New dependency on openat(2) breaks old systems

[McDutchie]

The dependency on openat(2) that was introduced by 3d7b7e1 (#805) breaks the build on older systems that don't have that syscall, at least QNX 6.5.0 and Mac OS X 10.3.7, and likely others.

Turns out openat was not standardised until POSIX Issue 7 (2008), so it's only portable on relatively recent systems.

I would like ksh to continue to work on old systems. This is not just for the geek value of it; old or obscure systems sometimes expose bugs that newer or more common ones hide. The more systems we can test on, the better.

cc @JohnoKing

[JohnoKing]

Below is a patch that should (hopefully) fix that issue. It contains a workaround using open and also quite a few other (poorly tested) fixes I wrote about 2 hours before this issue was posted (the open fix was written just now however).

0001-Improve-usage-of-F_DUPFD_CLOEXEC-O_CLOEXEC-and-opena.patch

From 16a384bc55fa0647e9bcf316094e9b7d989c0ee7 Mon Sep 17 00:00:00 2001
From: Johnothan King <johnothanking@protonmail.com>
Date: Sat, 4 Jan 2025 06:24:50 -0800
Subject: Improve usage of F_DUPFD_CLOEXEC, O_CLOEXEC and openat

- Robustified the ksh codebase's usage and handling of F_DUPFD_CLOEXEC
  and O_CLOEXEC.
- Avoid casting potentially invalid negative file descriptors as
  unsigned in SHOPT_ACCT code.
- Removed redundant openat call. The only purpose of the extra call was
  to check for access permissions (because O_PATH and O_SEARCH skip
  that check). The fchdir call is perfectly capable of doing that
  by itself, so the extra syscall should be avoided.
- Cope with the possibility of sh_diropenat running out of file
  descriptors to use.
- Cope with QNX 6.5.0 and Mac OS X 10.3.7 lacking an implementation of
  openat(2) (hopefully fixes https://github.com/ksh93/ksh/issues/816).
- Incidentally fixed a file descriptor leak in hist_exceptf().
---
 src/cmd/ksh93/Mamfile           |  1 +
 src/cmd/ksh93/bltins/cd_pwd.c   | 71 ++++++++++++++++++++++++---------
 src/cmd/ksh93/edit/history.c    | 51 ++++++++++++++++-------
 src/cmd/ksh93/sh/io.c           | 19 ++++++---
 src/cmd/ksh93/sh/main.c         | 25 ++++++++----
 src/cmd/ksh93/sh/subshell.c     |  6 ++-
 src/cmd/ksh93/sh/xec.c          | 10 +++--
 src/cmd/ksh93/tests/subshell.sh |  2 +-
 src/lib/libast/features/lib     |  2 +-
 src/lib/libast/include/sfio.h   |  1 +
 src/lib/libast/man/sfio.3       |  4 ++
 src/lib/libast/sfio/sfsetfd.c   | 37 +++++++++--------
 12 files changed, 161 insertions(+), 68 deletions(-)

diff --git a/src/cmd/ksh93/Mamfile b/src/cmd/ksh93/Mamfile
index 6a700b16c..f1a02ca8f 100644
--- a/src/cmd/ksh93/Mamfile
+++ b/src/cmd/ksh93/Mamfile
@@ -360,6 +360,7 @@ make install virtual
 			prev include/test.h
 			prev %{INCLUDE_AST}/ls.h
 			prev include/builtins.h
+			prev include/io.h
 			prev include/name.h
 			prev include/path.h
 			prev include/variables.h
diff --git a/src/cmd/ksh93/bltins/cd_pwd.c b/src/cmd/ksh93/bltins/cd_pwd.c
index ac4011cf4..81aca78e1 100644
--- a/src/cmd/ksh93/bltins/cd_pwd.c
+++ b/src/cmd/ksh93/bltins/cd_pwd.c
@@ -33,6 +33,7 @@
 #include	"path.h"
 #include	"name.h"
 #include	"builtins.h"
+#include	"io.h"
 #include	<ls.h>
 #include	"test.h"
 
@@ -51,16 +52,49 @@ static void rehash(Namval_t *np,void *data)
  */
 int sh_diropenat(int dir, const char *path)
 {
-	int fd,shfd;
-	if((fd = openat(dir, path, O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
-#if O_SEARCH
-		if(errno != EACCES || (fd = openat(dir, path, O_SEARCH|O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
+	int fd, needs_cloexec = 0;
+#if _lib_openat
+	if((fd = openat(dir, path, O_DIRECTORY|O_NONBLOCK|O_cloexec|O_SEARCH)) < 0)
+		return fd;
+#else
+	NOT_USED(dir);
+	if((fd = open(path,O_DIRECTORY|O_cloexec|O_SEARCH)) < 0)
+		return fd;
 #endif
-			return fd;
-	/* Move fd to a number > 10 and register the fd number with the shell */
-	shfd = sh_fcntl(fd, F_dupfd_cloexec, 10);
-	close(fd);
-	return shfd;
+
+	if(fd < 10)
+	{
+		/* Move fd to a number >= 10 and register the fd number with the shell */
+		int shfd = sh_fcntl(fd, F_dupfd_cloexec, 10);
+		close(fd);
+		if(shfd < 0)
+		{
+			if(errno==EINVAL)
+			{
+				/*
+				 * Tell cd we ran out of file descriptors. (EINVAL by itself
+				 * is too vague to be differentiated from a failure in
+				 * openat utilizing that same errno.)
+				 */
+				errno = ENOTTY;
+			}
+			return shfd;
+		}
+#if F_dupfd_cloexec == F_DUPFD
+		needs_cloexec = 1;
+#endif
+		fd = shfd;
+	}
+#if !O_cloexec
+	else
+		needs_cloexec = 1;
+#endif
+	if(needs_cloexec)
+	{
+		fcntl(fd,F_SETFD,FD_CLOEXEC);
+		sh.fdstatus[fd] |= IOCLEX;
+	}
+	return fd;
 }
 
 int	b_cd(int argc, char *argv[],Shbltin_t *context)
@@ -211,10 +245,8 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 			}
 			sh_close(newdirfd);
 		}
-#if !O_SEARCH
-		else if((rval=chdir(cp)) >= 0)
-			sh_pwdupdate(sh_diropenat(AT_FDCWD,cp));
-#endif
+		else if((O_SEARCH==0 || errno==ENOTTY) && (rval=chdir(cp)) >= 0)
+			sh_pwdupdate(errno==ENOTTY?-1:sh_diropenat(AT_FDCWD,cp));
 		if(saverrno==0)
 			saverrno=errno;
 	}
@@ -232,14 +264,17 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 			}
 			sh_close(newdirfd);
 		}
-#if !O_SEARCH
-		else if((rval=chdir(dir)) >= 0)
-			sh_pwdupdate(sh_diropenat(AT_FDCWD,dir));
-#endif
+		else if((O_SEARCH==0 || errno==ENOTTY) && (rval=chdir(cp)) >= 0)
+			sh_pwdupdate(errno==ENOTTY?-1:sh_diropenat(AT_FDCWD,cp));
 	}
 	if(rval<0)
 	{
-		if(saverrno)
+		if(saverrno==ENOTTY)
+		{
+			errno = EINVAL;
+			errormsg(SH_DICT,ERROR_system(ret),e_toomany);
+		}
+		else if(saverrno)
 			errno = saverrno;
 		errormsg(SH_DICT,ERROR_system(ret),"%s:",dir);
 		UNREACHABLE();
diff --git a/src/cmd/ksh93/edit/history.c b/src/cmd/ksh93/edit/history.c
index 840a1fb8c..a3dd6a4ea 100644
--- a/src/cmd/ksh93/edit/history.c
+++ b/src/cmd/ksh93/edit/history.c
@@ -110,6 +110,7 @@ static History_t *hist_ptr;
     static int  acctinit(History_t *hp)
     {
 	char *cp, *acctfile;
+	int needs_cloexec = 1;
 	Namval_t *np = nv_search("ACCTFILE",sh.var_tree,0);
 
 	if(!np || !(acctfile=nv_getval(np)))
@@ -123,15 +124,16 @@ static History_t *hist_ptr;
 			cp = "unknown";
 	}
 	logname = sh_strdup(cp);
-	if((acctfd=sh_open(acctfile,
-		O_BINARY|O_WRONLY|O_APPEND|O_CREAT,S_IRUSR|S_IWUSR))>=0 &&
-	    (unsigned)acctfd < 10)
+	if((acctfd=sh_open(acctfile,O_BINARY|O_WRONLY|O_APPEND|O_CREAT|O_cloexec,S_IRUSR|S_IWUSR))>=0 && acctfd < 10)
 	{
 		int n;
 		if((n = sh_fcntl(acctfd, F_dupfd_cloexec, 10)) >= 0)
 		{
 			sh_close(acctfd);
 			acctfd = n;
+#if F_dupfd_cloexec != FD_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 	}
 	if(acctfd < 0)
@@ -139,13 +141,17 @@ static History_t *hist_ptr;
 		acctfd = 0;
 		return 0;
 	}
+#if O_cloexec
+	else if(acctfd < 10)
+		needs_cloexec = 0;
+#endif
 	if(sh_isdevfd(acctfile))
 	{
 		char newfile[16];
 		sfsprintf(newfile,sizeof(newfile),"%.8s%d\0",e_devfdNN,acctfd);
 		nv_putval(np,newfile,NV_RDONLY);
 	}
-	else
+	else if(needs_cloexec)
 		fcntl(acctfd,F_SETFD,FD_CLOEXEC);
 	return 1;
     }
@@ -205,7 +211,7 @@ int  sh_histinit(void)
 	History_t *hp;
 	char *histname;
 	char *fname=0;
-	int histmask, maxlines, hist_start=0;
+	int histmask, maxlines, hist_start=0, needs_cloexec=1, n;
 	char *cp;
 	off_t hsize = 0;
 
@@ -225,16 +231,16 @@ retry:
 	if(!histinit)
 		histmode = S_IRUSR|S_IWUSR;
 	if((fd=open(cp,O_BINARY|O_APPEND|O_RDWR|O_CREAT|O_cloexec,histmode))>=0)
-	{
 		hsize=lseek(fd,0,SEEK_END);
-	}
-	if((unsigned)fd < 10)
+	if(fd > 0 && fd < 10)
 	{
-		int n;
 		if((n=sh_fcntl(fd,F_dupfd_cloexec,10))>=0)
 		{
 			sh_close(fd);
 			fd=n;
+#if F_dupfd_cloexec != F_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 	}
 	/* make sure that file has history file format */
@@ -253,13 +259,17 @@ retry:
 		{
 			if(!(fname = pathtmp(NULL,0,0,NULL)))
 				return 0;
-			fd = open(fname,O_BINARY|O_APPEND|O_CREAT|O_RDWR,S_IRUSR|S_IWUSR|O_cloexec);
+			fd = open(fname,O_BINARY|O_APPEND|O_CREAT|O_RDWR|O_cloexec,S_IRUSR|S_IWUSR);
 		}
 	}
 	if(fd<0)
 		return 0;
-	/* set the file to close-on-exec */
-	fcntl(fd,F_SETFD,FD_CLOEXEC);
+#if O_cloexec
+	if(fd < 10)
+		needs_cloexec = 0;
+#endif
+	if(needs_cloexec)
+		fcntl(fd,F_SETFD,FD_CLOEXEC);  /* set the file to close-on-exec */
 	if(cp=nv_getval(HISTSIZE))
 	{
 		intmax_t m = strtoll(cp, NULL, 10);
@@ -342,19 +352,27 @@ retry:
 		hp->auditfp = 0;
 		if(sh_isstate(SH_INTERACTIVE) && (hp->auditmask=sh_checkaudit(hp,SHOPT_AUDITFILE, buff, sizeof(buff))))
 		{
+			needs_cloexec = 1;
 			if((fd=sh_open(buff,O_BINARY|O_WRONLY|O_APPEND|O_CREAT|O_cloexec,S_IRUSR|S_IWUSR))>=0 && fd < 10)
 			{
-				int n;
 				if((n = sh_fcntl(fd,F_dupfd_cloexec, 10)) >= 0)
 				{
 					sh_close(fd);
 					fd = n;
+#if F_dupfd_cloexec != F_DUPFD
+					needs_cloexec = 0;
+#endif
 				}
 			}
+#if O_cloexec
+			if(fd < 10)
+				needs_cloexec = 0;
+#endif
 			if(fd>=0)
 			{
 				const char *tty;
-				fcntl(fd,F_SETFD,FD_CLOEXEC);
+				if(needs_cloexec)
+					fcntl(fd,F_SETFD,FD_CLOEXEC);
 				tty = ttyname(2);
 				hp->tty = sh_strdup(tty?tty:"notty");
 				hp->auditfp = sfnew(NULL,NULL,-1,fd,SFIO_WRITE);
@@ -1114,8 +1132,13 @@ static int hist_exceptf(Sfio_t* fp, int type, void *data, Sfdisc_t *handle)
 		if((newfd=open(hp->histname,O_BINARY|O_APPEND|O_CREAT|O_RDWR|O_cloexec,S_IRUSR|S_IWUSR)) >= 0)
 		{
 			if(sh_fcntl(newfd, F_dupfd_cloexec, oldfd) != oldfd)
+			{
+				close(newfd);
 				return -1;
+			}
+#if F_dupfd_cloexec == F_DUPFD
 			fcntl(oldfd,F_SETFD,FD_CLOEXEC);
+#endif
 			close(newfd);
 			if(lseek(oldfd,0,SEEK_END) < hp->histcnt)
 			{
diff --git a/src/cmd/ksh93/sh/io.c b/src/cmd/ksh93/sh/io.c
index 5046dcd6d..7a3dccd32 100644
--- a/src/cmd/ksh93/sh/io.c
+++ b/src/cmd/ksh93/sh/io.c
@@ -1702,7 +1702,7 @@ void sh_iosave(int origfd, int oldtop, char *name)
 		savefd = -1;
 	else
 	{
-		if((savefd = sh_fcntl(origfd, F_DUPFD, 10)) < 0 && errno!=EBADF)
+		if((savefd = sh_fcntl(origfd, F_dupfd_cloexec, 10)) < 0 && errno!=EBADF)
 		{
 			sh.toomany=1;
 			((struct checkpt*)sh.jmplist)->mode = SH_JMPERREXIT;
@@ -1717,8 +1717,10 @@ void sh_iosave(int origfd, int oldtop, char *name)
 	if(savefd >=0)
 	{
 		Sfio_t* sp = sh.sftable[origfd];
+#if F_dupfd_cloexec == F_DUPFD
 		/* make saved file close-on-exec */
 		sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);
+#endif
 		if(origfd==job.fd)
 			job.fd = savefd;
 		sh.fdstatus[savefd] = sh.fdstatus[origfd];
@@ -2251,10 +2253,7 @@ static void	sftrack(Sfio_t* sp, int flag, void* data)
 		return;
 	mode = sfset(sp,0,0);
 	if(sp==sh.heredocs && fd < 10 && flag==SFIO_SETFD)
-	{
-		fd = sfsetfd(sp,10);
-		fcntl(fd,F_SETFD,FD_CLOEXEC);
-	}
+		fd = sfsetfd_cloexec(sp,10);
 	if(fd < 3)
 		return;
 	if(flag==SFIO_NEW)
@@ -2564,11 +2563,21 @@ int sh_fcntl(int fd, int op, ...)
 	if(newfd>=0) switch(op)
 	{
 	    case F_DUPFD:
+#if F_dupfd_cloexec != F_DUPFD
+	    case F_dupfd_cloexec:
+#endif
 		if(sh.fdstatus[fd] == IOCLOSE)
 			sh.fdstatus[fd] = 0;
 		if(newfd>=sh.lim.open_max)
 			sh_iovalidfd(newfd);
+#if F_dupfd_cloexec != F_DUPFD
+		if(op==F_DUPFD)
+			sh.fdstatus[newfd] = (sh.fdstatus[fd]&~IOCLEX);
+		else
+			sh.fdstatus[newfd] = (sh.fdstatus[fd]|IOCLEX);
+#else
 		sh.fdstatus[newfd] = (sh.fdstatus[fd]&~IOCLEX);
+#endif
 		if(fdnotify)
 			(*fdnotify)(fd,newfd);
 		break;
diff --git a/src/cmd/ksh93/sh/main.c b/src/cmd/ksh93/sh/main.c
index 2cfe64068..8b4e2c5fc 100644
--- a/src/cmd/ksh93/sh/main.c
+++ b/src/cmd/ksh93/sh/main.c
@@ -363,15 +363,26 @@ static void	exfile(Sfio_t *iop,int fno)
 	{
 		if(fno > 0)
 		{
-			int r;
-			if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))
+			int needs_cloexec = 1;
+			if(fno < 10)
 			{
-				sh.fdstatus[r] = sh.fdstatus[fno];
-				sh_close(fno);
-				fno = r;
+				int r;
+				r = sh_fcntl(fno,F_dupfd_cloexec,10);
+				if(r >= 10)
+				{
+					sh.fdstatus[r] = sh.fdstatus[fno];
+					sh_close(fno);
+					fno = r;
+				}
+#if F_dupfd_cloexec != FD_DUPFD
+				needs_cloexec = 0;
+#endif
+			}
+			if(needs_cloexec)
+			{
+				fcntl(fno,F_SETFD,FD_CLOEXEC);
+				sh.fdstatus[fno] |= IOCLEX;
 			}
-			fcntl(fno,F_SETFD,FD_CLOEXEC);
-			sh.fdstatus[fno] |= IOCLEX;
 			iop = sh_iostream(fno);
 		}
 		else
diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
index aaf998b0d..1287d5b2e 100644
--- a/src/cmd/ksh93/sh/subshell.c
+++ b/src/cmd/ksh93/sh/subshell.c
@@ -101,10 +101,12 @@ void	sh_subtmpfile(void)
 		struct checkpt	*pp = (struct checkpt*)sh.jmplist;
 		struct subshell *sp = subshell_data->pipe;
 		/* save file descriptor 1 if open */
-		if((sp->tmpfd = fd = sh_fcntl(1,F_DUPFD,10)) >= 0)
+		if((sp->tmpfd = fd = sh_fcntl(1,F_dupfd_cloexec,10)) >= 0)
 		{
+#if F_dupfd_cloexec == F_DUPFD
 			fcntl(fd,F_SETFD,FD_CLOEXEC);
-			sh.fdstatus[fd] = sh.fdstatus[1]|IOCLEX;
+			sh.fdstatus[fd] |= IOCLEX;
+#endif
 			close(1);
 		}
 		else if(errno!=EBADF)
diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
index f8ab80fe5..e022b1427 100644
--- a/src/cmd/ksh93/sh/xec.c
+++ b/src/cmd/ksh93/sh/xec.c
@@ -3219,24 +3219,28 @@ static void coproc_init(int pipes[])
 	sh.cpid = 0;
 	if(sh.cpipe[0]<=0 || sh.cpipe[1]<=0)
 	{
+		int needs_cloexec = 1;
 		/* first co-process */
 		sh_pclose(sh.cpipe);
 		sh_pipe(sh.cpipe);
 		if((outfd=sh.cpipe[1]) < 10)
 		{
-		        int fd=sh_fcntl(sh.cpipe[1],F_DUPFD,10);
+		        int fd=sh_fcntl(sh.cpipe[1],F_dupfd_cloexec,10);
 			if(fd>=10)
 			{
-			        sh.fdstatus[fd] = (sh.fdstatus[outfd]&~IOCLEX);
+				sh.fdstatus[fd] |= sh.fdstatus[outfd];
 				close(outfd);
 			        sh.fdstatus[outfd] = IOCLOSE;
 				sh.cpipe[1] = fd;
 			}
+#if F_dupfd_cloexec != F_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 		if(fcntl(*sh.cpipe,F_SETFD,FD_CLOEXEC)>=0)
 			sh.fdstatus[sh.cpipe[0]] |= IOCLEX;
 		sh.fdptrs[sh.cpipe[0]] = sh.cpipe;
-		if(fcntl(sh.cpipe[1],F_SETFD,FD_CLOEXEC) >=0)
+		if(needs_cloexec && fcntl(sh.cpipe[1],F_SETFD,FD_CLOEXEC) >=0)
 			sh.fdstatus[sh.cpipe[1]] |= IOCLEX;
 	}
 	sh.outpipe = sh.cpipe;
diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
index 7132949ae..911ee07a5 100755
--- a/src/cmd/ksh93/tests/subshell.sh
+++ b/src/cmd/ksh93/tests/subshell.sh
@@ -607,7 +607,7 @@ then    integer i
 	for ((i=11; i < 29; i++))
 	do      if      ! [[ -r /dev/fd/$i  || -w /dev/fd/$i ]]
 		then    a=$($SHELL -c "[[ -r /dev/fd/$i || -w /dev/fd/$i ]]")
-			(( $? )) || err_exit "file descriptor $i not close on exec"
+			(( $? )) || err_exit "file descriptor $i not close-on-exec"
 		fi
 	done
 fi
diff --git a/src/lib/libast/features/lib b/src/lib/libast/features/lib
index d11a46071..d60c5051b 100644
--- a/src/lib/libast/features/lib
+++ b/src/lib/libast/features/lib
@@ -31,7 +31,7 @@ lib	gethostname,getpagesize,getrlimit,getuniverse
 lib	glob,iswblank,iswctype,killpg,link,localeconv,madvise
 lib	mbtowc,mbrtowc,memalign,memdup
 lib	mkdir,mkfifo,mktemp,mktime
-lib	mount,opendir,pathconf
+lib	mount,openat,opendir,pathconf
 lib	readlink,remove,rename,rewinddir,rmdir,setlocale
 lib	setpgrp,setpgrp2,setreuid,setuid
 lib	socketpair
diff --git a/src/lib/libast/include/sfio.h b/src/lib/libast/include/sfio.h
index f608da2f6..87f4f3093 100644
--- a/src/lib/libast/include/sfio.h
+++ b/src/lib/libast/include/sfio.h
@@ -203,6 +203,7 @@ extern int		sfraise(Sfio_t*, int, void*);
 extern int		sfnotify(void(*)(Sfio_t*, int, void*));
 extern int		sfset(Sfio_t*, int, int);
 extern int		sfsetfd(Sfio_t*, int);
+extern int		sfsetfd_cloexec(Sfio_t*, int);
 extern Sfio_t*		sfpool(Sfio_t*, Sfio_t*, int);
 extern ssize_t		sfread(Sfio_t*, void*, size_t);
 extern ssize_t		sfwrite(Sfio_t*, const void*, size_t);
diff --git a/src/lib/libast/man/sfio.3 b/src/lib/libast/man/sfio.3
index 6c8ff68e5..00173cc88 100644
--- a/src/lib/libast/man/sfio.3
+++ b/src/lib/libast/man/sfio.3
@@ -190,6 +190,7 @@ SFIO_EVENT
 int        sfresize(Sfio_t* f, Sfoff_t size);
 int        sfset(Sfio_t* f, int flags, int i);
 int        sfsetfd(Sfio_t* f, int fd);
+int        sfsetfd_cloexec(Sfio_t* f, int fd);
 Sfio_t*    sfstack(Sfio_t* base, Sfio_t* top);
 char*      sfstruse(Sfio_t *f);
 Sfio_t*    sfswap(Sfio_t* f1, Sfio_t* f2);
@@ -1758,6 +1759,9 @@ Then, except for \f3sfclose()\fP, the stream will be inaccessible
 until a future \f3sfsetfd()\fP call resets the file descriptor to a non-negative value.
 Thus, \f3sfsetfd(f,-1)\fP can be used to avoid closing the file descriptor
 of \f3f\fP when \f3f\fP is closed.
+.Ss "  int sfsetfd_cloexec(Sfio_t* f, int fd)"
+This function is identical to \f3sfsetfd()\fP, with the exception that it will
+give duplicated file descriptors the close-on-exec flag.
 .Ss "  Sfio_t* sfstack(Sfio_t* base, Sfio_t* top)"
 This function stacks or unstacks stream.
 Every stream stack is identified by a base stream
diff --git a/src/lib/libast/sfio/sfsetfd.c b/src/lib/libast/sfio/sfsetfd.c
index 3f24d81c2..d48722ede 100644
--- a/src/lib/libast/sfio/sfsetfd.c
+++ b/src/lib/libast/sfio/sfsetfd.c
@@ -23,30 +23,23 @@
 **	Written by Kiem-Phong Vo.
 */
 
