jcai19 updated this revision to Diff 199870.
jcai19 marked 4 inline comments as done.
jcai19 added a comment.
Fix format
Repository:
rG LLVM Github Monorepo
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D61967/new/
https://reviews.llvm.org/D61967
Files:
clang-tools-extra/clang-tidy/android/AndroidTidyModule.cpp
clang-tools-extra/clang-tidy/android/CMakeLists.txt
clang-tools-extra/clang-tidy/android/CloexecPipeCheck.cpp
clang-tools-extra/clang-tidy/android/CloexecPipeCheck.h
clang-tools-extra/docs/ReleaseNotes.rst
clang-tools-extra/docs/clang-tidy/checks/android-cloexec-pipe.rst
clang-tools-extra/docs/clang-tidy/checks/list.rst
clang-tools-extra/test/clang-tidy/android-cloexec-pipe.cpp
Index: clang-tools-extra/test/clang-tidy/android-cloexec-pipe.cpp
===================================================================
--- /dev/null
+++ clang-tools-extra/test/clang-tidy/android-cloexec-pipe.cpp
@@ -0,0 +1,27 @@
+// RUN: %check_clang_tidy %s android-cloexec-pipe %t
+
+extern "C" int pipe(int pipefd[2]);
+
+void f() {
+ int pipefd[2];
+ pipe(pipefd);
+ // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer pipe2() to pipe() because pipe2() allows O_CLOEXEC [android-cloexec-pipe]
+ // CHECK-FIXES: pipe2(pipefd, O_CLOEXEC);
+}
+
+namespace i {
+int pipe(int pipefd[2]);
+void g() {
+ int pipefd[2];
+ pipe(pipefd);
+}
+} // namespace i
+
+class C {
+public:
+ int pipe(int pipefd[2]);
+ void h() {
+ int pipefd[2];
+ pipe(pipefd);
+ }
+};
Index: clang-tools-extra/docs/clang-tidy/checks/list.rst
===================================================================
--- clang-tools-extra/docs/clang-tidy/checks/list.rst
+++ clang-tools-extra/docs/clang-tidy/checks/list.rst
@@ -32,6 +32,7 @@
android-cloexec-inotify-init1
android-cloexec-memfd-create
android-cloexec-open
+ android-cloexec-pipe
android-cloexec-socket
android-comparison-in-temp-failure-retry
boost-use-to-string
Index: clang-tools-extra/docs/clang-tidy/checks/android-cloexec-pipe.rst
===================================================================
--- /dev/null
+++ clang-tools-extra/docs/clang-tidy/checks/android-cloexec-pipe.rst
@@ -0,0 +1,18 @@
+.. title:: clang-tidy - android-cloexec-pipe
+
+android-cloexec-pipe
+====================
+
+Detects usage of ``pipe()``. The usage of ``pipe()`` is not recommended, it's better to use ``pipe2()``.
+Without this flag, an opened sensitive file descriptor would remain open across
+a ``fork``+``exec`` to a lower-privileged SELinux domain.
+
+Examples:
+
+.. code-block:: c++
+
+ pipe(pipefd);
+
+ // becomes
+
+ pipe2(pipefd, O_CLOEXEC);
Index: clang-tools-extra/docs/ReleaseNotes.rst
===================================================================
--- clang-tools-extra/docs/ReleaseNotes.rst
+++ clang-tools-extra/docs/ReleaseNotes.rst
@@ -101,6 +101,11 @@
Finds and fixes ``absl::Time`` subtraction expressions to do subtraction
in the Time domain instead of the numeric domain.
+- New :doc:`android-cloexec-pipe
+ <clang-tidy/checks/android-cloexec-pipe>` check.
+
+ Detects usage of ``pipe()``.
+
- New :doc:`bugprone-unhandled-self-assignment
<clang-tidy/checks/bugprone-unhandled-self-assignment>` check.
Index: clang-tools-extra/clang-tidy/android/CloexecPipeCheck.h
===================================================================
--- /dev/null
+++ clang-tools-extra/clang-tidy/android/CloexecPipeCheck.h
@@ -0,0 +1,34 @@
+//===--- CloexecPipeCheck.h - clang-tidy-----------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_PIPE_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_PIPE_H
+
+#include "CloexecCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+/// pipe() is better to be replaced by pipe2().
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-pipe.html
+class CloexecPipeCheck : public CloexecCheck {
+public:
+ CloexecPipeCheck(StringRef Name, ClangTidyContext *Context)
+ : CloexecCheck(Name, Context) {}
+ void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+ void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+};
+
+} // namespace android
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_PIPE_H
Index: clang-tools-extra/clang-tidy/android/CloexecPipeCheck.cpp
===================================================================
--- /dev/null
+++ clang-tools-extra/clang-tidy/android/CloexecPipeCheck.cpp
@@ -0,0 +1,37 @@
+//===--- CloexecPipeCheck.cpp - clang-tidy-------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "CloexecPipeCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+void CloexecPipeCheck::registerMatchers(MatchFinder *Finder) {
+ registerMatchersImpl(Finder,
+ functionDecl(returns(isInteger()), hasName("pipe"),
+ hasParameter(0, hasType(pointsTo(isInteger())))));
+}
+
+void CloexecPipeCheck::check(const MatchFinder::MatchResult &Result) {
+ const std::string &ReplacementText =
+ (Twine("pipe2(") + getSpellingArg(Result, 0) + ", O_CLOEXEC)").str();
+
+ replaceFunc(
+ Result,
+ "prefer pipe2() to pipe() because pipe2() allows O_CLOEXEC",
+ ReplacementText);
+}
+
+} // namespace android
+} // namespace tidy
+} // namespace clang
Index: clang-tools-extra/clang-tidy/android/CMakeLists.txt
===================================================================
--- clang-tools-extra/clang-tidy/android/CMakeLists.txt
+++ clang-tools-extra/clang-tidy/android/CMakeLists.txt
@@ -14,6 +14,7 @@
CloexecInotifyInitCheck.cpp
CloexecMemfdCreateCheck.cpp
CloexecOpenCheck.cpp
+ CloexecPipeCheck.cpp
CloexecSocketCheck.cpp
ComparisonInTempFailureRetryCheck.cpp
Index: clang-tools-extra/clang-tidy/android/AndroidTidyModule.cpp
===================================================================
--- clang-tools-extra/clang-tidy/android/AndroidTidyModule.cpp
+++ clang-tools-extra/clang-tidy/android/AndroidTidyModule.cpp
@@ -20,6 +20,7 @@
#include "CloexecInotifyInitCheck.h"
#include "CloexecMemfdCreateCheck.h"
#include "CloexecOpenCheck.h"
+#include "CloexecPipeCheck.h"
#include "CloexecSocketCheck.h"
#include "ComparisonInTempFailureRetryCheck.h"
@@ -49,6 +50,7 @@
CheckFactories.registerCheck<CloexecMemfdCreateCheck>(
"android-cloexec-memfd-create");
CheckFactories.registerCheck<CloexecOpenCheck>("android-cloexec-open");
+ CheckFactories.registerCheck<CloexecPipeCheck>("android-cloexec-pipe");
CheckFactories.registerCheck<CloexecSocketCheck>("android-cloexec-socket");
CheckFactories.registerCheck<ComparisonInTempFailureRetryCheck>(
"android-comparison-in-temp-failure-retry");
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
