components/krb5/patches/051-fopenF.patch
author Neng Xue <neng.xue@oracle.com>
Mon, 26 Sep 2016 15:58:55 -0700
changeset 6978 14cbeb78966a
parent 6599 1d033832c5e7
permissions -rw-r--r--
24669827 Update Userland krb5 to MIT 1.14.4

#
# Modifies calls to fopen() to add 'F' flag so 32bit binaries can open > 256
# file descriptors at once.
#
# MIT said they would take this patch however there has been talk of modifying
# fopen() for 32bit apps to extend the number of fds so this patch will not be
# submitted to MIT until this is resolved in ON.
# Patch source: in-house
#
--- a/src/appl/gss-sample/gss-server.c
+++ b/src/appl/gss-sample/gss-server.c
@@ -709,7 +709,7 @@ main(int argc, char **argv)
             if (!strcmp(*argv, "/dev/null")) {
                 logfile = display_file = NULL;
             } else {
-                logfile = fopen(*argv, "a");
+                logfile = fopen(*argv, "aF");
                 display_file = logfile;
                 if (!logfile) {
                     perror(*argv);
--- a/src/clients/ksu/authorization.c
+++ b/src/clients/ksu/authorization.c
@@ -100,7 +100,7 @@ krb5_error_code krb5_authorization(context, principal, luser,
 
     /* k5login and k5users must be owned by target user or root */
     if (!k5login_flag){
-        if ((login_fp = fopen(k5login_path, "r")) == NULL)
+        if ((login_fp = fopen(k5login_path, "rF")) == NULL)
             return 0;
         if ( fowner(login_fp, pwd->pw_uid) == FALSE) {
             fclose(login_fp);
@@ -109,7 +109,7 @@ krb5_error_code krb5_authorization(context, principal, luser,
     }
 
     if (!k5users_flag){
-        if ((users_fp = fopen(k5users_path, "r")) == NULL) {
+        if ((users_fp = fopen(k5users_path, "rF")) == NULL) {
             return 0;
         }
         if ( fowner(users_fp, pwd->pw_uid) == FALSE){
--- a/src/clients/ksu/ccache.c
+++ b/src/clients/ksu/ccache.c
@@ -375,7 +375,7 @@ krb5_get_login_princ(luser, princ_list)
 
 
     /* open ~/.k5login */
-    if ((fp = fopen(pbuf, "r")) == NULL) {
+    if ((fp = fopen(pbuf, "rF")) == NULL) {
         return 0;
     }
     /*
--- a/src/clients/ksu/heuristic.c
+++ b/src/clients/ksu/heuristic.c
@@ -222,7 +222,7 @@ get_authorized_princ_names(luser, cmd, princ_list)
     k5users_flag = stat(k5users_path, &tb);
 
     if (!k5login_flag){
-        if ((login_fp = fopen(k5login_path, "r")) == NULL)
+        if ((login_fp = fopen(k5login_path, "rF")) == NULL)
             return 0;
         if ( fowner(login_fp, pwd->pw_uid) == FALSE){
             close_time(1 /*k5users_flag*/, (FILE *) 0 /*users_fp*/,
@@ -231,7 +231,7 @@ get_authorized_princ_names(luser, cmd, princ_list)
         }
     }
     if (!k5users_flag){
-        if ((users_fp = fopen(k5users_path, "r")) == NULL)
+        if ((users_fp = fopen(k5users_path, "rF")) == NULL)
             return 0;
 
         if ( fowner(users_fp, pwd->pw_uid) == FALSE){
--- a/src/kadmin/dbutil/dump.c
+++ b/src/kadmin/dbutil/dump.c
@@ -1215,7 +1215,7 @@ current_dump_sno_in_ulog(krb5_context context, const char *ifile)
     char buf[BUFSIZ];
     FILE *f;
 
-    f = fopen(ifile, "r");
+    f = fopen(ifile, "rF");
     if (f == NULL)
         return 0;              /* aliasing other errors to ENOENT here is OK */
 
@@ -1540,7 +1540,7 @@ load_db(int argc, char **argv)
 
