{ "number": 36677, "input_hash": "7c266c259d020394", "model": "ledger", "prompt_hash": null, "created": "2026-10-31T01:18:00+00:00", "result": { "summary": "Marks files opened through fsbridge::fopen as non-inheritable and close-on-exec across platforms. It appends the 'e' mode specifier on Linux, appends 'N' on Windows, and implements an open() fallback with O_CLOEXEC followed by fdopen() for other POSIX operating systems like macOS and BSD. A unit test is included to assert that opened files lack the inheritance flag.", "problem": "File descriptors and handles opened through fsbridge::fopen remain inheritable across process boundaries by default, risking descriptor leaks into child processes executed by Bitcoin Core (such as external signers or notification scripts).", "card": "Makes files opened with fsbridge::fopen non-inheritable across process boundaries by appending 'e' on Linux, 'N' on Windows, and falling back to open() with O_CLOEXEC and fdopen() on other POSIX platforms. This prevents file descriptors from leaking into child processes spawned for external signers or notification hooks. The change addresses issue #36668 and includes unit tests checking the handle flags on Windows and POSIX.", "evidence": [ "Addresses issue #36668 ('util: Make files opened via `fsbridge::fopen()` not inheritable by child processes')." ], "scope_notes": "", "changed_since_previous": "The pull request is now linked to issue #36668.", "thread": { "last_event_at": "2026-10-30T11:59:39Z", "events": 16, "head_sha": "17ea8dd8185cc4ebcdb0b1fae2a0d892459e04c4", "schema_floor": 2, "schema": 2 }, "waiting_on": [ { "at": "2026-10-28", "id": "rc:4404499220", "on": "reviewer", "url": "https://github.com/bitcoin/bitcoin/pull/36677#discussion_r4404499220", "what": "hebasto to re-review the revised implementation addressing race condition concerns" } ], "risk": { "level": "low", "touches": [ "other", "tests" ], "why": "A mistake in the fopen wrapper or mode parsing could cause file open failures across utility callers on non-Linux POSIX systems." }, "discussion": { "author_status": "last statement processed 2026-10-30", "open_concerns": [], "resolved_concerns": [ "hebasto: Is the 'e' mode flag in fopen supported across all non-Windows systems? (answered by SirECMG 2026-10-28)", "ValeraFinebits: Compilation errors in fs_tests.cpp prevent test_bitcoin from building on Windows (fixed by ValeraFinebits 2026-10-28)", "ValeraFinebits: Add for std::strchr (fixed by SirECMG 2026-10-28)", "hebasto: Consecutive fopen and fcntl(FD_CLOEXEC) calls are not atomic and race in multithreaded processes (fixed by SirECMG 2026-10-28)", "ValeraFinebits: Keep 'e' on Linux and use open with O_CLOEXEC followed by fdopen on macOS/POSIX (fixed by SirECMG 2026-10-28)" ] }, "reviewability": { "state": "Ready", "label": "Ready", "reason": "Nothing known that would invalidate a review now." }, "agreement": { "state": "Strong", "summary": "Strong: substantive support, no open objection (ValeraFinebits)", "reason": "winterrdog commented suggesting to add Fixes #36668 to the PR description to auto-close the issue on merge; this is a procedural comment and introduces no claims.", "evidence": [ "ValeraFinebits: support \u2014 Verified on Windows that the test passes with the fix and fails without it on HANDLE_FLAG_INHERIT" ], "objections": [ { "reviewer": "hebasto", "association": "MEMBER", "type": "question", "kind": "correctness", "harm": "", "request": "", "question": "Is the 'e' mode flag in fopen supported across all non-Windows systems?", "text": "Is the 'e' mode flag in fopen supported across all non-Windows systems?", "clears_with": "answer", "blocking": false, "status": "answered", "status_note": "author changed implementation into three cases addressing Linux, Windows, and POSIX", "cleared": true, "author_replied": true, "others_replied": true, "fix_pushed": false, "replies": [ "rc:4404499220", "rc:4401375200" ], "evidence": "2026-10-27: 'Is \"e\" available on all non-Windows systems?'", "url": "https://github.com/bitcoin/bitcoin/pull/36677#discussion_r4394300695", "id": "rc:4394300695", "at": "2026-10-27", "status_at": "2026-10-28", "status_by": "SirECMG", "resolution_evidence": "2026-10-28: SirECMG: 'I changed implementation into three cases'", "pin": null, "from_schema": 2 }, { "reviewer": "ValeraFinebits", "association": "NONE", "type": "objection", "kind": "correctness", "harm": "Compilation errors in fs_tests.cpp prevent test_bitcoin from building on Windows", "request": "", "question": "", "text": "Compilation errors in fs_tests.cpp prevent test_bitcoin from building on Windows", "clears_with": "change", "blocking": true, "status": "fixed", "status_note": "tests now build and pass on Windows", "cleared": true, "author_replied": false, "others_replied": false, "fix_pushed": true, "replies": [], "evidence": "2026-10-28: 'The compilation errors in fs_tests.cpp prevent test_bitcoin from building on Windows.'", "url": "https://github.com/bitcoin/bitcoin/pull/36677#issuecomment-6471177983", "id": "c:6471177983", "at": "2026-10-28", "status_at": "2026-10-28", "status_by": "ValeraFinebits", "resolution_evidence": "2026-10-28: ValeraFinebits: 'Tested on Windows at 0c9ab56: the new test passes with