[PATCH 00/10] files,close_range: add CLOSE_RANGE_{CLOEXEC_ONLY,EXCEPT}

[Christian Brauner <brauner@kernel.org>]

close_range(CLOSE_RANGE_CLOEXEC) marks a range of file descriptors
close-on-exec. It only marks them. The file descriptors are only ever
closed during an exec. This series adds two new flags to extend the
abilities of close_range():

(1) CLOSE_RANGE_EXCEPT

    While regular close_range() operates on all file descriptors in the
    range [fd, max_fd] and not on any others, CLOSE_RANGE_EXCEPT makes
    close_range() operate on all file descriptors outside of the range.

    When combined with CLOSE_RANGE_UNSHARE dup_fd() never takes a
    reference on what is dropped.

    A task between clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and
    execve() that has the descriptors for the child in one window can
    shed the rest of the shared table in one call:

            close_range(lo, hi, CLOSE_RANGE_UNSHARE | CLOSE_RANGE_EXCEPT)

    Nothing outside of the window is referenced by the child at any point.

(2) CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec file descriptors
    in the range

    Whatever the caller deliberately passes down, stdio, LISTEN_FDS, an
    inherited pipe, remains where it is.

    The handful of close-on-exec descriptors the caller still needs for the
    exec such as the executable, an error pipe, can sit in a specific
    range. A task between clone(CLONE_FILES) and execve() may do:

            clone(CLONE_FILES | CLONE_VM | CLONE_VFORK)
            child: close_range(lo, hi, CLOSE_RANGE_UNSHARE |
                                       CLOSE_RANGE_CLOEXEC_ONLY |
                                       CLOSE_RANGE_EXCEPT)
            child: rearrange descriptors in the now private table
            child: execve()

    Between the clone and the close_range() the child holds no reference of
    its own on any file because copy_files() only bumps the fdtable
    refcount. So a close() in the parent takes effect immediately. The
    unshare also never takes a reference on the fds it leaves behind either.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Christian Brauner (10):
      file: let dup_fd() leave the punched hole behind
      selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
      file: rename dup_fd()'s punch_hole to range
      file: let dup_fd() drop everything outside of the range
      close_range: turn the flags into an enum
      file: add CLOSE_RANGE_EXCEPT
      selftests/core: test CLOSE_RANGE_EXCEPT
      file: let dup_fd() drop only close-on-exec descriptors
      file: add CLOSE_RANGE_CLOEXEC_ONLY
      selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY

 fs/file.c                                       | 200 ++++-
 include/linux/fdtable.h                         |   9 +
 include/uapi/linux/close_range.h                |  31 +-
 tools/testing/selftests/core/close_range_test.c | 951 ++++++++++++++++++++++++
 4 files changed, 1151 insertions(+), 40 deletions(-)
---
base-commit: 5dd1818b15d98d4a20806cd00b1b40320b06004f
change-id: 20260918-work-file-close_range_except-e100cfb38561