     /* Open the dumpfile. */
     if (dumpfile != NULL) {
-        f = fopen(dumpfile, "r");
+        f = fopen(dumpfile, "rF");
         if (f == NULL) {
             com_err(progname, errno, _("while opening %s"), dumpfile);
             goto error;
--- a/src/kadmin/server/ovsec_kadmd.c
+++ b/src/kadmin/server/ovsec_kadmd.c
@@ -126,7 +126,7 @@ write_pid_file(const char *pid_file)
     unsigned long pid;
     int st1, st2;
 
-    file = fopen(pid_file, "w");
+    file = fopen(pid_file, "wF");
     if (file == NULL)
         return errno;
     pid = (unsigned long)getpid();
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -859,7 +859,7 @@ write_pid_file(const char *path)
     FILE *file;
     unsigned long pid;
 
-    file = fopen(path, "w");
+    file = fopen(path, "wF");
     if (file == NULL)
         return errno;
     pid = (unsigned long) getpid();
--- a/src/lib/gssapi/generic/util_errmap.c
+++ b/src/lib/gssapi/generic/util_errmap.c
@@ -176,7 +176,7 @@ OM_uint32 gssint_mecherrmap_map(OM_uint32 minor, const gss_OID_desc * oid)
 
 #ifdef DEBUG
     FILE *f;
-    f = fopen("/dev/pts/9", "w+");
+    f = fopen("/dev/pts/9", "w+F");
     if (f == NULL)
         f = stderr;
 #endif
--- a/src/lib/gssapi/mechglue/g_initialize.c
+++ b/src/lib/gssapi/mechglue/g_initialize.c
@@ -1218,7 +1218,7 @@ loadConfigFile(const char *fileName)
 	char buffer[BUFSIZ], *oidStr;
 	FILE *confFile;
 
-	if ((confFile = fopen(fileName, "r")) == NULL) {
+	if ((confFile = fopen(fileName, "rF")) == NULL) {
 		return;
 	}
 
--- a/src/lib/kadm5/logger.c
+++ b/src/lib/kadm5/logger.c
@@ -566,7 +566,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
                     if (cp[4] == ':' || cp[4] == '=') {
                         /* Solaris Kerberos */
                         log_control.log_entries[i].lfu_fopen_mode =
-                            (cp[4] == ':') ? "a" : "w";
+                            (cp[4] == ':') ? "aF" : "wF";
                         old_umask = umask(077);
                         f = fopen(&cp[5],
                                   log_control.log_entries[i].lfu_fopen_mode);
@@ -801,7 +801,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
                  */
                 else if (!strcasecmp(cp, "CONSOLE")) {
                     log_control.log_entries[i].ldu_filep =
-                        CONSOLE_OPEN("a+");
+                        CONSOLE_OPEN("a+F");
                     if (log_control.log_entries[i].ldu_filep) {
                         set_cloexec_file(log_control.log_entries[i].ldu_filep);
                         log_control.log_entries[i].log_type = K_LOG_CONSOLE;
@@ -817,7 +817,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
                      */
                     if (cp[6] == '=') {
                         log_control.log_entries[i].ldu_filep =
-                            DEVICE_OPEN(&cp[7], "w");
+                            DEVICE_OPEN(&cp[7], "wF");
                         if (log_control.log_entries[i].ldu_filep) {
                             set_cloexec_file(log_control.log_entries[i].ldu_filep);
                             log_control.log_entries[i].log_type = K_LOG_DEVICE;
@@ -1156,7 +1156,7 @@ krb5_klog_reopen(krb5_context kcontext)
              * In case the old logfile did not get moved out of the
              * way, open for append to prevent squashing the old logs.
              */
-            f = fopen(log_control.log_entries[lindex].lfu_fname, "a+");
+            f = fopen(log_control.log_entries[lindex].lfu_fname, "a+F");
             if (f) {
                 set_cloexec_file(f);
                 log_control.log_entries[lindex].lfu_filep = f;
--- a/src/lib/kadm5/srv/server_acl.c
+++ b/src/lib/kadm5/srv/server_acl.c
@@ -488,7 +488,7 @@ kadm5int_acl_load_acl_file()
 
