pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix O_CLOEXEC flag handling in Windows port. 4+ messages / 1 participants [nested] [flat]
* pgsql: Fix O_CLOEXEC flag handling in Windows port. @ 2025-12-09 20:49 Thomas Munro <tmunro@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Thomas Munro @ 2025-12-09 20:49 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix O_CLOEXEC flag handling in Windows port. PostgreSQL's src/port/open.c has always set bInheritHandle = TRUE when opening files on Windows, making all file descriptors inheritable by child processes. This meant the O_CLOEXEC flag, added to many call sites by commit 1da569ca1f (v16), was silently ignored. The original commit included a comment suggesting that our open() replacement doesn't create inheritable handles, but it was a mis- understanding of the code path. In practice, the code was creating inheritable handles in all cases. This hasn't caused widespread problems because most child processes (archive_command, COPY PROGRAM, etc.) operate on file paths passed as arguments rather than inherited file descriptors. Even if a child wanted to use an inherited handle, it would need to learn the numeric handle value, which isn't passed through our IPC mechanisms. Nonetheless, the current behavior is wrong. It violates documented O_CLOEXEC semantics, contradicts our own code comments, and makes PostgreSQL behave differently on Windows than on Unix. It also creates potential issues with future code or security auditing tools. To fix, define O_CLOEXEC to _O_NOINHERIT in master, previously used by O_DSYNC. We use different values in the back branches to preserve existing values. In pgwin32_open_handle() we set bInheritHandle according to whether O_CLOEXEC is specified, for the same atomic semantics as POSIX in multi-threaded programs that create processes. Backpatch-through: 16 Author: Bryan Green <dbryan.green@gmail.com> Co-authored-by: Thomas Munro <thomas.munro@gmail.com> (minor adjustments) Discussion: https://postgr.es/m/e2b16375-7430-4053-bda3-5d2194ff1880%40gmail.com Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/c507ba55f5bfae900baa94f1c657e1d99da5c6dc Modified Files -------------- src/include/port.h | 1 - src/include/port/win32_port.h | 19 +- src/port/open.c | 14 +- src/test/modules/Makefile | 1 + src/test/modules/meson.build | 1 + src/test/modules/test_cloexec/Makefile | 30 +++ src/test/modules/test_cloexec/meson.build | 26 +++ src/test/modules/test_cloexec/t/001_cloexec.pl | 60 ++++++ src/test/modules/test_cloexec/test_cloexec.c | 262 +++++++++++++++++++++++++ 9 files changed, 400 insertions(+), 14 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix O_CLOEXEC flag handling in Windows port. @ 2025-12-09 20:50 Thomas Munro <tmunro@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Thomas Munro @ 2025-12-09 20:50 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix O_CLOEXEC flag handling in Windows port. PostgreSQL's src/port/open.c has always set bInheritHandle = TRUE when opening files on Windows, making all file descriptors inheritable by child processes. This meant the O_CLOEXEC flag, added to many call sites by commit 1da569ca1f (v16), was silently ignored. The original commit included a comment suggesting that our open() replacement doesn't create inheritable handles, but it was a mis- understanding of the code path. In practice, the code was creating inheritable handles in all cases. This hasn't caused widespread problems because most child processes (archive_command, COPY PROGRAM, etc.) operate on file paths passed as arguments rather than inherited file descriptors. Even if a child wanted to use an inherited handle, it would need to learn the numeric handle value, which isn't passed through our IPC mechanisms. Nonetheless, the current behavior is wrong. It violates documented O_CLOEXEC semantics, contradicts our own code comments, and makes PostgreSQL behave differently on Windows than on Unix. It also creates potential issues with future code or security auditing tools. To fix, define O_CLOEXEC to _O_NOINHERIT in master, previously used by O_DSYNC. We use different values in the back branches to preserve existing values. In pgwin32_open_handle() we set bInheritHandle according to whether O_CLOEXEC is specified, for the same atomic semantics as POSIX in multi-threaded programs that create processes. Backpatch-through: 16 Author: Bryan Green <dbryan.green@gmail.com> Co-authored-by: Thomas Munro <thomas.munro@gmail.com> (minor adjustments) Discussion: https://postgr.es/m/e2b16375-7430-4053-bda3-5d2194ff1880%40gmail.com Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/bebb281b08b624d69fbb4a6fb94b2c1b5d0be7a5 Modified Files -------------- src/include/port.h | 1 - src/include/port/win32_port.h | 19 +- src/port/open.c | 14 +- src/test/modules/Makefile | 1 + src/test/modules/meson.build | 1 + src/test/modules/test_cloexec/Makefile | 30 +++ src/test/modules/test_cloexec/meson.build | 26 +++ src/test/modules/test_cloexec/t/001_cloexec.pl | 60 ++++++ src/test/modules/test_cloexec/test_cloexec.c | 262 +++++++++++++++++++++++++ 9 files changed, 400 insertions(+), 14 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix O_CLOEXEC flag handling in Windows port. @ 2025-12-09 20:50 Thomas Munro <tmunro@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Thomas Munro @ 2025-12-09 20:50 