open files O_CLOEXEC|O_EXCL

Dumb patch that adds O_CLOEXEC to all open/fopen
calls, even where it is obviously pointless.

While at it, also add O_EXCL where it might be
considered useful, for example to clear Coverity
warnings, or on files that subsequently are used
to configure a join sandbox.

Pure defense in depth, this patch should have no
observable effects.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 3af828ede..2c751809e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -67,7 +67,7 @@ static void sandbox_handler(int sig){
                 if (asprintf(&monfile, "/proc/%d/cmdline", monitored_pid) == -1)
                         errExit("asprintf");
                 while (monsec) {
-                        FILE *fp = fopen(monfile, "r");
+                        FILE *fp = fopen(monfile, "re");
                         if (!fp)
                                 break;
 
@@ -162,7 +162,7 @@ static void save_nogroups(void) {
         if (arg_nogroups == 0)
                 return;
 
-        FILE *fp = fopen(RUN_GROUPS_CFG, "w");
+        FILE *fp = fopen(RUN_GROUPS_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "\n");
                 SET_PERMS_STREAM(fp, 0, 0, 0644); // assume mode 0644