[clang-tidy] Add a close-on-exec check on accept() in Android module.

[chh]

Summary

accept() is better to be replaced by accept4() with SOCK_CLOEXEC flag to avoid file descriptor leakage.

[alexfh]

See the comment on D35372.

[alexfh]

LG with a nit.

clang-tidy/android/CloexecAcceptCheck.cpp

43

Two minor issues here:

1. FixMsg name is misleading, specifically the "Msg" part, since it's not a message.
2. there's no need to use an argument comment, where it's clear what the actual argument's meaning is. E.g. ReplacementText is pretty clear on its own. As is the warning message above.

[chh]

clang-tidy/android/CloexecAcceptCheck.cpp

43

Done.

clang-tidy/android/AndroidTidyModule.cpp

 #include "../ClangTidy.h"
 #include "../ClangTidyModule.h"
 #include "../ClangTidyModuleRegistry.h"
+#include "CloexecAcceptCheck.h"
 #include "CloexecCreatCheck.h"
 #include "CloexecFopenCheck.h"
 #include "CloexecOpenCheck.h"

 class AndroidModule : public ClangTidyModule {
 public:
   void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {
+    CheckFactories.registerCheck<CloexecAcceptCheck>("android-cloexec-accept");
     CheckFactories.registerCheck<CloexecCreatCheck>("android-cloexec-creat");
     CheckFactories.registerCheck<CloexecFopenCheck>("android-cloexec-fopen");
     CheckFactories.registerCheck<CloexecOpenCheck>("android-cloexec-open");

clang-tidy/android/CMakeLists.txt

 
 add_clang_library(clangTidyAndroidModule
   AndroidTidyModule.cpp
+  CloexecAcceptCheck.cpp
   CloexecCreatCheck.cpp
   CloexecFopenCheck.cpp
   CloexecOpenCheck.cpp

clang-tidy/android/CloexecAcceptCheck.h

+//===--- CloexecAcceptCheck.h - clang-tidy-----------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_ACCEPT_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_ACCEPT_H
+
+#include "../ClangTidy.h"
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+/// accept() is better to be replaced by accept4().
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-accept.html
+class CloexecAcceptCheck : public ClangTidyCheck {
+public:
+  CloexecAcceptCheck(StringRef Name, ClangTidyContext *Context)
+      : ClangTidyCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+};
+
+} // namespace android
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_ANDROID_CLOEXEC_ACCEPT_H

clang-tidy/android/CloexecAcceptCheck.cpp

+//===--- CloexecAcceptCheck.cpp - clang-tidy-------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "CloexecAcceptCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang {
+namespace tidy {
+namespace android {
+
+void CloexecAcceptCheck::registerMatchers(MatchFinder *Finder) {
+  auto SockAddrPointerType =
+      hasType(pointsTo(recordDecl(isStruct(), hasName("sockaddr"))));
+  auto SockLenPointerType = hasType(pointsTo(namedDecl(hasName("socklen_t"))));
+
+  Finder->addMatcher(
+      callExpr(callee(functionDecl(isExternC(), returns(isInteger()),
+                                   hasName("accept"),
+                                   hasParameter(0, hasType(isInteger())),
+                                   hasParameter(1, SockAddrPointerType),
+                                   hasParameter(2, SockLenPointerType))
+                          .bind("funcDecl")))
+          .bind("acceptFn"),
+      this);
+}
+
+void CloexecAcceptCheck::check(const MatchFinder::MatchResult &Result) {
+  const auto *MatchedCall = Result.Nodes.getNodeAs<CallExpr>("acceptFn");
+  const SourceManager &SM = *Result.SourceManager;
+
+  const std::string &ReplacementText =
+      (Twine("accept4(") +
+       Lexer::getSourceText(CharSourceRange::getTokenRange(
+                                MatchedCall->getArg(0)->getSourceRange()),
+                            SM, Result.Context->getLangOpts()) +
+       ", " +
+       Lexer::getSourceText(CharSourceRange::getTokenRange(
+                                MatchedCall->getArg(1)->getSourceRange()),
+                            SM, Result.Context->getLangOpts()) +
+       ", " +
+       Lexer::getSourceText(CharSourceRange::getTokenRange(
+                                MatchedCall->getArg(2)->getSourceRange()),
+                            SM, Result.Context->getLangOpts()) +
+       ", SOCK_CLOEXEC)")
+          .str();
+
+  diag(MatchedCall->getLocStart(),
+       "prefer accept4() to accept() because accept4() allows SOCK_CLOEXEC")
+      << FixItHint::CreateReplacement(MatchedCall->getSourceRange(),
+                                      ReplacementText);
+}
+
+} // namespace android
+} // namespace tidy
+} // namespace clang

docs/ReleaseNotes.rst

 Improvements to clang-tidy
 --------------------------
 
+- New `android-cloexec-accept
+  <http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-accept.html>`_ check
+
+  Detects usage of ``accept()``.
+
 - New `android-cloexec-creat
   <http://clang.llvm.org/extra/clang-tidy/checks/android-cloexec-creat.html>`_ check
 

docs/clang-tidy/checks/android-cloexec-accept.rst

+.. title:: clang-tidy - android-cloexec-accept
+
+android-cloexec-accept
+======================
+
+The usage of ``accept()`` is not recommended, it's better to use ``accept4()``.
+Without this flag, an opened sensitive file descriptor would remain open across
+a fork+exec to a lower-privileged SELinux domain.
+
+Examples:
+
+.. code-block:: c++
+
+  accept(sockfd, addr, addrlen);
+
+  // becomes
+
+  accept4(sockfd, addr, addrlen, SOCK_CLOEXEC);

docs/clang-tidy/checks/list.rst

 =================
 
 .. toctree::
+   android-cloexec-accept
    android-cloexec-creat
    android-cloexec-fopen
    android-cloexec-open

test/clang-tidy/android-cloexec-accept.cpp

+// RUN: %check_clang_tidy %s android-cloexec-accept %t
+
+struct sockaddr {};
+typedef int socklen_t;
+#define NULL 0
+
+extern "C" int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
+
+void f() {
+  accept(0, NULL, NULL);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: prefer accept4() to accept() because accept4() allows SOCK_CLOEXEC [android-cloexec-accept]
+  // CHECK-FIXES: accept4(0, NULL, NULL, SOCK_CLOEXEC)
+}
+
+namespace i {
+int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
+void g() {
+  accept(0, NULL, NULL);
+}
+} // namespace i
+
+class C {
+public:
+  int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
+  void h() {
+    accept(0, NULL, NULL);
+  }
+};