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix O_CLOEXEC flag handling in Windows port. PostgreSQL's src/port/open.c has always set bInheritHandle = TRUE when opening files on Windows, making all file descriptors inheritable by child processes. This meant the O_CLOEXEC flag, added to many call sites by commit 1da569ca1f (v16), was silently ignored. The original commit included a comment suggesting that our open() replacement doesn't create inheritable handles, but it was a mis- understanding of the code path. In practice, the code was creating inheritable handles in all cases. This hasn't caused widespread problems because most child processes (archive_command, COPY PROGRAM, etc.) operate on file paths passed as arguments rather than inherited file descriptors. Even if a child wanted to use an inherited handle, it would need to learn the numeric handle value, which isn't passed through our IPC mechanisms. Nonetheless, the current behavior is wrong. It violates documented O_CLOEXEC semantics, contradicts our own code comments, and makes PostgreSQL behave differently on Windows than on Unix. It also creates potential issues with future code or security auditing tools. To fix, define O_CLOEXEC to _O_NOINHERIT in master, previously used by O_DSYNC. We use different values in the back branches to preserve existing values. In pgwin32_open_handle() we set bInheritHandle according to whether O_CLOEXEC is specified, for the same atomic semantics as POSIX in multi-threaded programs that create processes. Backpatch-through: 16 Author: Bryan Green <dbryan.green@gmail.com> Co-authored-by: Thomas Munro <thomas.munro@gmail.com> (minor adjustments) Discussion: https://postgr.es/m/e2b16375-7430-4053-bda3-5d2194ff1880%40gmail.com Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f24af0e04cef983945f13aeed99de989bf6ee9f0 Modified Files -------------- src/include/port.h | 1 - src/include/port/win32_port.h | 19 +- src/port/open.c | 14 +- src/test/modules/Makefile | 1 + src/test/modules/meson.build | 1 + src/test/modules/test_cloexec/Makefile | 30 +++ src/test/modules/test_cloexec/meson.build | 26 +++ src/test/modules/test_cloexec/t/001_cloexec.pl | 60 ++++++ src/test/modules/test_cloexec/test_cloexec.c | 262 +++++++++++++++++++++++++ 9 files changed, 400 insertions(+), 14 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix O_CLOEXEC flag handling in Windows port. @ 2025-12-09 20:50 Thomas Munro <tmunro@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Thomas Munro @ 2025-12-09 20:50 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix O_CLOEXEC flag handling in Windows port. PostgreSQL's src/port/open.c has always set bInheritHandle = TRUE when opening files on Windows, making all file descriptors inheritable by child processes. This meant the O_CLOEXEC flag, added to many call sites by commit 1da569ca1f (v16), was silently ignored. The original commit included a comment suggesting that our open() replacement doesn't create inheritable handles, but it was a mis- understanding of the code path. In practice, the code was creating inheritable handles in all cases. This hasn't caused widespread problems because most child processes (archive_command, COPY PROGRAM, etc.) operate on file paths passed as arguments rather than inherited file descriptors. Even if a child wanted to use an inherited handle, it would need to learn the numeric handle value, which isn't passed through our IPC mechanisms. Nonetheless, the current behavior is wrong. It violates documented O_CLOEXEC semantics, contradicts our own code comments, and makes PostgreSQL behave differently on Windows than on Unix. It also creates potential issues with future code or security auditing tools. To fix, define O_CLOEXEC to _O_NOINHERIT in master, previously used by O_DSYNC. We use different values in the back branches to preserve existing values. In pgwin32_open_handle() we set bInheritHandle according to whether O_CLOEXEC is specified, for the same atomic semantics as POSIX in multi-threaded programs that create processes. Backpatch-through: 16 Author: Bryan Green <dbryan.green@gmail.com> Co-authored-by: Thomas Munro <thomas.munro@gmail.com> (minor adjustments) Discussion: https://postgr.es/m/e2b16375-7430-4053-bda3-5d2194ff1880%40gmail.com Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d62a258cd45a255866b79577c85c68ea99b653aa Modified Files -------------- src/include/port.h | 1 - src/include/port/win32_port.h | 19 +- src/port/open.c | 14 +- src/test/modules/Makefile | 1 + src/test/modules/meson.build | 1 + src/test/modules/test_cloexec/Makefile | 30 +++ src/test/modules/test_cloexec/meson.build | 26 +++ src/test/modules/test_cloexec/t/001_cloexec.pl | 60 ++++++ src/test/modules/test_cloexec/test_cloexec.c | 262 +++++++++++++++++++++++++ 9 files changed, 400 insertions(+), 14 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2025-12-09 20:50 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-12-09 20:49 pgsql: Fix O_CLOEXEC flag handling in Windows port. Thomas Munro <tmunro@postgresql.org> 2025-12-09 20:50 pgsql: Fix O_CLOEXEC flag handling in Windows port. Thomas Munro <tmunro@postgresql.org> 2025-12-09 20:50 pgsql: Fix O_CLOEXEC flag handling in Windows port. Thomas Munro <tmunro@postgresql.org> 2025-12-09 20:50 pgsql: Fix O_CLOEXEC flag handling in Windows port. Thomas Munro <tmunro@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox