From 327f000532e96329280e06eb12af2d98071ac023 Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Fri, 3 Jul 2026 13:59:01 +0200
Subject: [PATCH] security_context_v1: set CLOEXEC for client FDs

Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/3949
---
 include/util/fd.h               |  8 ++++++++
 types/wlr_security_context_v1.c |  6 ++++++
 util/fd.c                       | 22 ++++++++++++++++++++++
 util/meson.build                |  1 +
 xwayland/server.c               |  1 +
 xwayland/sockets.c              | 19 +------------------
 xwayland/sockets.h              |  1 -
 7 files changed, 39 insertions(+), 19 deletions(-)
 create mode 100644 include/util/fd.h
 create mode 100644 util/fd.c

diff --git a/include/util/fd.h b/include/util/fd.h
new file mode 100644
index 000000000..9a353bf8b
--- /dev/null
+++ b/include/util/fd.h
@@ -0,0 +1,8 @@
+#ifndef UTIL_FD_H
+#define UTIL_FD_H
+
+#include <stdbool.h>
+
+bool set_cloexec(int fd, bool cloexec);
+
+#endif
diff --git a/types/wlr_security_context_v1.c b/types/wlr_security_context_v1.c
index da430c012..936b913c8 100644
--- a/types/wlr_security_context_v1.c
+++ b/types/wlr_security_context_v1.c
@@ -7,6 +7,7 @@
 #include <wlr/types/wlr_security_context_v1.h>
 #include <wlr/util/log.h>
 #include "security-context-v1-protocol.h"
+#include "util/fd.h"
 
 #define SECURITY_CONTEXT_MANAGER_V1_VERSION 1
 
@@ -129,6 +130,11 @@ static int security_context_handle_listen_fd_event(int listen_fd, uint32_t mask,
 			return 0;
 		}
 
+		if (!set_cloexec(client_fd, true)) {
+			close(client_fd);
+			return 0;
+		}
+
 		struct wlr_security_context_v1_client *security_context_client =
 			calloc(1, sizeof(*security_context_client));
 		if (security_context_client == NULL) {
diff --git a/util/fd.c b/util/fd.c
new file mode 100644
index 000000000..3dff5396f
--- /dev/null
+++ b/util/fd.c
@@ -0,0 +1,22 @@
+#include <fcntl.h>
+#include <wlr/util/log.h>
+
+#include "util/fd.h"
+
+bool set_cloexec(int fd, bool cloexec) {
+	int flags = fcntl(fd, F_GETFD);
+	if (flags == -1) {
+		wlr_log_errno(WLR_ERROR, "fcntl failed");
+		return false;
+	}
+	if (cloexec) {
+		flags = flags | FD_CLOEXEC;
+	} else {
+		flags = flags & ~FD_CLOEXEC;
+	}
+	if (fcntl(fd, F_SETFD, flags) == -1) {
+		wlr_log_errno(WLR_ERROR, "fcntl failed");
+		return false;
+	}
+	return true;
+}
diff --git a/util/meson.build b/util/meson.build
index 6aad13386..7d3f39d28 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -3,6 +3,7 @@ wlr_files += files(
 	'array.c',
 	'box.c',
 	'env.c',
+	'fd.c',
 	'global.c',
 	'log.c',
 	'matrix.c',
diff --git a/xwayland/server.c b/xwayland/server.c
index 0e8ad44fe..8401c9e61 100644
--- a/xwayland/server.c
+++ b/xwayland/server.c
@@ -16,6 +16,7 @@
 #include <wlr/xwayland.h>
 #include "config.h"
 #include "sockets.h"
+#include "util/fd.h"
 
 static void safe_close(int fd) {
 	if (fd >= 0) {
diff --git a/xwayland/sockets.c b/xwayland/sockets.c
index 9e287f361..364fbc477 100644
--- a/xwayland/sockets.c
+++ b/xwayland/sockets.c
@@ -14,6 +14,7 @@
 #include <unistd.h>
 #include <wlr/util/log.h>
 #include "sockets.h"
+#include "util/fd.h"
 
 static const char lock_fmt[] = "/tmp/.X%d-lock";
 static const char socket_dir[] = "/tmp/.X11-unix";
@@ -22,24 +23,6 @@ static const char socket_fmt[] = "/tmp/.X11-unix/X%d";
 static const char socket_fmt2[] = "/tmp/.X11-unix/X%d_";
 #endif
 
-bool set_cloexec(int fd, bool cloexec) {
-	int flags = fcntl(fd, F_GETFD);
-	if (flags == -1) {
-		wlr_log_errno(WLR_ERROR, "fcntl failed");
-		return false;
-	}
-	if (cloexec) {
-		flags = flags | FD_CLOEXEC;
-	} else {
-		flags = flags & ~FD_CLOEXEC;
-	}
-	if (fcntl(fd, F_SETFD, flags) == -1) {
-		wlr_log_errno(WLR_ERROR, "fcntl failed");
-		return false;
-	}
-	return true;
-}
-
 static int open_socket(struct sockaddr_un *addr, size_t path_size) {
 	int fd, rc;
 	socklen_t size = offsetof(struct sockaddr_un, sun_path) + path_size + 1;
diff --git a/xwayland/sockets.h b/xwayland/sockets.h
index 4c55a087e..b068dff2e 100644
--- a/xwayland/sockets.h
+++ b/xwayland/sockets.h
@@ -3,7 +3,6 @@
 
 #include <stdbool.h>
 
-bool set_cloexec(int fd, bool cloexec);
 void unlink_display_sockets(int display);
 int open_display_sockets(int socks[2]);