Please consider pulling these changes from the signed vfs-7.4-rc1.close_range tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
ouFoAP9oJWCJRlKwbki5KP0P3O6/gnQXUz8gR07qxzWk8Gz/NgD/V3+MHkU8fX2w
oTOGPuwrbbRNBTK/cmRG2kF6xxOPSw8=
=jDl8
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull close_range updates from Christian Brauner:
"This adds two new close_range() flags.
CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
outside of [fd, max_fd] instead of the ones inside. Alone it closes
everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
takes a reference on what is dropped. So a task between
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
descriptors for the child in one window can shed the rest of the
shared table in one call and nothing outside of the window is
referenced by the child at any point.
CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
range and leaves everything else alone. Whatever the caller
deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
close-on-exec descriptors that have to survive, the executable or an
error pipe, and closes every other close-on-exec descriptor.
Along the way dup_fd() stops copying a range in the middle of the
table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
avoided the copy when the range sat at the end of the table.
Descriptors in a skipped range are never copied and no reference is
taken on them, so ->flush() isn't called anymore for files from a
table they were never part of. The flags are turned into an enum and
selftests cover the window positions, the shared and the private table
and the unshare form"
* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
file: add CLOSE_RANGE_CLOEXEC_ONLY
file: let dup_fd() drop only close-on-exec descriptors
selftests/core: test CLOSE_RANGE_EXCEPT
file: add CLOSE_RANGE_EXCEPT
close_range: turn the flags into an enum
file: let dup_fd() drop everything outside of the range
file: rename dup_fd()'s punch_hole to range
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: let dup_fd() leave the punched hole behind
4effd80841