-static int _sfdup(int fd, int newfd)
+static int _sfdup(int fd, int newfd, int cloexec)
 {
 	int	dupfd;
 
-#ifdef F_DUPFD	/* the simple case */
+#if F_dupfd_cloexec == F_DUPFD
 	while((dupfd = fcntl(fd,F_DUPFD,newfd)) < 0 && errno == EINTR)
 		errno = 0;
-	return dupfd;
-
-#else	/* do it the hard way */
-	if((dupfd = dup(fd)) < 0 || dupfd >= newfd)
-		return dupfd;
-
-	/* dup() succeeded but didn't get the right number, recurse */
-	newfd = _sfdup(fd,newfd);
-
-	/* close the one that didn't match */
-	CLOSE(dupfd);
-
-	return newfd;
+	if(cloexec && dupfd > -1)
+		fcntl(dupfd,F_SETFD,FD_CLOEXEC);
+#else
+	while((dupfd = fcntl(fd,cloexec?F_dupfd_cloexec:F_DUPFD,newfd)) < 0 && errno == EINTR)
+		errno = 0;
 #endif
+	return dupfd;
 }
 
-int sfsetfd(Sfio_t* f, int newfd)
+static int sfsetfd_internal(Sfio_t* f, int newfd, int cloexec)
 {
 	int		oldfd;
 
@@ -70,7 +63,7 @@ int sfsetfd(Sfio_t* f, int newfd)
 		oldfd = f->file;
 		if(oldfd >= 0)
 		{	if(newfd >= 0)
-			{	if((newfd = _sfdup(oldfd,newfd)) < 0)
+			{	if((newfd = _sfdup(oldfd,newfd,cloexec)) < 0)
 				{	SFOPEN(f,0);
 					return -1;
 				}
@@ -119,3 +112,13 @@ int sfsetfd(Sfio_t* f, int newfd)
 
 	return newfd;
 }
+
+int sfsetfd(Sfio_t* f, int newfd)
+{
+	return sfsetfd_internal(f, newfd, 0);
+}
+
+int sfsetfd_cloexec(Sfio_t* f, int newfd)
+{
+	return sfsetfd_internal(f, newfd, 1);
+}
-- 
2.47.1

[McDutchie]

The patch unfortunately does not fix the build on old systems; it still fails in cd_pwd.c on a nonexistent symbol AT_FDCWD which is part of the openat spec.

Also (forgive me as I'm still wrapping my head around this), doesn't falling back to open instead of openat introduce a race condition? Isn't the point of openat to avoid that?

The 93v- beta, as per the open-ast-archive repo, takes a whole different approach again -- it adds a whole new set of AST versions of many system functions, including openat, in src/lib/libast/port/intercept.c and src/lib/libast/include/ast_intercept.h. I don't think I want to backport all that -- even if it doesn't come with its own bugs, it's a whole new thing to maintain.

