open files O_CLOEXEC|O_EXCL

Dumb patch that adds O_CLOEXEC to all open/fopen
calls, even where it is obviously pointless.

While at it, also add O_EXCL where it might be
considered useful, for example to clear Coverity
warnings, or on files that subsequently are used
to configure a join sandbox.

Pure defense in depth, this patch should have no
observable effects.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 4b9203c36..97c022bad 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -106,7 +106,7 @@ void pulseaudio_init(void) {
                 errExit("asprintf");
         if (copy_file(PULSE_CLIENT_SYSCONF, pulsecfg, -1, -1, 0644)) // root needed
                 errExit("copy_file");
-        FILE *fp = fopen(pulsecfg, "a");
+        FILE *fp = fopen(pulsecfg, "ae");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s", "\nenable-shm = no\n");