Manpages - close_range.2

To avoid blindly closing file descriptors in the range of possible file descriptors, this is sometimes implemented (on Linux) by listing open file descriptors in proc/self/fd and calling *close*(2) on each one. *close_range*() can take care of this without requiring /proc and within a single system call, which provides significant performance benefits.

File descriptors can be closed safely using

  /* we don't want anything past stderr here */
  close_range(3, ~0U, CLOSE_RANGE_UNSHARE);
  execve(....);

CLOSE_RANGE_UNSHARE is conceptually equivalent to

  unshare(CLONE_FILES);
  close_range(first, last, 0);

but can be more efficient: if the unshared range extends past the current maximum number of file descriptors allocated in the caller’s file descriptor table (the common case when last is ~0U), the kernel will unshare a new file descriptor table for the caller up to first, copying as few file descriptors as possible. This avoids subsequent *close*(2) calls entirely; the whole operation is complete once the table is unshared.

This is particularly useful in cases where multiple pre-exec setup steps risk conflicting with each other. For example, setting up a seccomp*(2) profile can conflict with a *close_range*() call: if the file descriptors are closed before the *seccomp*(2) profile is set up, the profile setup can’t use them itself, or control their closure; if the file descriptors are closed afterwards, the seccomp profile can’t block the *close_range*() call or any fallbacks. Using *CLOSE_RANGE_CLOEXEC avoids this: the descriptors can be marked before the *seccomp*(2) profile is set up, and the profile can control access to *close_range*() without affecting the calling process.

  #define _GNU_SOURCE
  #include <fcntl.h>
  #include <linux/close_range.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <sys/syscall.h>
  #include <string.h>
  #include <unistd.h>
  #include <dirent.h>

  /* Show the contents of the symbolic links in /proc/self/fd */

  static void
  show_fds(void)
  {
      DIR *dirp = opendir("/proc/self/fd");
      if (dirp  == NULL) {
          perror("opendir");
          exit(EXIT_FAILURE);
      }

      for (;;) {
          struct dirent *dp = readdir(dirp);
          if (dp == NULL)
              break;

          if (dp->d_type == DT_LNK) {
              char path[PATH_MAX], target[PATH_MAX];
              snprintf(path, sizeof(path), "/proc/self/fd/%s",
                       dp->d_name);

              ssize_t len = readlink(path, target, sizeof(target));
              printf("%s ==> %.*s\n", path, (int) len, target);
          }
      }

      closedir(dirp);
  }

  int
  main(int argc, char *argv[])
  {
      for (int j = 1; j < argc; j++) {
          int fd = open(argv[j], O_RDONLY);
          if (fd == -1) {
              perror(argv[j]);
              exit(EXIT_FAILURE);
          }
          printf("%s opened as FD %d\n", argv[j], fd);
      }

      show_fds();

      printf("========= About to call close_range() =======\n");

      if (syscall(__NR_close_range, 3, ~0U, 0) == -1) {
          perror("close_range");
          exit(EXIT_FAILURE);
      }

      show_fds();
      exit(EXIT_FAILURE);
  }