[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Chih-Hung Hsieh via Phabricator via cfe-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL310858: [clang-tidy] Add a close-on-exec check on dup() in 
Android module. (authored by chh).

Changed prior to commit:
  https://reviews.llvm.org/D35364?vs=110753=111021#toc

Repository:
  rL LLVM

https://reviews.llvm.org/D35364

Files:
  clang-tools-extra/trunk/clang-tidy/android/AndroidTidyModule.cpp
  clang-tools-extra/trunk/clang-tidy/android/CMakeLists.txt
  clang-tools-extra/trunk/clang-tidy/android/CloexecCheck.cpp
  clang-tools-extra/trunk/clang-tidy/android/CloexecCheck.h
  clang-tools-extra/trunk/clang-tidy/android/CloexecDupCheck.cpp
  clang-tools-extra/trunk/clang-tidy/android/CloexecDupCheck.h
  clang-tools-extra/trunk/docs/ReleaseNotes.rst
  clang-tools-extra/trunk/docs/clang-tidy/checks/android-cloexec-dup.rst
  clang-tools-extra/trunk/docs/clang-tidy/checks/list.rst
  clang-tools-extra/trunk/test/clang-tidy/android-cloexec-dup.cpp

Index: clang-tools-extra/trunk/docs/ReleaseNotes.rst
===
--- clang-tools-extra/trunk/docs/ReleaseNotes.rst
+++ clang-tools-extra/trunk/docs/ReleaseNotes.rst
@@ -70,6 +70,11 @@
   ``AllowConditionalIntegerCasts`` -> ``AllowIntegerConditions``,
   ``AllowConditionalPointerCasts`` -> ``AllowPointerConditions``.
 
+- New `android-cloexec-dup
+  `_ check
+
+  Detects usage of ``dup()``.
+
 - New `android-cloexec-memfd_create
   `_ check
 
Index: clang-tools-extra/trunk/docs/clang-tidy/checks/android-cloexec-dup.rst
===
--- clang-tools-extra/trunk/docs/clang-tidy/checks/android-cloexec-dup.rst
+++ clang-tools-extra/trunk/docs/clang-tidy/checks/android-cloexec-dup.rst
@@ -0,0 +1,18 @@
+.. title:: clang-tidy - android-cloexec-dup
+
+android-cloexec-dup
+===
+
+The usage of ``dup()`` is not recommended, it's better to use ``fcntl()``,
+which can set the close-on-exec flag. Otherwise, an opened sensitive file would
+remain open across a fork+exec to a lower-privileged SELinux domain.
+
+Examples:
+
+.. code-block:: c++
+
+  int fd = dup(oldfd);
+
+  // becomes
+
+  int fd = fcntl(oldfd, F_DUPFD_CLOEXEC);
Index: clang-tools-extra/trunk/docs/clang-tidy/checks/list.rst
===
--- clang-tools-extra/trunk/docs/clang-tidy/checks/list.rst
+++ clang-tools-extra/trunk/docs/clang-tidy/checks/list.rst
@@ -5,6 +5,7 @@
 
 .. toctree::
android-cloexec-creat
+   android-cloexec-dup
android-cloexec-fopen
android-cloexec-memfd-create
android-cloexec-open
Index: clang-tools-extra/trunk/test/clang-tidy/android-cloexec-dup.cpp
===
--- clang-tools-extra/trunk/test/clang-tidy/android-cloexec-dup.cpp
+++ clang-tools-extra/trunk/test/clang-tidy/android-cloexec-dup.cpp
@@ -0,0 +1,31 @@
+// RUN: %check_clang_tidy %s android-cloexec-dup %t
+
+extern "C" int dup(int oldfd);
+void f() {
+  dup(1);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer fcntl() to dup() because fcntl() allows F_DUPFD_CLOEXEC [android-cloexec-dup]
+  // CHECK-FIXES: fcntl(1, F_DUPFD_CLOEXEC);
+  int oldfd = 0;
+  dup(oldfd);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer
+  // CHECK-FIXES: fcntl(oldfd, F_DUPFD_CLOEXEC);
+}
+
+namespace i {
+int dup(int oldfd);
+void g() {
+  dup(0);
+  int oldfd = 1;
+  dup(oldfd);
+}
+} // namespace i
+
+class C {
+public:
+  int dup(int oldfd);
+  void h() {
+dup(0);
+int oldfd = 1;
+dup(oldfd);
+  }
+};
Index: clang-tools-extra/trunk/clang-tidy/android/CloexecDupCheck.cpp
===
--- clang-tools-extra/trunk/clang-tidy/android/CloexecDupCheck.cpp
+++ clang-tools-extra/trunk/clang-tidy/android/CloexecDupCheck.cpp
@@ -0,0 +1,38 @@
+//===--- CloexecDupCheck.cpp - clang-tidy--===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===--===//
+
+#include "CloexecDupCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+void CloexecDupCheck::registerMatchers(MatchFinder *Finder) {
+  registerMatchersImpl(Finder,
+   functionDecl(returns(isInteger()), hasName("dup"),
+hasParameter(0, hasType(isInteger();
+}
+
+void CloexecDupCheck::check(const MatchFinder::MatchResult ) {
+  const std::string  =
+  (Twine("fcntl(") + getSpellingArg(Result, 0) + ", 

