SECURITY CONSIDERATIONS
Read and write permissions to files are determined upon a call to open(2). Once a file descriptor is open, dropping privilege does not affect the process’s read/write permissions, even if the user ID specified has no read or write permissions to the file. These files normally remain open in any new process executed, resulting in a user being able to read or modify potentially sensitive data. To prevent these files from remaining open after an exec(3) call, be sure to set the close-on-exec flag is set:
void
pseudocode(void)
{
int fd;
/* ... */
fd = open("/path/to/sensitive/data", O_RDWR);
if (fd == -1)
err(1, "open");