My current thinking is that improved performance, while great to have, is non-essential for old systems. The important thing for old systems is that ksh keeps building and running. The old code performs worse, but is well debugged and tested by now.

So I think the safest way to go is to add a lib feature test for openat, and restore the old subshell and cd code, building it conditional upon !_lib_openat. I'm working on a patch for that now.

That doesn't mean it's all set in stone now. A new approach can still be considered for the dev branch later. For the 1.0 branch I think we need to go the safe route in any case.

[McDutchie]

So I think the safest way to go is to add a lib feature test for openat, and restore the old subshell and cd code, building it conditional upon !_lib_openat. I'm working on a patch for that now.

Here it is. Tested, so far, on Mac OS X 10.3.7 (PowerPC).

Patch v1

diff --git a/src/cmd/ksh93/bltins/cd_pwd.c b/src/cmd/ksh93/bltins/cd_pwd.c
index ac4011cf..f8cd566e 100644
--- a/src/cmd/ksh93/bltins/cd_pwd.c
+++ b/src/cmd/ksh93/bltins/cd_pwd.c
@@ -46,6 +46,7 @@ static void rehash(Namval_t *np,void *data)
 		nv_rehash(np,data);
 }
 
+#if _lib_openat
 /*
  * Obtain a file handle to the directory "path" relative to directory "dir"
  */
@@ -62,6 +63,7 @@ int sh_diropenat(int dir, const char *path)
 	close(fd);
 	return shfd;
 }
+#endif /* _lib_openat */
 
 int	b_cd(int argc, char *argv[],Shbltin_t *context)
 {
@@ -70,9 +72,11 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 	const char *dp;
 	int saverrno=0;
 	int rval,pflag=0,eflag=0,ret=1;
-	int newdirfd;
 	char *oldpwd, *cp;
 	Namval_t *opwdnod, *pwdnod;
+#if _lib_openat
+	int newdirfd;
+#endif /* _lib_openat */
 	NOT_USED(context);
 	while((rval = optget(argv,sh_optcd))) switch(rval)
 	{
@@ -136,8 +140,13 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 	 * If sh_subshell() in subshell.c cannot use fchdir(2) to restore the PWD using a saved file descriptor,
 	 * we must fork any virtual subshell now to avoid the possibility of ending up in the wrong PWD on exit.
 	 */
+#if _lib_openat
 	if(sh.subshell && !sh.subshare && (!sh_validate_subpwdfd() || !test_inode(sh.pwd,e_dot)))
 		sh_subfork();
+#else
+	if(sh.subshell && !sh.subshare && !test_inode(sh.pwd,e_dot))
+		sh_subfork();
+#endif /* _lib_openat */
 	/*
 	 * Do $CDPATH processing, except if the path is absolute or the first component is '.' or '..'
 	 */
@@ -157,7 +166,6 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 	if(*dir!='/')
 	{
 		/* check for leading .. */
-		char *cp;
 		sfprintf(sh.strbuf,"%s",dir);
 		cp = sfstruse(sh.strbuf);
 		pathcanon(cp, 0);
@@ -199,6 +207,7 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 				if(!pathcanon(cp,PATH_DOTDOT))
 					continue;
 		}
+#if _lib_openat
 		cp = path_relative(stkptr(sh.stk,PATH_OFFSET));
 		rval = newdirfd = sh_diropenat((sh.pwdfd>0)?sh.pwdfd:AT_FDCWD,cp);
 		if(newdirfd>0)
@@ -217,10 +226,17 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 #endif
 		if(saverrno==0)
 			saverrno=errno;
+#else
+		if((rval=chdir(path_relative(stkptr(sh.stk,PATH_OFFSET)))) >= 0)
+			goto success;
+		if(errno!=ENOENT && saverrno==0)
+			saverrno=errno;
+#endif /* _lib_openat */
 	}
 	while(cdpath);
 	if(rval<0 && *dir=='/' && *(path_relative(stkptr(sh.stk,PATH_OFFSET)))!='/')
 	{
+#if _lib_openat
 		rval = newdirfd = sh_diropenat((sh.pwdfd>0)?sh.pwdfd:AT_FDCWD,dir);
 		if(newdirfd>0)
 		{
@@ -236,6 +252,9 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 		else if((rval=chdir(dir)) >= 0)
 			sh_pwdupdate(sh_diropenat(AT_FDCWD,dir));
 #endif
+#else
+		rval = chdir(dir);
+#endif /* _lib_openat */
 	}
 	if(rval<0)
 	{
diff --git a/src/cmd/ksh93/include/defs.h b/src/cmd/ksh93/include/defs.h
index fa77e71b..7e36c885 100644
--- a/src/cmd/ksh93/include/defs.h
+++ b/src/cmd/ksh93/include/defs.h
@@ -114,7 +114,6 @@ extern char		*sh_checkid(char*,char*);
 extern void		sh_chktrap(void);
 extern void		sh_deparse(Sfio_t*,const Shnode_t*,int,int);
 extern int		sh_debug(const char*,const char*,const char*,char *const[],int);
-extern int		sh_diropenat(int,const char *);
 extern char 		**sh_envgen(void);
 extern Sfdouble_t	sh_arith(const char*);
 extern void		*sh_arithcomp(char*);
@@ -142,8 +141,6 @@ extern Dt_t		*sh_subfuntree(int);
 extern void		sh_subjobcheck(pid_t);
 extern int		sh_subsavefd(int);
 extern void		sh_subtmpfile(void);
-extern void		sh_pwdupdate(int);
-extern int		sh_validate_subpwdfd(void);
 extern char 		*sh_substitute(const char*,const char*,char*);
 extern void		sh_timetraps(void);
 extern const char	*_sh_translate(const char*);
@@ -151,6 +148,11 @@ extern int		sh_trace(char*[],int);
 extern void		sh_trim(char*);
 extern int		sh_type(const char*);
 extern void             sh_unscope(void);
+#if _lib_openat
+    extern int		sh_diropenat(int,const char *);
+    extern void		sh_pwdupdate(int);
+    extern int		sh_validate_subpwdfd(void);
+#endif /* _lib_openat */
 #if SHOPT_NAMESPACE
     extern Namval_t	*sh_fsearch(const char *,int);
 #endif /* SHOPT_NAMESPACE */
diff --git a/src/cmd/ksh93/include/shell.h b/src/cmd/ksh93/include/shell.h
index cf642fc2..1d87a36c 100644
--- a/src/cmd/ksh93/include/shell.h
+++ b/src/cmd/ksh93/include/shell.h
@@ -372,7 +372,9 @@ struct Shell_s
 	Sfio_t		**sftable;
 	unsigned char	*fdstatus;
 	char		*pwd;
+#if _lib_openat
 	int		pwdfd;		/* file descriptor for pwd */
+#endif /* _lib_openat */
 	void		*jmpbuffer;
 	void		*mktype;
 	Sfio_t		*strbuf;
diff --git a/src/cmd/ksh93/sh/fault.c b/src/cmd/ksh93/sh/fault.c
index 0de0cd9e..d20df057 100644
--- a/src/cmd/ksh93/sh/fault.c
+++ b/src/cmd/ksh93/sh/fault.c
@@ -687,8 +687,10 @@ noreturn void sh_done(int sig)
 	if(sh_isoption(SH_NOEXEC))
 		kiaclose((Lex_t*)sh.lex_context);
 #endif /* SHOPT_KIA */
+#if _lib_openat
 	if(sh.pwdfd > 0)
 		close(sh.pwdfd);
+#endif /* _lib_openat */
 	/* Exit with portable 8-bit status (128 + signum) if last child process exits due to signal */
 	if(sh.chldexitsig)
 		savxit = savxit & ~SH_EXITSIG | 0200;
diff --git a/src/cmd/ksh93/sh/path.c b/src/cmd/ksh93/sh/path.c
index 70c0d284..9c2bd83a 100644
--- a/src/cmd/ksh93/sh/path.c
+++ b/src/cmd/ksh93/sh/path.c
@@ -249,8 +249,10 @@ char *path_pwd(void)
 	if(!tofree)
 		cp = sh_strdup(cp);
 	sh.pwd = cp;
+#if _lib_openat
 	/* Set sh.pwdfd */
 	sh_pwdupdate(sh_diropenat(AT_FDCWD,cp));
+#endif /* _lib_openat */
 	return sh.pwd;
 }
 
diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
index aaf998b0..ec45997e 100644
--- a/src/cmd/ksh93/sh/subshell.c
+++ b/src/cmd/ksh93/sh/subshell.c
@@ -85,6 +85,9 @@ static struct subshell
 	char		rand_state;         /* 0 means sp->rand_seed hasn't been set, 1 is the opposite */
 	uint32_t	srand_upper_bound;  /* parent shell's upper bound for $SRANDOM */
 	int		pwdfd;              /* parent shell's file descriptor for PWD */
+#if !_lib_openat
+	char		pwdclose;
+#endif /* !_lib_openat */
 } *subshell_data;
 
 static unsigned int subenv;
@@ -446,6 +449,8 @@ void sh_subjobcheck(pid_t pid)
 	}
 }
 
