4 files changed, 18 insertions, 11 deletions
diff --git a/lib/libalpm/add.c b/lib/libalpm/add.c
index b879afcb..91b40a16 100644
--- a/lib/libalpm/add.c
+++ b/lib/libalpm/add.c
@@ -556,7 +556,7 @@ static int commit_single_pkg(alpm_handle_t *handle, alpm_pkg_t *newpkg,
 		}
 
 		/* save the cwd so we can restore it later */
-		OPEN(cwdfd, ".", O_RDONLY);
+		OPEN(cwdfd, ".", O_RDONLY | O_CLOEXEC);
 		if(cwdfd < 0) {
 			_alpm_log(handle, ALPM_LOG_ERROR, _("could not get current working directory\n"));
 		}
diff --git a/lib/libalpm/handle.c b/lib/libalpm/handle.c
index 9f5a9455..44457e6f 100644
--- a/lib/libalpm/handle.c
+++ b/lib/libalpm/handle.c
@@ -110,7 +110,7 @@ int _alpm_handle_lock(alpm_handle_t *handle)
 	FREE(dir);
 
 	do {
-		handle->lockfd = open(handle->lockfile, O_WRONLY | O_CREAT | O_EXCL, 0000);
+		handle->lockfd = open(handle->lockfile, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, 0000);
 	} while(handle->lockfd == -1 && errno == EINTR);
 
 	return (handle->lockfd >= 0 ? 0 : -1);
diff --git a/lib/libalpm/log.c b/lib/libalpm/log.c
index 2cdf7403..c4a9d84c 100644
--- a/lib/libalpm/log.c
+++ b/lib/libalpm/log.c
@@ -49,9 +49,16 @@ int SYMEXPORT alpm_logaction(alpm_handle_t *handle, const char *prefix,
 
 	/* check if the logstream is open already, opening it if needed */
 	if(handle->logstream == NULL) {
-		handle->logstream = fopen(handle->logfile, "a");
+		int fd;
+		do {
+			fd = open(handle->logfile, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC,
+					0000);
+		} while(fd == -1 && errno == EINTR);
+		if(fd >= 0) {
+			handle->logstream = fdopen(fd, "a");
+		}
 		/* if we couldn't open it, we have an issue */
-		if(handle->logstream == NULL) {
+		if(fd < 0 || handle->logstream == NULL) {
 			if(errno == EACCES) {
 				handle->pm_errno = ALPM_ERR_BADPERMS;
 			} else if(errno == ENOENT) {
diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c
index ab407613..f28404d7 100644
--- a/lib/libalpm/util.c
+++ b/lib/libalpm/util.c
@@ -153,9 +153,9 @@ int _alpm_copyfile(const char *src, const char *dest)
 
 	MALLOC(buf, (size_t)ALPM_BUFFER_SIZE, return 1);
 
-	OPEN(in, src, O_RDONLY);
+	OPEN(in, src, O_RDONLY | O_CLOEXEC);
 	do {
-		out = open(dest, O_WRONLY | O_CREAT, 0000);
+		out = open(dest, O_WRONLY | O_CREAT | O_BINARY | O_CLOEXEC, 0000);
 	} while(out == -1 && errno == EINTR);
 	if(in < 0 || out < 0) {
 		goto cleanup;
@@ -244,7 +244,7 @@ int _alpm_open_archive(alpm_handle_t *handle, const char *path,
 	archive_read_support_format_all(*archive);
 
 	_alpm_log(handle, ALPM_LOG_DEBUG, "opening archive %s\n", path);
-	OPEN(fd, path, O_RDONLY);
+	OPEN(fd, path, O_RDONLY | O_CLOEXEC);
 	if(fd < 0) {
 		_alpm_log(handle, ALPM_LOG_ERROR,
 				_("could not open file %s: %s\n"), path, strerror(errno));
@@ -326,7 +326,7 @@ int _alpm_unpack(alpm_handle_t *handle, const char *path, const char *prefix,
 	oldmask = umask(0022);
 
 	/* save the cwd so we can restore it later */
-	OPEN(cwdfd, ".", O_RDONLY);
+	OPEN(cwdfd, ".", O_RDONLY | O_CLOEXEC);
 	if(cwdfd < 0) {
 		_alpm_log(handle, ALPM_LOG_ERROR, _("could not get current working directory\n"));
 	}
@@ -502,7 +502,7 @@ int _alpm_run_chroot(alpm_handle_t *handle, const char *cmd, char *const argv[])
 	int retval = 0;
 
 	/* save the cwd so we can restore it later */
-	OPEN(cwdfd, ".", O_RDONLY);
+	OPEN(cwdfd, ".", O_RDONLY | O_CLOEXEC);
 	if(cwdfd < 0) {
 		_alpm_log(handle, ALPM_LOG_ERROR, _("could not get current working directory\n"));
 	}
@@ -778,7 +778,7 @@ static int md5_file(const char *path, unsigned char output[16])
 
 	MALLOC(buf, (size_t)ALPM_BUFFER_SIZE, return 1);
 
-	OPEN(fd, path, O_RDONLY);
+	OPEN(fd, path, O_RDONLY | O_CLOEXEC);
 	if(fd < 0) {
 		free(buf);
 		return 1;
@@ -820,7 +820,7 @@ static int sha2_file(const char *path, unsigned char output[32], int is224)
 
 	MALLOC(buf, (size_t)ALPM_BUFFER_SIZE, return 1);
 
-	OPEN(fd, path, O_RDONLY);
+	OPEN(fd, path, O_RDONLY | O_CLOEXEC);
 	if(fd < 0) {
 		free(buf);
 		return 1;