     DPRINT(DEBUG_CALLS, acl_debug_level, ("* kadm5int_acl_load_acl_file()\n"));
     /* Open the ACL file for read */
-    afp = fopen(acl_acl_file, "r");
+    afp = fopen(acl_acl_file, "rF");
     if (afp) {
         set_cloexec_file(afp);
         alineno = 1;
--- a/src/lib/kdb/kdb_default.c
+++ b/src/lib/kdb/kdb_default.c
@@ -251,9 +251,9 @@ krb5_db_def_fetch_mkey_stash(krb5_context   context,
     FILE *kf = NULL;
 
 #ifdef ANSI_STDIO
-    if (!(kf = fopen(keyfile, "rb")))
+    if (!(kf = fopen(keyfile, "rbF")))
 #else
-        if (!(kf = fopen(keyfile, "r")))
+        if (!(kf = fopen(keyfile, "rF")))
 #endif
             return KRB5_KDB_CANTREAD_STORED;
     set_cloexec_file(kf);
--- a/src/lib/krb5/ccache/cc_dir.c
+++ b/src/lib/krb5/ccache/cc_dir.c
@@ -153,7 +153,7 @@ read_primary_file(krb5_context context, const char *primary_path,
     *residual_out = NULL;
 
     /* Open the file and read its first line. */
-    fp = fopen(primary_path, "r");
+    fp = fopen(primary_path, "rF");
     if (fp == NULL)
         return ENOENT;
     ret = fgets(buf, sizeof(buf), fp);
--- a/src/lib/krb5/ccache/ccselect_k5identity.c
+++ b/src/lib/krb5/ccache/ccselect_k5identity.c
@@ -168,7 +168,7 @@ k5identity_choose(krb5_context context, krb5_ccselect_moddata data,
     free(homedir);
     if (ret)
         return ret;
-    fp = fopen(filename, "r");
+    fp = fopen(filename, "rF");
     free(filename);
     if (fp == NULL)
         return KRB5_PLUGIN_NO_HANDLE;
--- a/src/lib/krb5/keytab/kt_file.c
+++ b/src/lib/krb5/keytab/kt_file.c
@@ -1028,11 +1028,11 @@ typedef krb5_int16  krb5_kt_vno;
 #define krb5_kt_default_vno ((krb5_kt_vno)KRB5_KT_DEFAULT_VNO)
 
 #ifdef ANSI_STDIO
-static char *const fopen_mode_rbplus= "rb+";
-static char *const fopen_mode_rb = "rb";
+static char *const fopen_mode_rbplus= "rb+F";
+static char *const fopen_mode_rb = "rbF";
 #else
-static char *const fopen_mode_rbplus= "r+";
-static char *const fopen_mode_rb = "r";
+static char *const fopen_mode_rbplus= "r+F";
+static char *const fopen_mode_rb = "rF";
 #endif
 
 static krb5_error_code
--- a/src/lib/krb5/keytab/kt_srvtab.c
+++ b/src/lib/krb5/keytab/kt_srvtab.c
@@ -342,9 +342,9 @@ const struct _krb5_kt_ops krb5_kts_ops = {
 #include <stdio.h>
 
 #ifdef ANSI_STDIO
-#define         READ_MODE       "rb"
+#define         READ_MODE       "rbF"
 #else
-#define         READ_MODE       "r"
+#define         READ_MODE       "rF"
 #endif
 
 /* The maximum sizes for V4 aname, realm, sname, and instance +1 */
--- a/src/lib/krb5/os/localaddr.c
+++ b/src/lib/krb5/os/localaddr.c
@@ -368,7 +368,7 @@ get_linux_ipv6_addrs ()
     FILE *f;
 