+#if _lib_openat
+
 /*
  * Set the file descriptor for the current shell's PWD without wiping
  * out the stored file descriptor for the parent shell's PWD.
@@ -468,6 +473,8 @@ int sh_validate_subpwdfd(void)
 	return sp->pwdfd > 0;
 }
 
+#endif /* _lib_openat */
+
 /*
  * Run command tree <t> in a virtual subshell
  * If comsub is not null, then output will be placed in temp file (or buffer)
@@ -516,6 +523,10 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 		path_get(e_dot);
 		sh.pathinit = 0;
 	}
+#if !_lib_openat
+	if(!sh.pwd)
+		path_pwd();
+#endif /* !_lib_openat */
 	sp->bckpid = sh.bckpid;
 	if(comsub)
 		sh_stats(STAT_COMSUB);
@@ -531,8 +542,40 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 	if(!sh.subshare)
 	{
 		char *save_debugtrap = 0;
+#if _lib_openat
 		sp->pwd = sh_strdup(sh.pwd);
 		sp->pwdfd = sh.pwdfd;
+#else
+		struct subshell *xp;
+		sp->pwdfd = -1;
+		for(xp=sp->prev; xp; xp=xp->prev)
+		{
+			if(xp->pwdfd>0 && xp->pwd && strcmp(xp->pwd,sh.pwd)==0)
+			{
+				sp->pwdfd = xp->pwdfd;
+				break;
+			}
+		}
+		if(sp->pwdfd<0)
+		{
+			int n = open(e_dot,O_SEARCH);
+			if(n>=0)
+			{
+				sp->pwdfd = n;
+				if(n<10)
+				{
+					sp->pwdfd = sh_fcntl(n,F_DUPFD,10);
+					close(n);
+				}
+				if(sp->pwdfd>0)
+				{
+					fcntl(sp->pwdfd,F_SETFD,FD_CLOEXEC);
+					sp->pwdclose = 1;
+				}
+			}
+		}
+		sp->pwd = (sh.pwd?sh_strdup(sh.pwd):0);
+#endif /* _lib_openat */
 		sp->mask = sh.mask;
 		sh_stats(STAT_SUBSHELL);
 		/* save trap table */
@@ -606,6 +649,10 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 		if(sh.savesig < 0)
 		{
 			sh.savesig = 0;
+#if !_lib_openat
+			if(sp->pwdfd < 0 && !sh.subshare)	/* if we couldn't get a file descriptor to our PWD ... */
+				sh_subfork();			/* ...we have to fork, as we cannot fchdir back to it. */
+#endif /* !_lib_openat */
 			/* Virtual subshells are not safe to suspend (^Z, SIGTSTP) in the interactive main shell. */
 			if(sh_isstate(SH_INTERACTIVE))
 			{
@@ -789,6 +836,7 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 			free(savsig);
 		}
 		sh.options = sp->options;
+#if _lib_openat
 		if(sh.pwdfd != sp->pwdfd)
 		{
 			/*
@@ -811,6 +859,20 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 				sh_pwdupdate(sp->pwdfd);
 		}
 		free(sh.pwd);
+#else
+		/* restore the present working directory */
+		if(sp->pwdfd > 0 && fchdir(sp->pwdfd) < 0)
+		{
+			saveerrno = errno;
+			fatalerror = 2;
+		}
+		else if(sp->pwd && strcmp(sp->pwd,sh.pwd))
+			path_newdir(sh.pathlist);
+		if(sh.pwd)
+			free(sh.pwd);
+		if(sp->pwdclose)
+			close(sp->pwdfd);
+#endif /* _lib_openat */
 		sh.pwd = sp->pwd;
 		if(sp->mask!=sh.mask)
 			umask(sh.mask=sp->mask);
@@ -887,7 +949,12 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 				UNREACHABLE();
 			case 2:
 				/* reinit PWD as it will be wrong */
+#if _lib_openat
 				free(sh.pwd);
+#else
+				if(sh.pwd)
+					free(sh.pwd);
+#endif /* _lib_openat */
 				sh.pwd = NULL;
 				path_pwd();
 				errno = saveerrno;
diff --git a/src/lib/libast/features/lib b/src/lib/libast/features/lib
index d11a4607..c3cdb61a 100644
--- a/src/lib/libast/features/lib
+++ b/src/lib/libast/features/lib
@@ -31,7 +31,7 @@ lib	gethostname,getpagesize,getrlimit,getuniverse
 lib	glob,iswblank,iswctype,killpg,link,localeconv,madvise
 lib	mbtowc,mbrtowc,memalign,memdup
 lib	mkdir,mkfifo,mktemp,mktime
-lib	mount,opendir,pathconf
+lib	mount,opendir,openat,pathconf
 lib	readlink,remove,rename,rewinddir,rmdir,setlocale
 lib	setpgrp,setpgrp2,setreuid,setuid
 lib	socketpair

[JohnoKing]

I'm fine with this approach for now. Still, I don't see a good reason for the code to treat sh.pwd as though it were a potentially NULL pointer while in sh_subshell. sh.pwd is always guaranteed to be set via a path_pwd() call in env_init():

ksh/src/cmd/ksh93/sh/init.c

Line 1922 in d663b7c

path_pwd();

ksh/src/cmd/ksh93/sh/path.c

Lines 243 to 251 in d663b7c

	/* Neither obtained the pwd nor can fall back to sane-ish $PWD: fall back to "." */
	if(!cp)
	cp = nv_getval(pwdnod);
	if(!cp || *cp!='/')
	nv_putval(pwdnod,cp=(char*)e_dot,NV_RDONLY);
	/* Set shell PWD */
	if(!tofree)
	cp = sh_strdup(cp);
	sh.pwd = cp;

Consequently, it's only ever set to null right before path_pwd is invoked:

ksh/src/cmd/ksh93/bltins/cd_pwd.c

Lines 278 to 281 in d663b7c

	/* pathcanon() failed to canonicalize the directory, which happens when 'cd' is invoked from a
	nonexistent PWD with a relative path as the argument. Reinitialize $PWD as it will be wrong. */
	sh.pwd = NULL;
	path_pwd();

ksh/src/cmd/ksh93/sh/subshell.c

Lines 889 to 892 in d663b7c

	/* reinit PWD as it will be wrong */
	free(sh.pwd);
	sh.pwd = NULL;
	path_pwd();

Even in the old code I can't see a scenario where sh.pwd is ever NULL prior to it explicitly being set as such.

[McDutchie]

Still, I don't see a good reason for the code to treat sh.pwd as though it were a potentially NULL pointer while in sh_subshell.

Agreed, I'll fix that.

[McDutchie]

By the way, as subshells got faster, cd got nearly 7 times slower:

$ ksh -c 'typeset -i i; time for((i=0;i<500000;i++));do cd /dev; cd /;done'            

real	0m01,10s
user	0m00,85s
sys	0m00,24s
$ arch/*/bin/ksh -c 'typeset -i i; time for((i=0;i<500000;i++));do cd /dev; cd /;done'

real	0m07,50s
user	0m01,33s
sys	0m06,17s

[JohnoKing]

There are several primary causes of that. One is an extra openat call I backported from ksh93v-:

ksh/src/cmd/ksh93/bltins/cd_pwd.c

Lines 56 to 59 in b711e5d

	if((fd = openat(dir, path, O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
	#if O_SEARCH
	if(errno != EACCES || (fd = openat(dir, path, O_SEARCH|O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
	#endif

The ksh93v- code added this because O_SEARCH/O_PATH doesn't check for access permissions IIRC. In my previous patch (which I'm refactoring for eventual submission) I reduced this down to a single call as the access check is more efficiently done by fchdir instead.
Edit: I should also note that the sh_fcntl call used to dup the file descriptor to >=10 costs time as well.

Another cause of slowdown (in subshells) is the test_inode check used to determine if a subshell must fork (edit: for clarity, the inode check itself is the costly check):

ksh/src/cmd/ksh93/bltins/cd_pwd.c

Lines 147 to 148 in b711e5d

	if(sh.subshell && !sh.subshare && !test_inode(sh.pwd,e_dot))
	sh_subfork();

On my machine this causes a considerable drop in performance, but it can't realistically be removed without causing regressions.

[JohnoKing]

Below is a version two patch which should mitigate some of that performance drop.

openat-dupfd-cloexec-rework-somnolescent-version.patch

From a7069f9a6c9e8d527168568d5d6f2b07854f19f1 Mon Sep 17 00:00:00 2001
From: Johnothan King <johnothanking@protonmail.com>
Date: Sat, 4 Jan 2025 16:57:29 -0800
Subject: Improve usage of F_DUPFD_CLOEXEC, O_CLOEXEC and openat

- Robustified the ksh codebase's usage and handling of F_DUPFD_CLOEXEC
  and O_CLOEXEC.
- Avoid casting potentially invalid negative file descriptors as
  unsigned in SHOPT_ACCT code.
- Removed redundant openat call. The only purpose of the extra call was
  to check for access permissions (because O_PATH and O_SEARCH skip
  that check). The fchdir call is perfectly capable of doing that
  by itself, so the extra syscall should be avoided.
- Cope with the possibility of sh_diropenat running out of file
  descriptors to use.
- Incidentally fixed a file descriptor leak in hist_exceptf().
- Added sh_diropenpwd function to fix sh.pwdfd on old OSes.
---
 src/cmd/ksh93/Mamfile           |   1 +
 src/cmd/ksh93/bltins/cd_pwd.c   | 101 ++++++++++++++++++++++++--------
 src/cmd/ksh93/edit/history.c    |  51 +++++++++++-----
 src/cmd/ksh93/include/defs.h    |   6 +-
 src/cmd/ksh93/include/shell.h   |   2 -
 src/cmd/ksh93/sh/fault.c        |   2 -
 src/cmd/ksh93/sh/io.c           |  19 ++++--
 src/cmd/ksh93/sh/main.c         |  25 +++++---
 src/cmd/ksh93/sh/path.c         |   4 +-
 src/cmd/ksh93/sh/subshell.c     |  66 ++-------------------
 src/cmd/ksh93/sh/xec.c          |  10 +++-
 src/cmd/ksh93/tests/subshell.sh |   2 +-
 src/lib/libast/include/sfio.h   |   1 +
 src/lib/libast/man/sfio.3       |   4 ++
 src/lib/libast/sfio/sfsetfd.c   |  37 ++++++------
 15 files changed, 191 insertions(+), 140 deletions(-)

diff --git a/src/cmd/ksh93/Mamfile b/src/cmd/ksh93/Mamfile
index 6a700b16c..f1a02ca8f 100644
--- a/src/cmd/ksh93/Mamfile
+++ b/src/cmd/ksh93/Mamfile
@@ -360,6 +360,7 @@ make install virtual
 			prev include/test.h
 			prev %{INCLUDE_AST}/ls.h
 			prev include/builtins.h
+			prev include/io.h
 			prev include/name.h
 			prev include/path.h
 			prev include/variables.h
diff --git a/src/cmd/ksh93/bltins/cd_pwd.c b/src/cmd/ksh93/bltins/cd_pwd.c
index f8cd566e6..f40aeab80 100644
--- a/src/cmd/ksh93/bltins/cd_pwd.c
+++ b/src/cmd/ksh93/bltins/cd_pwd.c
@@ -33,6 +33,7 @@
 #include	"path.h"
 #include	"name.h"
 #include	"builtins.h"
+#include	"io.h"
 #include	<ls.h>
 #include	"test.h"
 
@@ -46,22 +47,71 @@ static void rehash(Namval_t *np,void *data)
 		nv_rehash(np,data);
 }
 
+/*
+ * Move the fd to a number >= 10 if necessary and guarantee the close-on-exec flag gets set
+ */
+static int prepfd(int fd)
+{
+	int needs_cloexec = 0;
+	if(fd < 10)
+	{
+		/* Duplicate the fd and register it with the shell */
+		int shfd = sh_fcntl(fd, F_dupfd_cloexec, 10);
+		close(fd);
+		if(shfd < 0)
+		{
+#if _lib_openat
+			if(errno==EINVAL)
+			{
+				/*
+				 * Tell cd we ran out of file descriptors. (EINVAL by itself
+				 * is too vague to be differentiated from a failure in
+				 * openat/open utilizing that same errno.)
+				 */
+				errno = ENOTTY;
+			}
+#endif
+			return shfd;
+		}
+#if F_dupfd_cloexec == F_DUPFD
+		needs_cloexec = 1;
+#endif
+		fd = shfd;
+	}
+#if !O_cloexec
+	else
+		needs_cloexec = 1;
+#endif
+	if(needs_cloexec)
+	{
+		/* Set close-on-exec if it's not already set */
+		fcntl(fd,F_SETFD,FD_CLOEXEC);
+		sh.fdstatus[fd] |= IOCLEX;
+	}
+	return fd;
+}
+
 #if _lib_openat
 /*
  * Obtain a file handle to the directory "path" relative to directory "dir"
  */
 int sh_diropenat(int dir, const char *path)
 {
-	int fd,shfd;
-	if((fd = openat(dir, path, O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
-#if O_SEARCH
-		if(errno != EACCES || (fd = openat(dir, path, O_SEARCH|O_DIRECTORY|O_NONBLOCK|O_cloexec)) < 0)
-#endif
-			return fd;
-	/* Move fd to a number > 10 and register the fd number with the shell */
-	shfd = sh_fcntl(fd, F_dupfd_cloexec, 10);
-	close(fd);
-	return shfd;
+	int fd;
+	if((fd = openat(dir, path, O_DIRECTORY|O_NONBLOCK|O_cloexec|O_SEARCH)) < 0)
+		return fd;
+	return prepfd(fd);
+}
+#else
+/*
+ * Inferior compatibility alternative to sh_diropenat which makes a pwdfd for '.' with open (no race involved)
+ */
+int sh_diropenpwd(void)
+{
+	int fd;
+	if((fd = open(e_dot, O_DIRECTORY|O_cloexec|O_SEARCH)) < 0)
+		return fd;
+	return prepfd(fd);
 }
 #endif /* _lib_openat */
 
@@ -140,13 +190,8 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 	 * If sh_subshell() in subshell.c cannot use fchdir(2) to restore the PWD using a saved file descriptor,
 	 * we must fork any virtual subshell now to avoid the possibility of ending up in the wrong PWD on exit.
 	 */
-#if _lib_openat
 	if(sh.subshell && !sh.subshare && (!sh_validate_subpwdfd() || !test_inode(sh.pwd,e_dot)))
 		sh_subfork();
-#else
-	if(sh.subshell && !sh.subshare && !test_inode(sh.pwd,e_dot))
-		sh_subfork();
-#endif /* _lib_openat */
 	/*
 	 * Do $CDPATH processing, except if the path is absolute or the first component is '.' or '..'
 	 */
@@ -220,15 +265,16 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 			}
 			sh_close(newdirfd);
 		}
-#if !O_SEARCH
-		else if((rval=chdir(cp)) >= 0)
-			sh_pwdupdate(sh_diropenat(AT_FDCWD,cp));
-#endif
+		else if((O_SEARCH==0 || errno==ENOTTY) && (rval=chdir(cp)) >= 0)
+			sh_pwdupdate(errno==ENOTTY?-1:sh_diropenat(AT_FDCWD,cp));
 		if(saverrno==0)
 			saverrno=errno;
 #else
 		if((rval=chdir(path_relative(stkptr(sh.stk,PATH_OFFSET)))) >= 0)
+		{
+			sh_pwdupdate(sh_diropenpwd());
 			goto success;
+		}
 		if(errno!=ENOENT && saverrno==0)
 			saverrno=errno;
 #endif /* _lib_openat */
@@ -248,18 +294,25 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
 			}
 			sh_close(newdirfd);
 		}
-#if !O_SEARCH
-		else if((rval=chdir(dir)) >= 0)
-			sh_pwdupdate(sh_diropenat(AT_FDCWD,dir));
-#endif
+		else if((O_SEARCH==0 || errno==ENOTTY) && (rval=chdir(cp)) >= 0)
+			sh_pwdupdate(errno==ENOTTY?-1:sh_diropenat(AT_FDCWD,cp));
 #else
-		rval = chdir(dir);
+		if((rval=chdir(dir)) >= 0)
+			sh_pwdupdate(sh_diropenpwd());
 #endif /* _lib_openat */
 	}
 	if(rval<0)
 	{
 		if(saverrno)
 			errno = saverrno;
+#if _lib_openat
+		if(errno==ENOTTY)
+		{
+			errno = EINVAL;
+			errormsg(SH_DICT,ERROR_system(ret),e_toomany);
+			UNREACHABLE();
+		}
+#endif
 		errormsg(SH_DICT,ERROR_system(ret),"%s:",dir);
 		UNREACHABLE();
 	}
diff --git a/src/cmd/ksh93/edit/history.c b/src/cmd/ksh93/edit/history.c
index 840a1fb8c..a3dd6a4ea 100644
--- a/src/cmd/ksh93/edit/history.c
+++ b/src/cmd/ksh93/edit/history.c
@@ -110,6 +110,7 @@ static History_t *hist_ptr;
     static int  acctinit(History_t *hp)
     {
 	char *cp, *acctfile;
+	int needs_cloexec = 1;
 	Namval_t *np = nv_search("ACCTFILE",sh.var_tree,0);
 
 	if(!np || !(acctfile=nv_getval(np)))
@@ -123,15 +124,16 @@ static History_t *hist_ptr;
 			cp = "unknown";
 	}
 	logname = sh_strdup(cp);
-	if((acctfd=sh_open(acctfile,
-		O_BINARY|O_WRONLY|O_APPEND|O_CREAT,S_IRUSR|S_IWUSR))>=0 &&
-	    (unsigned)acctfd < 10)
+	if((acctfd=sh_open(acctfile,O_BINARY|O_WRONLY|O_APPEND|O_CREAT|O_cloexec,S_IRUSR|S_IWUSR))>=0 && acctfd < 10)
 	{
 		int n;
 		if((n = sh_fcntl(acctfd, F_dupfd_cloexec, 10)) >= 0)
 		{
 			sh_close(acctfd);
 			acctfd = n;
+#if F_dupfd_cloexec != FD_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 	}
 	if(acctfd < 0)
@@ -139,13 +141,17 @@ static History_t *hist_ptr;
 		acctfd = 0;
 		return 0;
 	}
+#if O_cloexec
+	else if(acctfd < 10)
+		needs_cloexec = 0;
+#endif
 	if(sh_isdevfd(acctfile))
 	{
 		char newfile[16];
 		sfsprintf(newfile,sizeof(newfile),"%.8s%d\0",e_devfdNN,acctfd);
 		nv_putval(np,newfile,NV_RDONLY);
 	}
-	else
+	else if(needs_cloexec)
 		fcntl(acctfd,F_SETFD,FD_CLOEXEC);
 	return 1;
     }
@@ -205,7 +211,7 @@ int  sh_histinit(void)
 	History_t *hp;
 	char *histname;
 	char *fname=0;
-	int histmask, maxlines, hist_start=0;
+	int histmask, maxlines, hist_start=0, needs_cloexec=1, n;
 	char *cp;
 	off_t hsize = 0;
 
@@ -225,16 +231,16 @@ retry:
 	if(!histinit)
 		histmode = S_IRUSR|S_IWUSR;
 	if((fd=open(cp,O_BINARY|O_APPEND|O_RDWR|O_CREAT|O_cloexec,histmode))>=0)
-	{
 		hsize=lseek(fd,0,SEEK_END);
-	}
-	if((unsigned)fd < 10)
+	if(fd > 0 && fd < 10)
 	{
-		int n;
 		if((n=sh_fcntl(fd,F_dupfd_cloexec,10))>=0)
 		{
 			sh_close(fd);
 			fd=n;
+#if F_dupfd_cloexec != F_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 	}
 	/* make sure that file has history file format */
@@ -253,13 +259,17 @@ retry:
 		{
 			if(!(fname = pathtmp(NULL,0,0,NULL)))
 				return 0;
-			fd = open(fname,O_BINARY|O_APPEND|O_CREAT|O_RDWR,S_IRUSR|S_IWUSR|O_cloexec);
+			fd = open(fname,O_BINARY|O_APPEND|O_CREAT|O_RDWR|O_cloexec,S_IRUSR|S_IWUSR);
 		}
 	}
 	if(fd<0)
 		return 0;
-	/* set the file to close-on-exec */
-	fcntl(fd,F_SETFD,FD_CLOEXEC);
+#if O_cloexec
+	if(fd < 10)
+		needs_cloexec = 0;
+#endif
+	if(needs_cloexec)
+		fcntl(fd,F_SETFD,FD_CLOEXEC);  /* set the file to close-on-exec */
 	if(cp=nv_getval(HISTSIZE))
 	{
 		intmax_t m = strtoll(cp, NULL, 10);
@@ -342,19 +352,27 @@ retry:
 		hp->auditfp = 0;
 		if(sh_isstate(SH_INTERACTIVE) && (hp->auditmask=sh_checkaudit(hp,SHOPT_AUDITFILE, buff, sizeof(buff))))
 		{
+			needs_cloexec = 1;
 			if((fd=sh_open(buff,O_BINARY|O_WRONLY|O_APPEND|O_CREAT|O_cloexec,S_IRUSR|S_IWUSR))>=0 && fd < 10)
 			{
-				int n;
 				if((n = sh_fcntl(fd,F_dupfd_cloexec, 10)) >= 0)
 				{
 					sh_close(fd);
 					fd = n;
+#if F_dupfd_cloexec != F_DUPFD
+					needs_cloexec = 0;
+#endif
 				}
 			}
+#if O_cloexec
+			if(fd < 10)
+				needs_cloexec = 0;
+#endif
 			if(fd>=0)
 			{
 				const char *tty;
-				fcntl(fd,F_SETFD,FD_CLOEXEC);
+				if(needs_cloexec)
+					fcntl(fd,F_SETFD,FD_CLOEXEC);
 				tty = ttyname(2);
 				hp->tty = sh_strdup(tty?tty:"notty");
 				hp->auditfp = sfnew(NULL,NULL,-1,fd,SFIO_WRITE);
@@ -1114,8 +1132,13 @@ static int hist_exceptf(Sfio_t* fp, int type, void *data, Sfdisc_t *handle)
 		if((newfd=open(hp->histname,O_BINARY|O_APPEND|O_CREAT|O_RDWR|O_cloexec,S_IRUSR|S_IWUSR)) >= 0)
 		{
 			if(sh_fcntl(newfd, F_dupfd_cloexec, oldfd) != oldfd)
+			{
+				close(newfd);
 				return -1;
+			}
+#if F_dupfd_cloexec == F_DUPFD
 			fcntl(oldfd,F_SETFD,FD_CLOEXEC);
+#endif
 			close(newfd);
 			if(lseek(oldfd,0,SEEK_END) < hp->histcnt)
 			{
diff --git a/src/cmd/ksh93/include/defs.h b/src/cmd/ksh93/include/defs.h
index 7e36c885b..dd985ec35 100644
--- a/src/cmd/ksh93/include/defs.h
+++ b/src/cmd/ksh93/include/defs.h
@@ -150,9 +150,11 @@ extern int		sh_type(const char*);
 extern void             sh_unscope(void);
 #if _lib_openat
     extern int		sh_diropenat(int,const char *);
-    extern void		sh_pwdupdate(int);
-    extern int		sh_validate_subpwdfd(void);
+#else
+    extern int		sh_diropenpwd(void);
 #endif /* _lib_openat */
+extern void		sh_pwdupdate(int);
+extern int		sh_validate_subpwdfd(void);
 #if SHOPT_NAMESPACE
     extern Namval_t	*sh_fsearch(const char *,int);
 #endif /* SHOPT_NAMESPACE */
diff --git a/src/cmd/ksh93/include/shell.h b/src/cmd/ksh93/include/shell.h
index 1d87a36c6..cf642fc24 100644
--- a/src/cmd/ksh93/include/shell.h
+++ b/src/cmd/ksh93/include/shell.h
@@ -372,9 +372,7 @@ struct Shell_s
 	Sfio_t		**sftable;
 	unsigned char	*fdstatus;
 	char		*pwd;
-#if _lib_openat
 	int		pwdfd;		/* file descriptor for pwd */
-#endif /* _lib_openat */
 	void		*jmpbuffer;
 	void		*mktype;
 	Sfio_t		*strbuf;
diff --git a/src/cmd/ksh93/sh/fault.c b/src/cmd/ksh93/sh/fault.c
index d20df0577..0de0cd9eb 100644
--- a/src/cmd/ksh93/sh/fault.c
+++ b/src/cmd/ksh93/sh/fault.c
@@ -687,10 +687,8 @@ noreturn void sh_done(int sig)
 	if(sh_isoption(SH_NOEXEC))
 		kiaclose((Lex_t*)sh.lex_context);
 #endif /* SHOPT_KIA */
-#if _lib_openat
 	if(sh.pwdfd > 0)
 		close(sh.pwdfd);
-#endif /* _lib_openat */
 	/* Exit with portable 8-bit status (128 + signum) if last child process exits due to signal */
 	if(sh.chldexitsig)
 		savxit = savxit & ~SH_EXITSIG | 0200;
diff --git a/src/cmd/ksh93/sh/io.c b/src/cmd/ksh93/sh/io.c
index 5046dcd6d..7a3dccd32 100644
--- a/src/cmd/ksh93/sh/io.c
+++ b/src/cmd/ksh93/sh/io.c
@@ -1702,7 +1702,7 @@ void sh_iosave(int origfd, int oldtop, char *name)
 		savefd = -1;
 	else
 	{
-		if((savefd = sh_fcntl(origfd, F_DUPFD, 10)) < 0 && errno!=EBADF)
+		if((savefd = sh_fcntl(origfd, F_dupfd_cloexec, 10)) < 0 && errno!=EBADF)
 		{
 			sh.toomany=1;
 			((struct checkpt*)sh.jmplist)->mode = SH_JMPERREXIT;
@@ -1717,8 +1717,10 @@ void sh_iosave(int origfd, int oldtop, char *name)
 	if(savefd >=0)
 	{
 		Sfio_t* sp = sh.sftable[origfd];
+#if F_dupfd_cloexec == F_DUPFD
 		/* make saved file close-on-exec */
 		sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);
+#endif
 		if(origfd==job.fd)
 			job.fd = savefd;
 		sh.fdstatus[savefd] = sh.fdstatus[origfd];
@@ -2251,10 +2253,7 @@ static void	sftrack(Sfio_t* sp, int flag, void* data)
 		return;
 	mode = sfset(sp,0,0);
 	if(sp==sh.heredocs && fd < 10 && flag==SFIO_SETFD)
-	{
-		fd = sfsetfd(sp,10);
-		fcntl(fd,F_SETFD,FD_CLOEXEC);
-	}
+		fd = sfsetfd_cloexec(sp,10);
 	if(fd < 3)
 		return;
 	if(flag==SFIO_NEW)
@@ -2564,11 +2563,21 @@ int sh_fcntl(int fd, int op, ...)
 	if(newfd>=0) switch(op)
 	{
 	    case F_DUPFD:
+#if F_dupfd_cloexec != F_DUPFD
+	    case F_dupfd_cloexec:
+#endif
 		if(sh.fdstatus[fd] == IOCLOSE)
 			sh.fdstatus[fd] = 0;
 		if(newfd>=sh.lim.open_max)
 			sh_iovalidfd(newfd);
+#if F_dupfd_cloexec != F_DUPFD
+		if(op==F_DUPFD)
+			sh.fdstatus[newfd] = (sh.fdstatus[fd]&~IOCLEX);
+		else
+			sh.fdstatus[newfd] = (sh.fdstatus[fd]|IOCLEX);
+#else
 		sh.fdstatus[newfd] = (sh.fdstatus[fd]&~IOCLEX);
+#endif
 		if(fdnotify)
 			(*fdnotify)(fd,newfd);
 		break;
diff --git a/src/cmd/ksh93/sh/main.c b/src/cmd/ksh93/sh/main.c
index 2cfe64068..8b4e2c5fc 100644
--- a/src/cmd/ksh93/sh/main.c
+++ b/src/cmd/ksh93/sh/main.c
@@ -363,15 +363,26 @@ static void	exfile(Sfio_t *iop,int fno)
 	{
 		if(fno > 0)
 		{
-			int r;
-			if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))
+			int needs_cloexec = 1;
+			if(fno < 10)
 			{
-				sh.fdstatus[r] = sh.fdstatus[fno];
-				sh_close(fno);
-				fno = r;
+				int r;
+				r = sh_fcntl(fno,F_dupfd_cloexec,10);
+				if(r >= 10)
+				{
+					sh.fdstatus[r] = sh.fdstatus[fno];
+					sh_close(fno);
+					fno = r;
+				}
+#if F_dupfd_cloexec != FD_DUPFD
+				needs_cloexec = 0;
+#endif
+			}
+			if(needs_cloexec)
+			{
+				fcntl(fno,F_SETFD,FD_CLOEXEC);
+				sh.fdstatus[fno] |= IOCLEX;
 			}
-			fcntl(fno,F_SETFD,FD_CLOEXEC);
-			sh.fdstatus[fno] |= IOCLEX;
 			iop = sh_iostream(fno);
 		}
 		else
diff --git a/src/cmd/ksh93/sh/path.c b/src/cmd/ksh93/sh/path.c
index 9c2bd83a1..7273516e3 100644
--- a/src/cmd/ksh93/sh/path.c
+++ b/src/cmd/ksh93/sh/path.c
@@ -249,9 +249,11 @@ char *path_pwd(void)
 	if(!tofree)
 		cp = sh_strdup(cp);
 	sh.pwd = cp;
-#if _lib_openat
 	/* Set sh.pwdfd */
+#if _lib_openat
 	sh_pwdupdate(sh_diropenat(AT_FDCWD,cp));
+#else
+	sh_pwdupdate(sh_diropenpwd());
 #endif /* _lib_openat */
 	return sh.pwd;
 }
diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
index 0137abfea..1287d5b2e 100644
--- a/src/cmd/ksh93/sh/subshell.c
+++ b/src/cmd/ksh93/sh/subshell.c
@@ -85,9 +85,6 @@ static struct subshell
 	char		rand_state;         /* 0 means sp->rand_seed hasn't been set, 1 is the opposite */
 	uint32_t	srand_upper_bound;  /* parent shell's upper bound for $SRANDOM */
 	int		pwdfd;              /* parent shell's file descriptor for PWD */
-#if !_lib_openat
-	char		pwdclose;
-#endif /* !_lib_openat */
 } *subshell_data;
 
