ufssuspend(4): mark non-passable

[kib]

Summary

This fixes long-standing issue where ufssuspend file descriptor could
leak over fork or be passed over unix domain socket, and then closing it
in the opener would not unsuspend the file system.

It should not affect the well-behaving growfs(8) utility, but makes the
userspace API safer on principle.

Tested by: pho

[markj]

sys/ufs/ffs/ffs_suspend.c

354 ↗

(On Diff #188574)

Can we instead provide a devfs_ops_nonpassable_f table from devfs? I suspect this is not the only device file which needs this treatment. I even wonder if non-passable should be the default.

[kib]

cdevsw: add D_NONPASSABLE flag

to make the opened device files non-passable.

[markj]

sys/sys/conf.h

180