From cb6f28282a188c51816f4f0fac5aa2a25baeb507 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Thu, 4 Sep 2025 18:09:57 -0400 Subject: [PATCH] on libraries --- ..._172a92bf49be25355dda3f88b377a6f4._comment | 4 --- ..._853bf59715ac755d046b54b282eaac7c._comment | 27 +++++++++++++++++++ 2 files changed, 27 insertions(+), 4 deletions(-) create mode 100644 doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment diff --git a/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment b/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment index 1e95bdeab6..681ec6add1 100644 --- a/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment +++ b/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment @@ -19,8 +19,4 @@ inherit the close-on-exec flag. So it should be safe to just write new versions of all of those. Also there are a few uses of `openFd` that don't set CloseOnExec. - -There is also the problem that any haskell library that does anything -with a file might use any of the above internally without setting -close-on-exec. """]] diff --git a/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment b/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment new file mode 100644 index 0000000000..8b8010e8c4 --- /dev/null +++ b/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment @@ -0,0 +1,27 @@ +[[!comment format=mdwn + username="joey" + subject="""comment 8""" + date="2025-09-04T20:56:54Z" + content=""" +There is also the problem that any haskell library that does anything +with a file might use any of the above internally without setting +close-on-exec. + +For example, opening a https connection can result in readFile opening a +handle to a file in /etc/ssl/certs/, which will not be closed on exec. And +which can leak out via another thread doing an exec at just the right time. + +But inheriting a single FD like that is not going to cause problems for beegfs +or anything else. + +The ones I'd worry about is if a haskell library is doing something +with a file in the git-annex repo. + +Most dependencies of git-annex clearly don't open files there, and most open no +files at all. Ones I need to check: + +* persistent-sqlite +* feed (parseFeedFromFile) +* concurrent-output (addOutputBuffer uses openTempFile; emitOutputBuffer uses T.readFile) +* magic +"""]] -- 2.30.2