autofs-5.0.3 - use CLOEXEC flag

From: Ian Kent <raven@themaw.net>

Update autofs to use the new CLOEXEC flag if present.
This allows us to set close on exec atomically flag when opening files,
hopefully avoiding selinux complaining about leaked file handles.
---

 daemon/automount.c        |   42 +++---------------
 daemon/direct.c           |    2 
 daemon/flag.c             |    8 +--
 daemon/indirect.c         |    2 
 daemon/lookup.c           |    1 
 daemon/module.c           |    2 
 daemon/spawn.c            |   11 ----
 include/automount.h       |  106 ++++++++++++++++++++++++++++++++++++++++++++++
 include/state.h           |    1 
 lib/cache.c               |    2 
 lib/defaults.c            |    7 +--
 lib/log.c                 |    2 
 lib/macros.c              |    1 
 lib/mounts.c              |    2 
 lib/nss_parse.y           |   13 -----
 lib/parse_subs.c          |    1 
 lib/rpc_subs.c            |   21 ++-------
 modules/cyrus-sasl.c      |    1 
 modules/lookup_file.c     |   40 ++---------------
 modules/lookup_hesiod.c   |    1 
 modules/lookup_hosts.c    |    1 
 modules/lookup_ldap.c     |    1 
 modules/lookup_multi.c    |    1 
 modules/lookup_nisplus.c  |    1 
 modules/lookup_program.c  |    5 --
 modules/lookup_userhome.c |    1 
 modules/lookup_yp.c       |    1 
 modules/mount_afs.c       |    2 
 modules/mount_autofs.c    |    2 
 modules/mount_bind.c      |    2 
 modules/mount_changer.c   |   10 ----
 modules/mount_ext2.c      |    2 
 modules/mount_generic.c   |    2 
 modules/mount_nfs.c       |    2 
 modules/parse_hesiod.c    |    1 
 modules/parse_sun.c       |    2 
 modules/replicated.c      |   13 +----
 37 files changed, 145 insertions(+), 170 deletions(-)


--- autofs-5.0.3.orig/daemon/automount.c
+++ autofs-5.0.3/daemon/automount.c
@@ -20,13 +20,11 @@
  * ----------------------------------------------------------------------- */
 
 #include <dirent.h>
-#include <fcntl.h>
 #include <getopt.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <sys/ioctl.h>
 #include <ctype.h>
 #include <sys/types.h>
@@ -68,6 +66,9 @@ static pthread_t state_mach_thid;
 /* Pre-calculated kernel packet length */
 static size_t kpkt_len;
 
+/* Does kernel know about SOCK_CLOEXEC and friends */
+static int cloexec_works = 0;
+
 /* Attribute to create detached thread */
 pthread_attr_t thread_attr;
 
@@ -705,7 +706,7 @@ static char *automount_path_to_fifo(unsi
 static int create_logpri_fifo(struct autofs_point *ap)
 {
 	int ret = -1;
-	int fd, cl_flags;
+	int fd;
 	char *fifo_name;
 	char buf[MAX_ERR_BUF];
 
@@ -731,7 +732,7 @@ static int create_logpri_fifo(struct aut
 		goto out_free;
 	}
 
-	fd = open(fifo_name, O_RDWR|O_NONBLOCK);
+	fd = open_fd(fifo_name, O_RDWR|O_NONBLOCK);
 	if (fd < 0) {
 		char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 		crit(ap->logopt,
@@ -741,11 +742,6 @@ static int create_logpri_fifo(struct aut
 		goto out_free;
 	}
 
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	ap->logpri_fifo = fd;
 
 out_free:
@@ -997,7 +993,7 @@ int do_expire(struct autofs_point *ap, c
 
 static int autofs_init_ap(struct autofs_point *ap)
 {
-	int pipefd[2], cl_flags;
+	int pipefd[2];
 
 	if ((ap->state != ST_INIT)) {
 		/* This can happen if an autofs process is already running*/
@@ -1008,7 +1004,7 @@ static int autofs_init_ap(struct autofs_
 	ap->pipefd = ap->kpipefd = ap->ioctlfd = -1;
 
 	/* Pipe for kernel communications */
-	if (pipe(pipefd) < 0) {
+	if (open_pipe(pipefd) < 0) {
 		crit(ap->logopt,
 		     "failed to create commumication pipe for autofs path %s",
 		     ap->path);
@@ -1018,18 +1014,8 @@ static int autofs_init_ap(struct autofs_
 	ap->pipefd = pipefd[0];
 	ap->kpipefd = pipefd[1];
 
-	if ((cl_flags = fcntl(ap->pipefd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(ap->pipefd, F_SETFD, cl_flags);
-	}
-
-	if ((cl_flags = fcntl(ap->kpipefd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(ap->kpipefd, F_SETFD, cl_flags);
-	}
-
 	/* Pipe state changes from signal handler to main loop */
-	if (pipe(ap->state_pipe) < 0) {
+	if (open_pipe(ap->state_pipe) < 0) {
 		crit(ap->logopt,
 		     "failed create state pipe for autofs path %s", ap->path);
 		close(ap->pipefd);
@@ -1037,16 +1023,6 @@ static int autofs_init_ap(struct autofs_
 		return -1;
 	}
 
-	if ((cl_flags = fcntl(ap->state_pipe[0], F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(ap->state_pipe[0], F_SETFD, cl_flags);
-	}
-
-	if ((cl_flags = fcntl(ap->state_pipe[1], F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(ap->state_pipe[1], F_SETFD, cl_flags);
-	}
-
 	if (create_logpri_fifo(ap) < 0) {
 		logmsg("could not create FIFO for path %s\n", ap->path);
 		logmsg("dynamic log level changes not available for %s", ap->path);
@@ -1114,7 +1090,7 @@ static void become_daemon(unsigned foreg
 		exit(0);
 	}
 
-	if (pipe(start_pipefd) < 0) {
+	if (open_pipe(start_pipefd) < 0) {
 		fprintf(stderr, "%s: failed to create start_pipefd.\n",
 			program);
 		exit(0);
--- autofs-5.0.3.orig/daemon/direct.c
+++ autofs-5.0.3/daemon/direct.c
@@ -20,12 +20,10 @@
  * ----------------------------------------------------------------------- */
 
 #include <dirent.h>
-#include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
 #include <sys/wait.h>
--- autofs-5.0.3.orig/daemon/flag.c
+++ autofs-5.0.3/daemon/flag.c
@@ -21,15 +21,15 @@
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <fcntl.h>
 #include <time.h>
-#include <unistd.h>
 #include <string.h>
 #include <alloca.h>
 #include <stdio.h>
 #include <signal.h>
 #include <errno.h>
 
+#include "automount.h"
+
 #define MAX_PIDSIZE	20
 #define FLAG_FILE	AUTOFS_FLAG_DIR "/autofs-running"
 
@@ -129,7 +129,7 @@ int aquire_flag_file(void)
 	while (!we_created_flagfile) {
 		int errsv, i, j;
 
-		i = open(linkf, O_WRONLY|O_CREAT, 0);
+		i = open_fd_mode(linkf, O_WRONLY|O_CREAT, 0);
 		if (i < 0) {
 			release_flag_file();
 			return 0;
@@ -146,7 +146,7 @@ int aquire_flag_file(void)
 			return 0;
 		}
 
-		fd = open(FLAG_FILE, O_RDWR);
+		fd = open_fd(FLAG_FILE, O_RDWR);
 		if (fd < 0) {
 			/* Maybe the file was just deleted? */
 			if (errno == ENOENT)
--- autofs-5.0.3.orig/daemon/indirect.c
+++ autofs-5.0.3/daemon/indirect.c
@@ -20,12 +20,10 @@
  * ----------------------------------------------------------------------- */
 
 #include <dirent.h>
-#include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
 #include <sys/wait.h>
--- autofs-5.0.3.orig/daemon/lookup.c
+++ autofs-5.0.3/daemon/lookup.c
@@ -22,7 +22,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <sys/stat.h>
-#include <unistd.h>
 #include "automount.h"
 #include "nsswitch.h"
 
--- autofs-5.0.3.orig/daemon/module.c
+++ autofs-5.0.3/daemon/module.c
@@ -31,7 +31,7 @@ int load_autofs4_module(void)
 	 * is an older version we will catch it at mount
 	 * time.
 	 */
-	fp = fopen("/proc/filesystems", "r");
+	fp = open_fopen_r("/proc/filesystems");
 	if (!fp) {
 		logerr("cannot open /proc/filesystems\n");
 		return 0;
--- autofs-5.0.3.orig/daemon/spawn.c
+++ autofs-5.0.3/daemon/spawn.c
@@ -13,7 +13,6 @@
  *
  * ----------------------------------------------------------------------- */
 
-#include <fcntl.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -21,7 +20,6 @@
 #include <string.h>
 #include <sys/types.h>
 #include <dirent.h>
-#include <unistd.h>
 #include <time.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
@@ -125,7 +123,7 @@ static int do_spawn(unsigned logopt, uns
 	int ret, status, pipefd[2];
 	char errbuf[ERRBUFSIZ + 1], *p, *sp;
 	int errp, errn;
-	int flags, cancel_state;
+	int cancel_state;
 	unsigned int use_lock = options & SPAWN_OPT_LOCK;
 	unsigned int use_access = options & SPAWN_OPT_ACCESS;
 	sigset_t allsigs, tmpsig, oldsig;
@@ -133,7 +131,7 @@ static int do_spawn(unsigned logopt, uns
 	pid_t euid = 0;
 	gid_t egid = 0;
 
-	if (pipe(pipefd))
+	if (open_pipe(pipefd))
 		return -1;
 
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cancel_state);
@@ -213,11 +211,6 @@ static int do_spawn(unsigned logopt, uns
 			return -1;
 		}
 
-		if ((flags = fcntl(pipefd[0], F_GETFD, 0)) != -1) {
-			flags |= FD_CLOEXEC;
-			fcntl(pipefd[0], F_SETFD, flags);
-		}
-
 		errp = 0;
 		do {
 			errn = timed_read(pipefd[0],
--- autofs-5.0.3.orig/include/automount.h
+++ autofs-5.0.3/include/automount.h
@@ -17,6 +17,8 @@
 #include <pthread.h>
 #include <sched.h>
 #include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
 #include "config.h"
 #include "list.h"
 
@@ -464,5 +466,109 @@ int alarm_start_handler(void);
 int alarm_add(struct autofs_point *ap, time_t seconds);
 void alarm_delete(struct autofs_point *ap);
 
+/*
+ * Use CLOEXEC flag for open(), pipe(), fopen() (read-only case) and
+ * socket() if possible.
+ */
+static int cloexec_works;
+
+static inline void check_cloexec(int fd)
+{
+	if (cloexec_works == 0) {
+		int fl = fcntl(fd, F_GETFD);
+		cloexec_works = (fl & FD_CLOEXEC) ? 1 : -1;
+	}
+	if (cloexec_works > 0)
+		return;
+	fcntl(fd, F_SETFD, FD_CLOEXEC);
+	return;
+}
+
+static inline int open_fd(const char *path, int flags)
+{
+	int fd;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+	if (cloexec_works != -1)
+		flags |= O_CLOEXEC;
+#endif
+	fd = open(path, flags);
+	if (fd == -1)
+		return -1;
+	check_cloexec(fd);
+	return fd;
+}
+
+static inline int open_fd_mode(const char *path, int flags, int mode)
+{
+	int fd;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+	if (cloexec_works != -1)
+		flags |= O_CLOEXEC;
+#endif
+	fd = open(path, flags, mode);
+	if (fd == -1)
+		return -1;
+	check_cloexec(fd);
+	return fd;
+}
+
+static inline int open_pipe(int pipefd[2])
+{
+	int ret;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC) && defined(__have_pipe2)
+	if (cloexec_works != -1) {
+		ret = pipe2(pipefd, O_CLOEXEC);
+		if (ret != -1)
+			return 0;
+		if (errno != EINVAL)
+			return -1;
+	}
+#endif
+	ret = pipe(pipefd);
+	if (ret == -1)
+		return -1;
+	check_cloexec(pipefd[0]);
+	check_cloexec(pipefd[1]);
+	return 0;
+}
+
+static inline int open_sock(int domain, int type, int protocol)
+{
+	int fd;
+
+#ifdef SOCK_CLOEXEC
+	if (cloexec_works != -1)
+		type |= SOCK_CLOEXEC;
+#endif
+	fd = socket(domain, type, protocol);
+	if (fd == -1)
+		return -1;
+	check_cloexec(fd);
+	return fd;
+}
+
+static inline FILE *open_fopen_r(const char *path)
+{
+	FILE *f;
+
+#if defined(O_CLOEXEC) && defined(SOCK_CLOEXEC)
+	if (cloexec_works != -1) {
+		f = fopen(path, "re");
+		if (f != NULL) {
+			check_cloexec(fileno(f));
+			return f;
+		}
+	}
+#endif
+	f = fopen(path, "r");
+	if (f == NULL)
+		return NULL;
+	check_cloexec(fileno(f));
+	return f;
+}
+
 #endif
 
--- autofs-5.0.3.orig/include/state.h
+++ autofs-5.0.3/include/state.h
@@ -20,7 +20,6 @@
 #ifndef STATE_H
 #define STATE_H
 
-#include <unistd.h>
 #include <string.h>
 #include <stdlib.h>
 #include <signal.h>
--- autofs-5.0.3.orig/lib/cache.c
+++ autofs-5.0.3/lib/cache.c
@@ -17,10 +17,8 @@
 #include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <ctype.h>
 #include <stdio.h>
-#include <fcntl.h>
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/stat.h>
--- autofs-5.0.3.orig/lib/defaults.c
+++ autofs-5.0.3/lib/defaults.c
@@ -21,6 +21,7 @@
 #include "defaults.h"
 #include "lookup_ldap.h"
 #include "log.h"
+#include "automount.h"
 
 #define DEFAULTS_CONFIG_FILE		AUTOFS_CONF_DIR "/autofs"
 #define MAX_LINE_LEN			256
@@ -255,7 +256,7 @@ struct list_head *defaults_get_uris(void
 	char *res;
 	struct list_head *list;
 
-	f = fopen(DEFAULTS_CONFIG_FILE, "r");
+	f = open_fopen_r(DEFAULTS_CONFIG_FILE);
 	if (!f)
 		return NULL;
 
@@ -298,7 +299,7 @@ unsigned int defaults_read_config(unsign
 	char buf[MAX_LINE_LEN];
 	char *res;
 
-	f = fopen(DEFAULTS_CONFIG_FILE, "r");
+	f = open_fopen_r(DEFAULTS_CONFIG_FILE);
 	if (!f)
 		return 0;
 
@@ -544,7 +545,7 @@ struct ldap_searchdn *defaults_get_searc
 	char *res;
 	struct ldap_searchdn *sdn, *last;
 
-	f = fopen(DEFAULTS_CONFIG_FILE, "r");
+	f = open_fopen_r(DEFAULTS_CONFIG_FILE);
 	if (!f)
 		return NULL;
 
--- autofs-5.0.3.orig/lib/log.c
+++ autofs-5.0.3/lib/log.c
@@ -20,8 +20,6 @@
 
 #include <stdarg.h>
 #include <stdio.h>
-#include <unistd.h>
-#include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
 
--- autofs-5.0.3.orig/lib/macros.c
+++ autofs-5.0.3/lib/macros.c
@@ -14,7 +14,6 @@
  * ----------------------------------------------------------------------- */
 
 #include <malloc.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
--- autofs-5.0.3.orig/lib/mounts.c
+++ autofs-5.0.3/lib/mounts.c
@@ -14,13 +14,11 @@
 
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <mntent.h>
 #include <limits.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
-#include <fcntl.h>
 #include <sys/mount.h>
 #include <stdio.h>
 #include <dirent.h>
--- autofs-5.0.3.orig/lib/nss_parse.y
+++ autofs-5.0.3/lib/nss_parse.y
@@ -22,8 +22,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <memory.h>
-#include <unistd.h>
-#include <fcntl.h>
 #include <limits.h>
 
 #include "automount.h"
@@ -164,9 +162,9 @@ static void parse_close_nsswitch(void *a
 int nsswitch_parse(struct list_head *list)
 {
 	FILE *nsswitch;
-	int fd, cl_flags, status;
+	int status;
 
-	nsswitch = fopen(NSSWITCH_FILE, "r");
+	nsswitch = open_fopen_r(NSSWITCH_FILE);
 	if (!nsswitch) {
 		logerr("couldn't open %s\n", NSSWITCH_FILE);
 		return 1;
@@ -174,13 +172,6 @@ int nsswitch_parse(struct list_head *lis
 
 	pthread_cleanup_push(parse_close_nsswitch, nsswitch);
 
-	fd = fileno(nsswitch);
-
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	parse_mutex_lock();
 	pthread_cleanup_push(parse_mutex_unlock, NULL);
 
--- autofs-5.0.3.orig/lib/parse_subs.c
+++ autofs-5.0.3/lib/parse_subs.c
@@ -18,7 +18,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
-#include <unistd.h>
 #include "automount.h"
 
 /*
--- autofs-5.0.3.orig/lib/rpc_subs.c
+++ autofs-5.0.3/lib/rpc_subs.c
@@ -21,13 +21,11 @@
 #include <rpc/rpc.h>
 #include <rpc/pmap_prot.h>
 
-#include <unistd.h>
 #include <sys/socket.h>
 #include <netdb.h>
 #include <net/if.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include <sys/fcntl.h>
 #include <rpcsvc/ypclnt.h>
 #include <errno.h>
 #include <sys/ioctl.h>
@@ -36,6 +34,7 @@
 
 #include "mount.h"
 #include "rpc_subs.h"
+#include "automount.h"
 
 /* #define STANDALONE */
 #ifdef STANDALONE
@@ -59,7 +58,7 @@ inline void dump_core(void);
  */
 static CLIENT *create_udp_client(struct conn_info *info)
 {
-	int fd, cl_flags, ret, ghn_errno;
+	int fd, ret, ghn_errno;
 	CLIENT *client;
 	struct sockaddr_in laddr, raddr;
 	struct hostent hp;
@@ -115,15 +114,10 @@ got_addr:
 		 * layer, it would bind to a reserved port, which has been shown
 		 * to exhaust the reserved port range in some situations.
 		 */
-		fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+		fd = open_sock(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
 		if (fd < 0)
 			return NULL;
 
-		if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-			cl_flags |= FD_CLOEXEC;
-			fcntl(fd, F_SETFD, cl_flags);
-		}
-
 		laddr.sin_family = AF_INET;
 		laddr.sin_port = 0;
 		laddr.sin_addr.s_addr = htonl(INADDR_ANY);
@@ -274,7 +268,7 @@ done:
  */
 static CLIENT *create_tcp_client(struct conn_info *info)
 {
-	int fd, cl_flags, ghn_errno;
+	int fd, ghn_errno;
 	CLIENT *client;
 	struct sockaddr_in addr;
 	struct hostent hp;
@@ -324,15 +318,10 @@ got_addr:
 	addr.sin_port = htons(info->port);
 
 	if (!info->client) {
-		fd = socket(PF_INET, SOCK_STREAM, info->proto->p_proto);
+		fd = open_sock(PF_INET, SOCK_STREAM, info->proto->p_proto);
 		if (fd < 0)
 			return NULL;
 
-		if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-			cl_flags |= FD_CLOEXEC;
-			fcntl(fd, F_SETFD, cl_flags);
-		}
-
 		ret = connect_nb(fd, &addr, &info->timeout);
 		if (ret < 0)
 			goto out_close;
--- autofs-5.0.3.orig/modules/cyrus-sasl.c
+++ autofs-5.0.3/modules/cyrus-sasl.c
@@ -51,7 +51,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 #include <ldap.h>
 #include <sasl/sasl.h>
 
--- autofs-5.0.3.orig/modules/lookup_file.c
+++ autofs-5.0.3/modules/lookup_file.c
@@ -17,8 +17,6 @@
 #include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
 #include <time.h>
 #include <ctype.h>
 #include <signal.h>
@@ -395,7 +393,7 @@ int lookup_read_master(struct master *ma
 	char *ent;
 	struct stat st;
 	FILE *f;
-	int fd, cl_flags;
+	int fd;
 	unsigned int path_len, ent_len;
 	int entry, cur_state;
 
@@ -422,7 +420,7 @@ int lookup_read_master(struct master *ma
 		return NSS_STATUS_UNAVAIL;
 	}
 
-	f = fopen(ctxt->mapname, "r");
+	f = open_fopen_r(ctxt->mapname);
 	if (!f) {
 		error(logopt,
 		      MODPREFIX "could not open master map file %s",
@@ -432,11 +430,6 @@ int lookup_read_master(struct master *ma
 
 	fd = fileno(f);
 
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	while(1) {
 		entry = read_one(logopt, f, path, &path_len, ent, &ent_len);
 		if (!entry) {
@@ -651,7 +644,7 @@ int lookup_read_map(struct autofs_point 
 	char *mapent;
 	struct stat st;
 	FILE *f;
-	int fd, cl_flags;
+	int fd;
 	unsigned int k_len, m_len;
 	int entry;
 
@@ -684,7 +677,7 @@ int lookup_read_map(struct autofs_point 
 		return NSS_STATUS_UNAVAIL;
 	}
 
-	f = fopen(ctxt->mapname, "r");
+	f = open_fopen_r(ctxt->mapname);
 	if (!f) {
 		error(ap->logopt,
 		      MODPREFIX "could not open map file %s", ctxt->mapname);
@@ -693,11 +686,6 @@ int lookup_read_map(struct autofs_point 
 
 	fd = fileno(f);
 
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	while(1) {
 		entry = read_one(ap->logopt, f, key, &k_len, mapent, &m_len);
 		if (!entry) {
@@ -784,7 +772,6 @@ static int lookup_one(struct autofs_poin
 	char mapent[MAPENT_MAX_LEN + 1];
 	time_t age = time(NULL);
 	FILE *f;
-	int fd, cl_flags;
 	unsigned int k_len, m_len;
 	int entry, ret;
 
@@ -794,20 +781,13 @@ static int lookup_one(struct autofs_poin
 
 	mc = source->mc;
 
-	f = fopen(ctxt->mapname, "r");
+	f = open_fopen_r(ctxt->mapname);
 	if (!f) {
 		error(ap->logopt,
 		      MODPREFIX "could not open map file %s", ctxt->mapname);
 		return CHE_FAIL;
 	}
 
-	fd = fileno(f);
-
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	while(1) {
 		entry = read_one(ap->logopt, f, mkey, &k_len, mapent, &m_len);
 		if (entry) {
@@ -897,7 +877,6 @@ static int lookup_wild(struct autofs_poi
 	char mapent[MAPENT_MAX_LEN + 1];
 	time_t age = time(NULL);
 	FILE *f;
-	int fd, cl_flags;
 	unsigned int k_len, m_len;
 	int entry, ret;
 
@@ -907,20 +886,13 @@ static int lookup_wild(struct autofs_poi
 
 	mc = source->mc;
 
-	f = fopen(ctxt->mapname, "r");
+	f = open_fopen_r(ctxt->mapname);
 	if (!f) {
 		error(ap->logopt,
 		      MODPREFIX "could not open map file %s", ctxt->mapname);
 		return CHE_FAIL;
 	}
 
-	fd = fileno(f);
-
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	while(1) {
 		entry = read_one(ap->logopt, f, mkey, &k_len, mapent, &m_len);
 		if (entry) {
--- autofs-5.0.3.orig/modules/lookup_hesiod.c
+++ autofs-5.0.3/modules/lookup_hesiod.c
@@ -10,7 +10,6 @@
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
--- autofs-5.0.3.orig/modules/lookup_hosts.c
+++ autofs-5.0.3/modules/lookup_hosts.c
@@ -15,7 +15,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <unistd.h>
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/stat.h>
--- autofs-5.0.3.orig/modules/lookup_ldap.c
+++ autofs-5.0.3/modules/lookup_ldap.c
@@ -21,7 +21,6 @@
 #include <sys/stat.h>
 #include <ctype.h>
 #include <string.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <time.h>
 #include <signal.h>
--- autofs-5.0.3.orig/modules/lookup_multi.c
+++ autofs-5.0.3/modules/lookup_multi.c
@@ -18,7 +18,6 @@
 #include <malloc.h>
 #include <stdio.h>
 #include <string.h>
-#include <unistd.h>
 #include <sys/stat.h>
 
 #define MODULE_LOOKUP
--- autofs-5.0.3.orig/modules/lookup_nisplus.c
+++ autofs-5.0.3/modules/lookup_nisplus.c
@@ -6,7 +6,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <unistd.h>
 #include <sys/param.h>
 #include <sys/types.h>
 #include <signal.h>
--- autofs-5.0.3.orig/modules/lookup_program.c
+++ autofs-5.0.3/modules/lookup_program.c
@@ -18,7 +18,6 @@
 #include <malloc.h>
 #include <stdio.h>
 #include <string.h>
-#include <unistd.h>
 #include <signal.h>
 #include <sys/param.h>
 #include <sys/stat.h>
@@ -193,12 +192,12 @@ int lookup_mount(struct autofs_point *ap
 	 * want to send stderr to the syslog, and we don't use spawnl()
 	 * because we need the pipe hooks
 	 */
-	if (pipe(pipefd)) {
+	if (open_pipe(pipefd)) {
 		char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 		logerr(MODPREFIX "pipe: %s", estr);
 		goto out_free;
 	}
-	if (pipe(epipefd)) {
+	if (open_pipe(epipefd)) {
 		close(pipefd[0]);
 		close(pipefd[1]);
 		goto out_free;
--- autofs-5.0.3.orig/modules/lookup_userhome.c
+++ autofs-5.0.3/modules/lookup_userhome.c
@@ -16,7 +16,6 @@
 #include <stdio.h>
 #include <malloc.h>
 #include <pwd.h>
-#include <unistd.h>
 #include <string.h>
 #include <sys/param.h>
 #include <sys/types.h>
--- autofs-5.0.3.orig/modules/lookup_yp.c
+++ autofs-5.0.3/modules/lookup_yp.c
@@ -16,7 +16,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <unistd.h>
 #include <time.h>
 #include <signal.h>
 #include <ctype.h>
--- autofs-5.0.3.orig/modules/mount_afs.c
+++ autofs-5.0.3/modules/mount_afs.c
@@ -9,8 +9,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <sys/param.h>
 #include <sys/types.h>
--- autofs-5.0.3.orig/modules/mount_autofs.c
+++ autofs-5.0.3/modules/mount_autofs.c
@@ -16,8 +16,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <signal.h>
 #include <alloca.h>
--- autofs-5.0.3.orig/modules/mount_bind.c
+++ autofs-5.0.3/modules/mount_bind.c
@@ -15,8 +15,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <stdlib.h>
 #include <sys/param.h>
--- autofs-5.0.3.orig/modules/mount_changer.c
+++ autofs-5.0.3/modules/mount_changer.c
@@ -19,8 +19,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <sys/param.h>
 #include <sys/types.h>
@@ -142,25 +140,19 @@ int swapCD(const char *device, const cha
 {
 	int fd;			/* file descriptor for CD-ROM device */
 	int status;		/* return status for system calls */
-	int cl_flags;
 	int slot = -1;
 	int total_slots_available;
 
 	slot = atoi(slotName) - 1;
 
 	/* open device */
-	fd = open(device, O_RDONLY | O_NONBLOCK);
+	fd = open_fd(device, O_RDONLY | O_NONBLOCK);
 	if (fd < 0) {
 		logerr(MODPREFIX "Opening device %s failed : %s",
 		      device, strerror(errno));
 		return 1;
 	}
 
-	if ((cl_flags = fcntl(fd, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(fd, F_SETFD, cl_flags);
-	}
-
 	/* Check CD player status */
 	total_slots_available = ioctl(fd, CDROM_CHANGER_NSLOTS);
 	if (total_slots_available <= 1) {
--- autofs-5.0.3.orig/modules/mount_ext2.c
+++ autofs-5.0.3/modules/mount_ext2.c
@@ -15,8 +15,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <stdlib.h>
 #include <sys/param.h>
--- autofs-5.0.3.orig/modules/mount_generic.c
+++ autofs-5.0.3/modules/mount_generic.c
@@ -15,8 +15,6 @@
 
 #include <stdio.h>
 #include <malloc.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <string.h>
 #include <stdlib.h>
 #include <sys/param.h>
--- autofs-5.0.3.orig/modules/mount_nfs.c
+++ autofs-5.0.3/modules/mount_nfs.c
@@ -17,8 +17,6 @@
 #include <stdio.h>
 #include <malloc.h>
 #include <netdb.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/param.h>
--- autofs-5.0.3.orig/modules/parse_hesiod.c
+++ autofs-5.0.3/modules/parse_hesiod.c
@@ -7,7 +7,6 @@
 #include <sys/types.h>
 #include <ctype.h>
 #include <string.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
--- autofs-5.0.3.orig/modules/parse_sun.c
+++ autofs-5.0.3/modules/parse_sun.c
@@ -18,8 +18,6 @@
 #include <stdio.h>
 #include <malloc.h>
 #include <netdb.h>
-#include <fcntl.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
--- autofs-5.0.3.orig/modules/replicated.c
+++ autofs-5.0.3/modules/replicated.c
@@ -52,8 +52,6 @@
 #include <net/if.h>
 #include <netinet/in.h>
 #include <netdb.h>
-#include <unistd.h>
-#include <fcntl.h>
 
 #include "rpc_subs.h"
 #include "replicated.h"
@@ -82,7 +80,7 @@ void seed_random(void)
 	int fd;
 	unsigned int seed;
 
-	fd = open("/dev/urandom", O_RDONLY);
+	fd = open_fd("/dev/urandom", O_RDONLY);
 	if (fd < 0) {
 		srandom(time(NULL));
 		return;
@@ -145,7 +143,7 @@ static unsigned int get_proximity(const 
 	char tmp[20], buf[MAX_ERR_BUF], *ptr;
 	struct ifconf ifc;
 	struct ifreq *ifr, nmptr;
-	int sock, cl_flags, ret, i;
+	int sock, ret, i;
 	uint32_t mask, ha, ia;
 
 	memcpy(tmp, host_addr, addr_len);
@@ -153,18 +151,13 @@ static unsigned int get_proximity(const 
 
 	ha = ntohl((uint32_t) hst_addr->s_addr);
 
-	sock = socket(AF_INET, SOCK_DGRAM, 0);
+	sock = open_sock(AF_INET, SOCK_DGRAM, 0);
 	if (sock < 0) {
 		char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 		logerr("socket creation failed: %s", estr);
 		return PROXIMITY_ERROR;
 	}
 
-	if ((cl_flags = fcntl(sock, F_GETFD, 0)) != -1) {
-		cl_flags |= FD_CLOEXEC;
-		fcntl(sock, F_SETFD, cl_flags);
-	}
-
 	if (!alloc_ifreq(&ifc, sock)) {
 		close(sock);
 		return PROXIMITY_ERROR;