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Haojian Wu via Phabricator via cfe-commits]

hokein accepted this revision.
hokein added a comment.

LGTM




Comment at: clang-tidy/android/CloexecCheck.h:91
+  /// Helper function to get the spelling of a particular argument.
+  StringRef getSpellingArg(const ast_matchers::MatchFinder::MatchResult 
,
+   int N) const;

yawanng wrote:
> hokein wrote:
> > This method seems only be used in one check. Maybe move it to the 
> > implementation of that specific check? And you can make the  private 
> > members `FuncBindingStr` and `FuncDeclBindingStr` to protected member.
> Actually, this  method will be used in three checks. 
Ah, ok. Sorry for missing it.


https://reviews.llvm.org/D35364



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Yan Wang via Phabricator via cfe-commits]

yawanng added inline comments.



Comment at: clang-tidy/android/CloexecCheck.h:91
+  /// Helper function to get the spelling of a particular argument.
+  StringRef getSpellingArg(const ast_matchers::MatchFinder::MatchResult 
,
+   int N) const;

hokein wrote:
> This method seems only be used in one check. Maybe move it to the 
> implementation of that specific check? And you can make the  private members 
> `FuncBindingStr` and `FuncDeclBindingStr` to protected member.
Actually, this  method will be used in three checks. 


https://reviews.llvm.org/D35364



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Yan Wang via Phabricator via cfe-commits]

yawanng updated this revision to Diff 110753.
yawanng marked an inline comment as done.

https://reviews.llvm.org/D35364

Files:
  clang-tidy/android/AndroidTidyModule.cpp
  clang-tidy/android/CMakeLists.txt
  clang-tidy/android/CloexecCheck.cpp
  clang-tidy/android/CloexecCheck.h
  clang-tidy/android/CloexecDupCheck.cpp
  clang-tidy/android/CloexecDupCheck.h
  docs/ReleaseNotes.rst
  docs/clang-tidy/checks/android-cloexec-dup.rst
  docs/clang-tidy/checks/list.rst
  test/clang-tidy/android-cloexec-dup.cpp

Index: test/clang-tidy/android-cloexec-dup.cpp
===
--- /dev/null
+++ test/clang-tidy/android-cloexec-dup.cpp
@@ -0,0 +1,31 @@
+// RUN: %check_clang_tidy %s android-cloexec-dup %t
+
+extern "C" int dup(int oldfd);
+void f() {
+  dup(1);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer fcntl() to dup() because fcntl() allows F_DUPFD_CLOEXEC [android-cloexec-dup]
+  // CHECK-FIXES: fcntl(1, F_DUPFD_CLOEXEC);
+  int oldfd = 0;
+  dup(oldfd);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer
+  // CHECK-FIXES: fcntl(oldfd, F_DUPFD_CLOEXEC);
+}
+
+namespace i {
+int dup(int oldfd);
+void g() {
+  dup(0);
+  int oldfd = 1;
+  dup(oldfd);
+}
+} // namespace i
+
+class C {
+public:
+  int dup(int oldfd);
+  void h() {
+dup(0);
+int oldfd = 1;
+dup(oldfd);
+  }
+};
Index: docs/clang-tidy/checks/list.rst
===
--- docs/clang-tidy/checks/list.rst
+++ docs/clang-tidy/checks/list.rst
@@ -5,6 +5,7 @@
 
