2 files changed, 16 insertions, 9 deletions

diff --git a/src/fids/main.c b/src/fids/main.c
index c899b55e1..8f9bc1ea0 100644
--- a/src/fids/main.c
+++ b/src/fids/main.c
@@ -210,22 +210,29 @@ static void process_config(const char *fname) {
                 exit(1);
         }
 
-        // make sure the file is owned by root
-        struct stat s;
-        if (stat(fname, &s)) {
+        fprintf(stderr, "Opening config file %s\n", fname);
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0) {
                 if (include_level == 1) {
-                        fprintf(stderr, "Error ids: config file not found\n");
+                        fprintf(stderr, "Error ids: cannot open config file %s\n", fname);
                         exit(1);
                 }
                 return;
         }
+
+        // make sure the file is owned by root
+        struct stat s;
+        if (fstat(fd, &s)) {
+                fprintf(stderr, "Error ids: cannot stat config file %s\n", fname);
+                exit(1);
+        }
         if (s.st_uid || s.st_gid) {
                 fprintf(stderr, "Error ids: config file not owned by root\n");
                 exit(1);
         }
 
-        fprintf(stderr, "Loading %s config file\n", fname);
-        FILE *fp = fopen(fname, "r");
+        fprintf(stderr, "Loading config file %s\n", fname);
+        FILE *fp = fdopen(fd, "r");
         if (!fp) {
                 fprintf(stderr, "Error fids: cannot open config file %s\n", fname);
                 exit(1);
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 3d9bf9082..e02be29f1 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -435,11 +435,11 @@ void seccomp_print_filter(pid_t pid) {
         if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        if (stat(fname, &s) == -1)
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0)
                 goto errexit;
 
-        FILE *fp = fopen(fname, "re");
+        FILE *fp = fdopen(fd, "r");
         if (!fp)
                 goto errexit;
         free(fname);