Set close-on-exec on files opened with Lwt_io.with_file

Author: MisterDA

lib/build_log.ml

@@ -29,7 +29,8 @@ let tail ?switch t dst =
   match t.state with
   | `Finished -> invalid_arg "tail: log is finished!"
   | `Readonly path ->
-    Lwt_io.(with_file ~mode:input) path @@ fun ch ->
+    let flags = [Unix.O_RDONLY; Unix.O_NONBLOCK; Unix.O_CLOEXEC] in
+    Lwt_io.(with_file ~mode:input ~flags) path @@ fun ch ->
     let buf = Bytes.create max_chunk_size in
     let rec aux () =
       Lwt_io.read_into ch buf 0 max_chunk_size >>= function

lib/os.ml

@@ -90,7 +90,8 @@ let rec write_all fd buf ofs len =
   )
 
 let write_file ~path contents =
-  Lwt_io.(with_file ~mode:output) path @@ fun ch ->
+  let flags = [Unix.O_WRONLY; Unix.O_CREAT; Unix.O_TRUNC; Unix.O_NONBLOCK; Unix.O_CLOEXEC] in
+  Lwt_io.(with_file ~mode:output ~flags) path @@ fun ch ->
   Lwt_io.write ch contents
 
 let with_pipe_from_child fn =

lib/tar_transfer.ml

@@ -65,7 +65,8 @@ let copy_file ~src ~dst ~to_untar ~user =
       dst stat.Lwt_unix.LargeFile.st_size
   in
   Tar_lwt_unix.write_block ~level hdr (fun ofd ->
-      Lwt_io.(with_file ~mode:input) src (copy_to ~dst:ofd)
+      let flags = [Unix.O_RDONLY; Unix.O_NONBLOCK; Unix.O_CLOEXEC] in
+      Lwt_io.(with_file ~mode:input ~flags) src (copy_to ~dst:ofd)
     ) to_untar
 
 let copy_symlink ~src ~target ~dst ~to_untar ~user =