Fix cmp(1) to handle the case where standard streams are closed.

[markj]

Summary

Use caph_limit_stdio() before opening input files. This function
suppresses EBADF. When further limiting stdin, make sure STDIN_FILENO
isn't being used for one of the input files.

Fix some style bugs while here.

[oshogbo]

usr.bin/cmp/cmp.c

119 ↗

(On Diff #52898)

stderr?

119 ↗

(On Diff #52898)

I miss read sorry.

[oshogbo]

usr.bin/cmp/cmp.c

167 ↗

(On Diff #52898)

Hym not sure if I get this.
special is set if fd1 or fd2 is set to the STDIN right? So we don't need to check those.

169 ↗

(On Diff #52898)

I'm not sure if I'm understand that correctly.
If we have a problem with closed STDIN dosent this return EBADF as well?
The special will not be set but STDIN will be closed, so this should fail I think.

[markj]

usr.bin/cmp/cmp.c

167 ↗

(On Diff #52898)

Yes, but if !special and the shell doesn't provide stdin, then STDIN_FILENO will be used for one of the input files.

169 ↗

(On Diff #52898)

If stdin is closed, then file descriptor 0 is available and will be claimed by fd1 or fd2. You are right though, this is making the assumption that open() will return the smallest available descriptor.

[markj]

• Verify that STDIN_FILENO is in use before limiting rights on it. In practice, it will always be in use: if STDIN_FILENO is not provided by the shell, then it will be claimed for fd1. But, we should not make assumptions about the kernel's fd allocation policy.

[oshogbo]

usr.bin/cmp/cmp.c

170 ↗

(On Diff #52900)

Let's just remove this whole block.
If the stdin is used lets limit it using caph_limit_stdio.
If it is but not used do we care to limit it further? In my opinion this is a minimal value if not even none and complicate code a lot.

[markj]

usr.bin/cmp/cmp.c

170 ↗

(On Diff #52900)

Fair enough. I agree that it doesn't accomplish much: we're just removing read caps from the descriptor.

[markj]

Don't bother limiting rights on stdin beyond what caph_limit_stdio()
does.