 .. toctree::
android-cloexec-creat
+   android-cloexec-dup
android-cloexec-fopen
android-cloexec-memfd-create
android-cloexec-open
Index: docs/clang-tidy/checks/android-cloexec-dup.rst
===
--- /dev/null
+++ docs/clang-tidy/checks/android-cloexec-dup.rst
@@ -0,0 +1,18 @@
+.. title:: clang-tidy - android-cloexec-dup
+
+android-cloexec-dup
+===
+
+The usage of ``dup()`` is not recommended, it's better to use ``fcntl()``,
+which can set the close-on-exec flag. Otherwise, an opened sensitive file would
+remain open across a fork+exec to a lower-privileged SELinux domain.
+
+Examples:
+
+.. code-block:: c++
+
+  int fd = dup(oldfd);
+
+  // becomes
+
+  int fd = fcntl(oldfd, F_DUPFD_CLOEXEC);
Index: docs/ReleaseNotes.rst
===
--- docs/ReleaseNotes.rst
+++ docs/ReleaseNotes.rst
@@ -70,6 +70,11 @@
   ``AllowConditionalIntegerCasts`` -> ``AllowIntegerConditions``,
   ``AllowConditionalPointerCasts`` -> ``AllowPointerConditions``.
 
+- New `android-cloexec-dup
+  `_ check
+
+  Detects usage of ``dup()``.
+
 - New `android-cloexec-memfd_create
   `_ check
 
Index: clang-tidy/android/CloexecDupCheck.h
===
--- /dev/null
+++ clang-tidy/android/CloexecDupCheck.h
@@ -0,0 +1,36 @@
+//===--- CloexecDupCheck.h - clang-tidy-*- C++ -*-===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===--===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
+
+#include "CloexecCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+/// dup() is better to be replaced by fcntl(), which has close-on-exec flag.
+/// Find the usage of dup() and redirect user to use fcntl().
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-dup.html
+class CloexecDupCheck : public CloexecCheck {
+public:
+  CloexecDupCheck(StringRef Name, ClangTidyContext *Context)
+  : CloexecCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult ) override;
+};
+
+} // namespace android
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
Index: clang-tidy/android/CloexecDupCheck.cpp
===
--- /dev/null
+++ clang-tidy/android/CloexecDupCheck.cpp
@@ -0,0 +1,38 @@
+//===--- CloexecDupCheck.cpp - clang-tidy--===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===--===//
+
+#include "CloexecDupCheck.h"
+#include 

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Haojian Wu via Phabricator via cfe-commits]

hokein added inline comments.



Comment at: clang-tidy/android/CloexecCheck.h:91
+  /// Helper function to get the spelling of a particular argument.
+  StringRef getSpellingArg(const ast_matchers::MatchFinder::MatchResult 
,
+   int N) const;

This method seems only be used in one check. Maybe move it to the 
implementation of that specific check? And you can make the  private members 
`FuncBindingStr` and `FuncDeclBindingStr` to protected member.



Comment at: test/clang-tidy/android-cloexec-dup.cpp:7
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer fcntl() to dup() because 
fcntl() allows F_DUPFD_CLOEXEC [android-cloexec-dup]
+  // CHECK-FIXES: fcntl(1, F_DUPFD_CLOEXEC)
+  int oldfd = 0;

nit: trailing `;`, the same below. Please apply this to other patches as well.


https://reviews.llvm.org/D35364



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Yan Wang via Phabricator via cfe-commits]

yawanng updated this revision to Diff 110654.

https://reviews.llvm.org/D35364

Files:
  clang-tidy/android/AndroidTidyModule.cpp
  clang-tidy/android/CMakeLists.txt
  clang-tidy/android/CloexecCheck.cpp
  clang-tidy/android/CloexecCheck.h
  clang-tidy/android/CloexecDupCheck.cpp
  clang-tidy/android/CloexecDupCheck.h
  docs/ReleaseNotes.rst
  docs/clang-tidy/checks/android-cloexec-dup.rst
  docs/clang-tidy/checks/list.rst
  test/clang-tidy/android-cloexec-dup.cpp