     /* _PATH_PROCNET_IFINET6 */
-    f = fopen("/proc/net/if_inet6", "r");
+    f = fopen("/proc/net/if_inet6", "rF");
     if (f) {
         char ifname[21];
         unsigned int idx, pfxlen, scope, dadstat;
--- a/src/lib/krb5/os/localauth_k5login.c
+++ b/src/lib/krb5/os/localauth_k5login.c
@@ -116,7 +116,7 @@ userok_k5login(krb5_context context, krb5_localauth_moddata data,
     if (ret)
         goto cleanup;
 
-    fp = fopen(filename, "r");
+    fp = fopen(filename, "rF");
     if (fp == NULL) {
         ret = errno;
         goto cleanup;
--- a/src/lib/krb5/rcache/t_replay.c
+++ b/src/lib/krb5/rcache/t_replay.c
@@ -66,7 +66,7 @@ dump_rcache(const char *filename)
     krb5_int32 usec;
     krb5_timestamp timestamp;
 
-    fp = fopen(filename, "r");
+    fp = fopen(filename, "rF");
     if (!fp) {
         fprintf(stderr, "Can't open filename: %s\n", strerror(errno));
         return;
--- a/src/lib/krb5/unicode/ucdata/ucdata.c
+++ b/src/lib/krb5/unicode/ucdata/ucdata.c
@@ -156,7 +156,7 @@ _ucprop_load(char *paths, int reload)
         _ucprop_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "ctype.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "ctype.dat", "rbF")) == 0)
       return -1;
 
     /*
@@ -337,7 +337,7 @@ _uccase_load(char *paths, int reload)
         _uccase_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "case.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "case.dat", "rbF")) == 0)
       return -1;
 
     /*
@@ -532,7 +532,7 @@ _uccomp_load(char *paths, int reload)
         _uccomp_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "comp.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "comp.dat", "rbF")) == 0)
         return -1;
 
     /*
@@ -730,7 +730,7 @@ _ucdcmp_load(char *paths, int reload)
         _ucdcmp_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "decomp.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "decomp.dat", "rbF")) == 0)
         return -1;
 
     /*
@@ -785,7 +785,7 @@ _uckdcmp_load(char *paths, int reload)
         _uckdcmp_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "kdecomp.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "kdecomp.dat", "rbF")) == 0)
         return -1;
 
     /*
@@ -1042,7 +1042,7 @@ _uccmcl_load(char *paths, int reload)
         _uccmcl_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "cmbcl.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "cmbcl.dat", "rbF")) == 0)
         return -1;
 
     /*
@@ -1138,7 +1138,7 @@ _ucnumb_load(char *paths, int reload)
         _ucnum_size = 0;
     }
 
-    if ((in = _ucopenfile(paths, "num.dat", "rb")) == 0)
+    if ((in = _ucopenfile(paths, "num.dat", "rbF")) == 0)
       return -1;
 
     /*
--- a/src/lib/krb5/unicode/ucdata/ucgendat.c
+++ b/src/lib/krb5/unicode/ucdata/ucgendat.c
@@ -1296,14 +1296,14 @@ write_cdata(char *opath)
      * Open the output file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "uctable.h", opath);
-    if ((out = fopen(path, "w")) == 0)
+    if ((out = fopen(path, "wF")) == 0)
       return;
 #else
     /*
      * Open the ctype.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "ctype.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 #endif
 
@@ -1436,7 +1436,7 @@ write_cdata(char *opath)
      * Open the case.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "case.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 
     /*
@@ -1513,7 +1513,7 @@ write_cdata(char *opath)
      * Open the comp.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "comp.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
 	return;
 
     /*
@@ -1589,7 +1589,7 @@ write_cdata(char *opath)
      * Open the decomp.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "decomp.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 
     hdr[1] = decomps_used;
@@ -1682,7 +1682,7 @@ write_cdata(char *opath)
      * Open the kdecomp.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "kdecomp.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 
     hdr[1] = kdecomps_used;
@@ -1762,7 +1762,7 @@ write_cdata(char *opath)
      * Open the cmbcl.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "cmbcl.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 
     /*
@@ -1836,7 +1836,7 @@ write_cdata(char *opath)
      * Open the num.dat file.
      */
     snprintf(path, sizeof path, "%s" LDAP_DIRSEP "num.dat", opath);
-    if ((out = fopen(path, "wb")) == 0)
+    if ((out = fopen(path, "wbF")) == 0)
       return;
 
