From 62f5f01c44cefa48c7236445e8a0a05d1b56c9f9 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 30 Oct 2026 20:37:09 -0700 Subject: Open the lock files close-on-exec Each exec filter and snapshot compressor a fill runs inherited the slot's lock descriptor beside the stdout it writes into. An flock lasts until its last copy closes and nothing waits for a process a filter leaves behind, so a fill killed before its rename could leave the slot locked, and served stale or uncached, for as long as such a process lived. The scan holds its lock across no exec and opens the same way so that the two stay alike. --- source/cache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'source/cache.c') diff --git a/source/cache.c b/source/cache.c index 4802ab5..12151b8 100644 --- a/source/cache.c +++ b/source/cache.c @@ -202,7 +202,9 @@ static int lock_slot(struct cache_slot *slot) { struct stat held, named; - slot->lock_fd = open(slot->lock_path, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR); + // Close-on-exec, so that a program the fill runs gets the file only + // as its stdout, and holds the lock no longer than it can write there. + slot->lock_fd = open(slot->lock_path, O_RDWR | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); if (slot->lock_fd == -1) return errno; // An flock rather than a POSIX record lock. The descriptor is put on -- cgit 2.12.1