the fix'", "pin": null, "from_schema": 2 }, { "reviewer": "ValeraFinebits", "association": "NONE", "type": "suggestion", "kind": "maintenance", "harm": "", "request": "Add for std::strchr", "question": "", "text": "Add for std::strchr", "clears_with": "answer", "blocking": false, "status": "fixed", "status_note": "author added the missing include", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "c:6478095764" ], "evidence": "2026-10-28: 'Could we also add for std::strchr?'", "url": "https://github.com/bitcoin/bitcoin/pull/36677#issuecomment-6477697524", "id": "c:6477697524", "at": "2026-10-28", "status_at": "2026-10-28", "status_by": "SirECMG", "resolution_evidence": "2026-10-28: SirECMG: 'Added the missing include!'", "pin": null, "from_schema": 2 }, { "reviewer": "hebasto", "association": "MEMBER", "type": "objection", "kind": "safety", "harm": "Consecutive fopen and fcntl(FD_CLOEXEC) calls are not atomic and race in multithreaded processes", "request": "", "question": "", "text": "Consecutive fopen and fcntl(FD_CLOEXEC) calls are not atomic and race in multithreaded processes", "clears_with": "change", "blocking": true, "status": "fixed", "status_note": "author implemented separate Linux/Windows/POSIX paths to avoid the non-atomic race", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "rc:4403445732", "rc:4404499220" ], "evidence": "2026-10-28: 'Unfortunately, the consecutive fopen and fcntl(..., FD_CLOEXEC) calls are not atomic, which is a race in a multithreaded process.'", "url": "https://github.com/bitcoin/bitcoin/pull/36677#discussion_r4398624471", "id": "rc:4398624471", "at": "2026-10-28", "status_at": "2026-10-28", "status_by": "SirECMG", "resolution_evidence": "2026-10-28: SirECMG: 'I changed implementation into three cases'", "pin": null, "from_schema": 2 }, { "reviewer": "ValeraFinebits", "association": "NONE", "type": "suggestion", "kind": "approach", "harm": "", "request": "Keep 'e' on Linux and use open with O_CLOEXEC followed by fdopen on macOS/POSIX", "question": "", "text": "Keep 'e' on Linux and use open with O_CLOEXEC followed by fdopen on macOS/POSIX", "clears_with": "answer", "blocking": false, "status": "fixed", "status_note": "implemented by author across platform-specific branches", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "rc:4404499220" ], "evidence": "2026-10-28: 'Could we keep the original e approach on Linux and handle macOS separately with open using O_CLOEXEC, followed by fdopen?'", "url": "https://github.com/bitcoin/bitcoin/pull/36677#discussion_r4401375200", "id": "rc:4401375200", "at": "2026-10-28", "status_at": "2026-10-28", "status_by": "SirECMG", "resolution_evidence": "2026-10-28: SirECMG: 'I changed implementation into three cases'", "pin": null, "from_schema": 2 } ], "support": [ { "reviewer": "ValeraFinebits", "reason": "Verified on Windows that the test passes with the fix and fails without it on HANDLE_FLAG_INHERIT", "substantive": true, "verdict": "", "id": "c:6480706270", "url": "https://github.com/bitcoin/bitcoin/pull/36677#issuecomment-6480706270", "at": "2026-10-28", "association": "NONE", "evidence": "tested", "areas": [] } ], "participants": [ { "login": "hebasto", "stance": "objection", "note": "objected to non-atomic fopen and fcntl race condition in multithreaded processes, and questioned 'e' support on POSIX", "association": "MEMBER", "comments": 2, "first": "2026-10-27", "last": "2026-10-28" }, { "login": "ValeraFinebits", "stance": "support", "note": "tested on Windows, suggested implementation improvements and fixes for macOS/POSIX", "association": "NONE", "comments": 7, "first": "2026-10-28", "last": "2026-10-28" }, { "login": "winterrdog", "stance": "neutral", "note": "requested squashing commits and suggested adding Fixes to PR description", "association": "CONTRIBUTOR", "comments": 2, "first": "2026-10-28", "last": "2026-10-30" } ], "derivation": "substantive support, no open objection (ValeraFinebits)", "model_state": null, "corrections": [], "notes": "winterrdog commented suggesting to add Fixes #36668 to the PR description to auto-close the issue on merge; this is a procedural comment and introduces no claims." }, "dependencies": { "depends_on": [], "enables": [] }, "categories": [ { "name": "utils", "member": true, "evidence": "Matches the 'Utils/log/libs' label and edits src/util/fs.cpp to harden shared filesystem wrapper primitives.", "band": "P3", "reason_tag": "bug fix", "score": 0.4, "factors": { "bug_severity": 1, "leverage": 0, "performance": 0, "security_stability": 1, "user_value": 0 }, "rationale": "Prevents file descriptor leaks by ensuring fsbridge::fopen sets close-on-exec/non-inheritable flags across platforms. The problem description notes handles 'remain inheritable across process boundaries by default, risking descriptor leaks into child processes executed by Bitcoin Core (such as external signers or notification scripts)'. This is worthwhile security hygiene and robustness for utility primitives, but deferrable as it is not actively causing critical failures." } ], "confidence": "high", "uncertainties": [], "needs": [] }, "cost_usd": 0.0, "source": { "record": "2026-10-31T01:18:00+00:00", "code": "2026-10-31T01:19:52+00:00", "judgments": 1 } }