     /*
@@ -1908,7 +1908,7 @@ main(int argc, char *argv[])
               case 'x':
                 argc--;
                 argv++;
-                if ((in = fopen(argv[0], "r")) == 0)
+                if ((in = fopen(argv[0], "rF")) == 0)
                   fprintf(stderr,
                           "%s: unable to open composition exclusion file %s\n",
                           prog, argv[0]);
@@ -1924,7 +1924,7 @@ main(int argc, char *argv[])
         } else {
             if (in != stdin && in != NULL)
               fclose(in);
-            if ((in = fopen(argv[0], "r")) == 0)
+            if ((in = fopen(argv[0], "rF")) == 0)
               fprintf(stderr, "%s: unable to open ctype file %s\n",
                       prog, argv[0]);
             else {
--- a/src/lib/rpc/getrpcent.c
+++ b/src/lib/rpc/getrpcent.c
@@ -121,7 +121,7 @@ SETRPCENT_TYPE setrpcent(int f)
 	if (d == 0)
 		return;
 	if (d->rpcf == NULL) {
-		d->rpcf = fopen(RPCDB, "r");
+		d->rpcf = fopen(RPCDB, "rF");
 		if (d->rpcf)
 		    set_cloexec_file(d->rpcf);
 	} else
@@ -160,7 +160,7 @@ getrpcent(void)
 	if (d == 0)
 		return(NULL);
 	if (d->rpcf == NULL) {
-	    if ((d->rpcf = fopen(RPCDB, "r")) == NULL)
+	    if ((d->rpcf = fopen(RPCDB, "rF")) == NULL)
 		return (NULL);
 	    set_cloexec_file(d->rpcf);
 	}
--- a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -57,7 +57,7 @@ void gssrpcint_printf(const char *format, ...)
     {
 	static FILE *f;
 	if (f == NULL)
-	    f = fopen("/dev/pts/4", "a");
+	    f = fopen("/dev/pts/4", "aF");
 	if (f) {
 	    vfprintf(f, format, ap);
 	    fflush(f);
--- a/src/plugins/audit/test/au_test.c
+++ b/src/plugins/audit/test/au_test.c
@@ -54,7 +54,7 @@ static k5_mutex_t lock = K5_MUTEX_PARTIAL_INITIALIZER;
 static krb5_error_code
 open_au(krb5_audit_moddata *auctx)
 {
-    au_fd = fopen("au.log", "a+");
+    au_fd = fopen("au.log", "a+F");
     if (au_fd == NULL)
         return KRB5_PLUGIN_NO_HANDLE; /* audit module is unavailable */
     k5_mutex_init(&lock);
--- a/src/plugins/kdb/db2/adb_openclose.c
+++ b/src/plugins/kdb/db2/adb_openclose.c
@@ -152,12 +152,12 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename,
          * needs be open read/write so that write locking can work with
          * POSIX systems
          */
-        if ((lockp->lockinfo.lockfile = fopen(lockfilename, "r+")) == NULL) {
+        if ((lockp->lockinfo.lockfile = fopen(lockfilename, "r+F")) == NULL) {
             /*
              * maybe someone took away write permission so we could only
              * get shared locks?
              */
-            if ((lockp->lockinfo.lockfile = fopen(lockfilename, "r"))
+            if ((lockp->lockinfo.lockfile = fopen(lockfilename, "rF"))
                 == NULL) {
                 free(db);
                 return OSA_ADB_NOLOCKFILE;
--- a/src/plugins/kdb/db2/libdb2/btree/bt_debug.c
+++ b/src/plugins/kdb/db2/libdb2/btree/bt_debug.c
@@ -66,7 +66,7 @@ __bt_dinit()
 	first = 0;
 
 #ifndef TRACE_TO_STDERR
-	if ((tracefp = fopen("/tmp/__bt_debug", "w")) != NULL)
+	if ((tracefp = fopen("/tmp/__bt_debug", "wF")) != NULL)
 		return;
 #endif
 	tracefp = stderr;
--- a/src/plugins/kdb/db2/libdb2/test/SEQ_TEST/t.c
+++ b/src/plugins/kdb/db2/libdb2/test/SEQ_TEST/t.c
@@ -18,7 +18,7 @@ void main(int argc, char *argv[]) {
   FILE *fopen(), *fin;
 
   unlink("test.db");
-  if ((fin = fopen("data","r")) == NULL) {
+  if ((fin = fopen("data","rF")) == NULL) {
     printf("Unable to open %s\n","data");
     exit(25);
   }
--- a/src/plugins/kdb/db2/libdb2/test/btree.tests/main.c
+++ b/src/plugins/kdb/db2/libdb2/test/btree.tests/main.c
@@ -224,7 +224,7 @@ user(db)
 	int argc, i, last;
 	char *lbuf, *argv[4], buf[512];
 
-	if ((ifp = fopen("/dev/tty", "r")) == NULL) {
+	if ((ifp = fopen("/dev/tty", "rF")) == NULL) {
 		(void)fprintf(stderr,
 		    "/dev/tty: %s\n", strerror(errno));
 		exit(1);
@@ -624,7 +624,7 @@ list(db, argv)
 	FILE *fp;
 	int status;
 
-	if ((fp = fopen(argv[1], "w")) == NULL) {
+	if ((fp = fopen(argv[1], "wF")) == NULL) {
 		(void)fprintf(stderr, "%s: %s\n", argv[1], strerror(errno));
 		return;
 	}
@@ -649,7 +649,7 @@ rlist(db, argv)
 	void *cookie;
 
 	cookie = NULL;
-	if ((fp = fopen(argv[1], "w")) == NULL) {
+	if ((fp = fopen(argv[1], "wF")) == NULL) {
 		(void)fprintf(stderr, "%s: %s\n", argv[1], strerror(errno));
 		return;
 	}
@@ -679,7 +679,7 @@ load(db, argv)
 	char *lp, buf[16 * 1024];
 
 	BUGdb = db;
-	if ((fp = fopen(argv[1], "r")) == NULL) {
+	if ((fp = fopen(argv[1], "rF")) == NULL) {
 		(void)fprintf(stderr, "%s: %s\n", argv[1], strerror(errno));
 		return;
 	}
--- a/src/plugins/kdb/db2/libdb2/test/hash1.tests/tdel.c
+++ b/src/plugins/kdb/db2/libdb2/test/hash1.tests/tdel.c
@@ -103,7 +103,7 @@ char **argv;
 	}
 
 	if ( --argc ) {
-		fp = fopen ( argv[0], "r");
+		fp = fopen ( argv[0], "rF");
 		i = 0;
 		while ( fgets(wp1, 8192, fp) &&
 			fgets(wp2, 8192, fp) &&
--- a/src/plugins/kdb/db2/libdb2/test/hash1.tests/thash4.c
+++ b/src/plugins/kdb/db2/libdb2/test/hash1.tests/thash4.c
@@ -106,7 +106,7 @@ char **argv;
 	}
 
 	if ( --argc ) {
-		fp = fopen ( argv[0], "r");
+		fp = fopen ( argv[0], "rF");
 		i = 0;
 		while ( fgets(wp1, 256, fp) &&
 			fgets(wp2, 8192, fp) &&
--- a/src/plugins/kdb/db2/libdb2/test/hash2.tests/passtest.c
+++ b/src/plugins/kdb/db2/libdb2/test/hash2.tests/passtest.c
@@ -19,8 +19,8 @@ main(void)
     val_line = (char *)malloc(300);
     old = (char *)malloc(300);
 
-    keys = fopen("yp.keys", "rt");
-    vals = fopen("yp.total", "rt");
+    keys = fopen("yp.keys", "rtF");
+    vals = fopen("yp.total", "rtF");
 
     passwd.bsize =  1024;
     passwd.cachesize = 1024 * 1024;
@@ -61,8 +61,8 @@ main(void)
 
