route", "r");
+        FILE *fp = fopen("/proc/self/net/route", "re");
         if (!fp)
                 errExit("fopen");