Index: test/clang-tidy/android-cloexec-dup.cpp
===
--- /dev/null
+++ test/clang-tidy/android-cloexec-dup.cpp
@@ -0,0 +1,31 @@
+// RUN: %check_clang_tidy %s android-cloexec-dup %t
+
+extern "C" int dup(int oldfd);
+void f() {
+  dup(1);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer fcntl() to dup() because fcntl() allows F_DUPFD_CLOEXEC [android-cloexec-dup]
+  // CHECK-FIXES: fcntl(1, F_DUPFD_CLOEXEC)
+  int oldfd = 0;
+  dup(oldfd);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer
+  // CHECK-FIXES: fcntl(oldfd, F_DUPFD_CLOEXEC)
+}
+
+namespace i {
+int dup(int oldfd);
+void g() {
+  dup(0);
+  int oldfd = 1;
+  dup(oldfd);
+}
+} // namespace i
+
+class C {
+public:
+  int dup(int oldfd);
+  void h() {
+dup(0);
+int oldfd = 1;
+dup(oldfd);
+  }
+};
Index: docs/clang-tidy/checks/list.rst
===
--- docs/clang-tidy/checks/list.rst
+++ docs/clang-tidy/checks/list.rst
@@ -5,6 +5,7 @@
 
 .. toctree::
android-cloexec-creat
+   android-cloexec-dup
android-cloexec-fopen
android-cloexec-memfd-create
android-cloexec-open
Index: docs/clang-tidy/checks/android-cloexec-dup.rst
===
--- /dev/null
+++ docs/clang-tidy/checks/android-cloexec-dup.rst
@@ -0,0 +1,18 @@
+.. title:: clang-tidy - android-cloexec-dup
+
+android-cloexec-dup
+===
+
+The usage of ``dup()`` is not recommended, it's better to use ``fcntl()``,
+which can set the close-on-exec flag. Otherwise, an opened sensitive file would
+remain open across a fork+exec to a lower-privileged SELinux domain.
+
+Examples:
+
+.. code-block:: c++
+
+  int fd = dup(oldfd);
+
+  // becomes
+
+  int fd = fcntl(oldfd, F_DUPFD_CLOEXEC);
Index: docs/ReleaseNotes.rst
===
--- docs/ReleaseNotes.rst
+++ docs/ReleaseNotes.rst
@@ -70,6 +70,11 @@
   ``AllowConditionalIntegerCasts`` -> ``AllowIntegerConditions``,
   ``AllowConditionalPointerCasts`` -> ``AllowPointerConditions``.
 
+- New `android-cloexec-dup
+  `_ check
+
+  Detects usage of ``dup()``.
+
 - New `android-cloexec-memfd_create
   `_ check
 
Index: clang-tidy/android/CloexecDupCheck.h
===
--- /dev/null
+++ clang-tidy/android/CloexecDupCheck.h
@@ -0,0 +1,36 @@
+//===--- CloexecDupCheck.h - clang-tidy-*- C++ -*-===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===--===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
+
+#include "CloexecCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+/// dup() is better to be replaced by fcntl(), which has close-on-exec flag.
+/// Find the usage of dup() and redirect user to use fcntl().
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-dup.html
+class CloexecDupCheck : public CloexecCheck {
+public:
+  CloexecDupCheck(StringRef Name, ClangTidyContext *Context)
+  : CloexecCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult ) override;
+};
+
+} // namespace android
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_DUP_H
Index: clang-tidy/android/CloexecDupCheck.cpp
===
--- /dev/null
+++ clang-tidy/android/CloexecDupCheck.cpp
@@ -0,0 +1,38 @@
+//===--- CloexecDupCheck.cpp - clang-tidy--===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===--===//
+
+#include "CloexecDupCheck.h"
+#include "clang/AST/ASTContext.h"
+#include 

[PATCH] D35364: [clang-tidy] Add a close-on-exec check on dup() in Android module.

[Alexander Kornienko via Phabricator via cfe-commits]

alexfh added a comment.

See the comment on https://reviews.llvm.org/D35372.


Repository:
  rL LLVM

https://reviews.llvm.org/D35364



___
cfe-commits mailing list
cfe-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits