[glibc] nptl: open threads comm with O_WRONLY|O_CLOEXEC

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1cba6073e500c7bde9322a2f536fc0c308846c61

commit 1cba6073e500c7bde9322a2f536fc0c308846c61
Author: Sana Kazi <[email protected]>
Date:   Mon Jun 15 16:37:59 2026 +0200

    nptl: open threads comm with O_WRONLY|O_CLOEXEC
    
    pthread_setname_np opens the thread's comm file using O_RDWR, but the
    function only ever writes to it.  This causes two distinct problems:
    
    1. Missing O_CLOEXEC: the file descriptor is not marked close-on-exec,
       so it remains open across fork+exec.  A child process that audits
       its inherited file-descriptor set will encounter an unexpected /proc
       fd it did not open and may treat this as a security violation and
       abort.
    
    2. Unnecessary O_RDWR: requesting read+write access when only write
       access is needed can cause open() to fail under security policies
       that permit writing to /proc/<tid>/comm but deny reading it.
    
    Fix both issues by replacing O_RDWR with O_WRONLY|O_CLOEXEC
    
    Similarly, updated pthread_getname_np to use O_CLOEXEC.
    
    Bug-Id: 34192[https://sourceware.org/bugzilla/show_bug.cgi?id=34192]
    
    Signed-off-by: Sana Kazi <[email protected]>
    Reviewed-by: Florian Weimer <[email protected]>

Diff:
---
 nptl/pthread_getname.c | 2 +-
 nptl/pthread_setname.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nptl/pthread_getname.c b/nptl/pthread_getname.c
index da23a13ba5..5261993d1f 100644
--- a/nptl/pthread_getname.c
+++ b/nptl/pthread_getname.c
@@ -44,7 +44,7 @@ __pthread_getname_np (pthread_t th, char *buf, size_t len)
   char fname[sizeof (FMT) + 8];
   sprintf (fname, FMT, (unsigned int) pd->tid);
 
-  int fd = __open64_nocancel (fname, O_RDONLY);
+  int fd = __open64_nocancel (fname, O_RDONLY | O_CLOEXEC);
   if (fd == -1)
     return errno;
 
diff --git a/nptl/pthread_setname.c b/nptl/pthread_setname.c
index 62f4964fcc..f9a528c3d8 100644
--- a/nptl/pthread_setname.c
+++ b/nptl/pthread_setname.c
@@ -46,7 +46,7 @@ __pthread_setname_np (pthread_t th, const char *name)
   char fname[sizeof (FMT) + 8];
   sprintf (fname, FMT, (unsigned int) pd->tid);
 
-  int fd = __open64_nocancel (fname, O_RDWR);
+  int fd = __open64_nocancel (fname, O_WRONLY | O_CLOEXEC);
   if (fd == -1)
     return errno;