larsxschneider@xxxxxxxxx wrote: > static int ce_compare_data(const struct cache_entry *ce, struct stat *st) > { > int match = -1; > - int fd = open(ce->name, O_RDONLY); > + int fd = open(ce->name, O_RDONLY | O_CLOEXEC); > > if (fd >= 0) { > unsigned char sha1[20]; Also, this needs to check EINVAL when O_CLOEXEC != 0 the same way create_tempfile currently does. Somebody could be building with modern headers but running an old kernel that doesn't understand O_CLOEXEC. There should probably be a open() wrapper for handling this case since we're now up to 3 places where open(... O_CLOEXEC) is used.