 
 
-    keys = fopen("yp.keys", "rt");
-    vals = fopen("yp.total", "rt");
+    keys = fopen("yp.keys", "rtF");
+    vals = fopen("yp.total", "rtF");
     get_key = (char *)malloc(100);
     get_val = (char *)malloc(300);
 
@@ -120,8 +120,8 @@ main(void)
     get_key = (char *)malloc(100);
     key2 = (char *)malloc(100);
 
-    keys = fopen("yp.keys", "rt");
-    vals = fopen("yp.total", "rt");
+    keys = fopen("yp.keys", "rtF");
+    vals = fopen("yp.total", "rtF");
 
     db = dbopen("/usr/tmp/passwd.db", O_RDWR|O_BINARY, 0664, DB_HASH, &passwd);
     n = 0;
@@ -148,8 +148,8 @@ main(void)
     key2 = (char *)malloc(100);
     get_val = (char *)malloc(300);
 
-    keys = fopen("yp.keys", "rt");
-    vals = fopen("yp.total", "rt");
+    keys = fopen("yp.keys", "rtF");
+    vals = fopen("yp.total", "rtF");
 
     db = dbopen("/usr/tmp/passwd.db", O_RDWR|O_BINARY, 0664, DB_HASH, &passwd);
     n = 0;
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
@@ -178,7 +178,7 @@ done:
 
     /* set password in the file */
     old_mode = umask(0177);
-    pfile = fopen(file_name, "a+");
+    pfile = fopen(file_name, "a+F");
     if (pfile == NULL) {
         com_err(me, errno, _("Failed to open file %s: %s"), file_name,
                 strerror (errno));
@@ -230,7 +230,7 @@ done:
         }
 
         omask = umask(077);
-        newfile = fopen(tmp_file, "w");
+        newfile = fopen(tmp_file, "wF");
         umask (omask);
         if (newfile == NULL) {
             com_err(me, errno, _("Error creating file %s"), tmp_file);
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
@@ -87,7 +87,7 @@ krb5_ldap_readpassword(krb5_context context, const char *filename,
 
     *password_out = NULL;
 
-    fp = fopen(filename, "r");
+    fp = fopen(filename, "rF");
     if (fp == NULL) {
         ret = errno;
         k5_setmsg(context, ret, _("Cannot open LDAP password file '%s': %s"),
--- a/src/plugins/locate/python/py-locate.c
+++ b/src/plugins/locate/python/py-locate.c
@@ -98,7 +98,7 @@ my_init(void)
 
     Py_Initialize ();
 //    fprintf(stderr, "trying to load %s\n", SCRIPT_PATH);
-    f = fopen(SCRIPT_PATH, "r");
+    f = fopen(SCRIPT_PATH, "rF");
     if (f == NULL) {
         if (sctx)
             krb5_set_error_message(sctx, -1,
--- a/src/plugins/preauth/otp/otp_state.c
+++ b/src/plugins/preauth/otp/otp_state.c
@@ -96,7 +96,7 @@ read_secret_file(const char *secret_file, char **secret)
         return retval;
     }
 
-    file = fopen(filename, "r");
+    file = fopen(filename, "rF");
     if (file == NULL) {
         retval = errno;
         com_err("otp", retval, "Unable to open secret file '%s'", filename);
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -4281,7 +4281,7 @@ pkinit_get_certs_pkcs12(krb5_context context,
         goto cleanup;
     }
 
-    fp = fopen(idopts->cert_filename, "rb");
+    fp = fopen(idopts->cert_filename, "rbF");
     if (fp == NULL) {
         pkiDebug("Failed to open PKCS12 file '%s', error %d\n",
                  idopts->cert_filename, errno);
--- a/src/plugins/preauth/pkinit/pkinit_lib.c
+++ b/src/plugins/preauth/pkinit/pkinit_lib.c
@@ -365,7 +365,7 @@ print_buffer_bin(unsigned char *buf, unsigned int len, char *filename)
     if (len <= 0 || filename == NULL)
         return;
 
-    if ((f = fopen(filename, "w")) == NULL)
+    if ((f = fopen(filename, "wF")) == NULL)
         return;
 
     set_cloexec_file(f);
--- a/src/plugins/tls/k5tls/openssl.c
+++ b/src/plugins/tls/k5tls/openssl.c
@@ -348,7 +348,7 @@ load_anchor_file(X509_STORE *store, const char *path)
     X509_INFO *xi;
     int i;
 
-    fp = fopen(path, "r");
+    fp = fopen(path, "rF");
     if (fp == NULL)
         return errno;
     sk = PEM_X509_INFO_read(fp, NULL, NULL, NULL);
--- a/src/slave/kpropd.c
+++ b/src/slave/kpropd.c
@@ -1310,7 +1310,7 @@ authorized_principal(krb5_context context, krb5_principal p,
     if (retval)
         return FALSE;
 
-    acl_file = fopen(acl_file_name, "r");
+    acl_file = fopen(acl_file_name, "rF");
     if (acl_file == NULL)
         return FALSE;
 
--- a/src/tests/asn.1/t_trval.c
+++ b/src/tests/asn.1/t_trval.c
@@ -93,7 +93,7 @@ int main(argc, argv)
             }
         } else {
             optflg = 0;
-            if ((fp = fopen(*argv,"r")) == NULL) {
+            if ((fp = fopen(*argv,"rF")) == NULL) {
                 fprintf(stderr,"trval: unable to open %s\n", *argv);
                 continue;
             }
--- a/src/tests/gss-threads/gss-server.c
+++ b/src/tests/gss-threads/gss-server.c
@@ -733,7 +733,7 @@ main(int argc, char **argv)
             if (!strcmp(*argv, "/dev/null")) {
                 logfile = display_file = NULL;
             } else {
-                logfile = fopen(*argv, "a");
+                logfile = fopen(*argv, "aF");
                 display_file = logfile;
                 if (!logfile) {
                     perror(*argv);
--- a/src/util/profile/prof_file.c
+++ b/src/util/profile/prof_file.c
@@ -126,7 +126,7 @@ static int rw_access(const_profile_filespec_t filespec)
      */
     FILE    *f;
 
-    f = fopen(filespec, "r+");
+    f = fopen(filespec, "r+F");
     if (f) {
         fclose(f);
         return 1;
@@ -150,7 +150,7 @@ static int r_access(const_profile_filespec_t filespec)
      */
     FILE    *f;
 
-    f = fopen(filespec, "r");
+    f = fopen(filespec, "rF");
     if (f) {
         fclose(f);
         return 1;
@@ -355,7 +355,7 @@ errcode_t profile_update_file_data_locked(prf_data_t data, char **ret_modspec)
 #endif
     if (!isdir) {
         errno = 0;
-        f = fopen(data->filespec, "r");
+        f = fopen(data->filespec, "rF");
         if (f == NULL)
             return (errno != 0) ? errno : ENOENT;
         set_cloexec_file(f);
@@ -423,7 +423,7 @@ static errcode_t write_data_to_file(prf_data_t data, const char *outfile,
 
     errno = 0;
 
-    f = fopen(new_file, "w");
+    f = fopen(new_file, "wF");
     if (!f) {
         retval = errno;
         if (retval == 0)
--- a/src/util/profile/prof_parse.c
+++ b/src/util/profile/prof_parse.c
@@ -213,7 +213,7 @@ static errcode_t parse_include_file(const char *filename,
     state.root_section = root_section;
     state.current_section = NULL;
 
-    fp = fopen(filename, "r");
+    fp = fopen(filename, "rF");
     if (fp == NULL)
         return PROF_FAIL_INCLUDE_FILE;
     retval = parse_file(fp, &state, NULL);
--- a/src/util/profile/test_parse.c
+++ b/src/util/profile/test_parse.c
@@ -25,7 +25,7 @@ int main(argc, argv)
         exit(1);
     }
 
-    f = fopen(argv[1], "r");
+    f = fopen(argv[1], "rF");
     if (!f) {
         perror(argv[1]);
         exit(1);