 static unsigned int subenv;
@@ -104,10 +101,12 @@ void	sh_subtmpfile(void)
 		struct checkpt	*pp = (struct checkpt*)sh.jmplist;
 		struct subshell *sp = subshell_data->pipe;
 		/* save file descriptor 1 if open */
-		if((sp->tmpfd = fd = sh_fcntl(1,F_DUPFD,10)) >= 0)
+		if((sp->tmpfd = fd = sh_fcntl(1,F_dupfd_cloexec,10)) >= 0)
 		{
+#if F_dupfd_cloexec == F_DUPFD
 			fcntl(fd,F_SETFD,FD_CLOEXEC);
-			sh.fdstatus[fd] = sh.fdstatus[1]|IOCLEX;
+			sh.fdstatus[fd] |= IOCLEX;
+#endif
 			close(1);
 		}
 		else if(errno!=EBADF)
@@ -449,8 +448,6 @@ void sh_subjobcheck(pid_t pid)
 	}
 }
 
-#if _lib_openat
-
 /*
  * Set the file descriptor for the current shell's PWD without wiping
  * out the stored file descriptor for the parent shell's PWD.
@@ -473,8 +470,6 @@ int sh_validate_subpwdfd(void)
 	return sp->pwdfd > 0;
 }
 
-#endif /* _lib_openat */
-
 /*
  * Run command tree <t> in a virtual subshell
  * If comsub is not null, then output will be placed in temp file (or buffer)
@@ -523,10 +518,6 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 		path_get(e_dot);
 		sh.pathinit = 0;
 	}
-#if !_lib_openat
-	if(!sh.pwd)
-		path_pwd();
-#endif /* !_lib_openat */
 	sp->bckpid = sh.bckpid;
 	if(comsub)
 		sh_stats(STAT_COMSUB);
@@ -542,40 +533,8 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 	if(!sh.subshare)
 	{
 		char *save_debugtrap = 0;
-#if _lib_openat
 		sp->pwd = sh_strdup(sh.pwd);
 		sp->pwdfd = sh.pwdfd;
-#else
-		struct subshell *xp;
-		sp->pwdfd = -1;
-		for(xp=sp->prev; xp; xp=xp->prev)
-		{
-			if(xp->pwdfd>0 && xp->pwd && strcmp(xp->pwd,sh.pwd)==0)
-			{
-				sp->pwdfd = xp->pwdfd;
-				break;
-			}
-		}
-		if(sp->pwdfd<0)
-		{
-			int n = open(e_dot,O_SEARCH);
-			if(n>=0)
-			{
-				sp->pwdfd = n;
-				if(n<10)
-				{
-					sp->pwdfd = sh_fcntl(n,F_DUPFD,10);
-					close(n);
-				}
-				if(sp->pwdfd>0)
-				{
-					fcntl(sp->pwdfd,F_SETFD,FD_CLOEXEC);
-					sp->pwdclose = 1;
-				}
-			}
-		}
-		sp->pwd = (sh.pwd?sh_strdup(sh.pwd):0);
-#endif /* _lib_openat */
 		sp->mask = sh.mask;
 		sh_stats(STAT_SUBSHELL);
 		/* save trap table */
@@ -649,10 +608,6 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 		if(sh.savesig < 0)
 		{
 			sh.savesig = 0;
-#if !_lib_openat
-			if(sp->pwdfd < 0 && !sh.subshare)	/* if we couldn't get a file descriptor to our PWD ... */
-				sh_subfork();			/* ...we have to fork, as we cannot fchdir back to it. */
-#endif /* !_lib_openat */
 			/* Virtual subshells are not safe to suspend (^Z, SIGTSTP) in the interactive main shell. */
 			if(sh_isstate(SH_INTERACTIVE))
 			{
@@ -836,7 +791,6 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 			free(savsig);
 		}
 		sh.options = sp->options;
-#if _lib_openat
 		if(sh.pwdfd != sp->pwdfd)
 		{
 			/*
@@ -858,18 +812,6 @@ Sfio_t *sh_subshell(Shnode_t *t, volatile int flags, int comsub)
 			if(fatalerror != 2)
 				sh_pwdupdate(sp->pwdfd);
 		}
-#else
-		/* restore the present working directory */
-		if(sp->pwdfd > 0 && fchdir(sp->pwdfd) < 0)
-		{
-			saveerrno = errno;
-			fatalerror = 2;
-		}
-		else if(sp->pwd && strcmp(sp->pwd,sh.pwd))
-			path_newdir(sh.pathlist);
-		if(sp->pwdclose)
-			close(sp->pwdfd);
-#endif /* _lib_openat */
 		free(sh.pwd);
 		sh.pwd = sp->pwd;
 		if(sp->mask!=sh.mask)
diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
index f8ab80fe5..e022b1427 100644
--- a/src/cmd/ksh93/sh/xec.c
+++ b/src/cmd/ksh93/sh/xec.c
@@ -3219,24 +3219,28 @@ static void coproc_init(int pipes[])
 	sh.cpid = 0;
 	if(sh.cpipe[0]<=0 || sh.cpipe[1]<=0)
 	{
+		int needs_cloexec = 1;
 		/* first co-process */
 		sh_pclose(sh.cpipe);
 		sh_pipe(sh.cpipe);
 		if((outfd=sh.cpipe[1]) < 10)
 		{
-		        int fd=sh_fcntl(sh.cpipe[1],F_DUPFD,10);
+		        int fd=sh_fcntl(sh.cpipe[1],F_dupfd_cloexec,10);
 			if(fd>=10)
 			{
-			        sh.fdstatus[fd] = (sh.fdstatus[outfd]&~IOCLEX);
+				sh.fdstatus[fd] |= sh.fdstatus[outfd];
 				close(outfd);
 			        sh.fdstatus[outfd] = IOCLOSE;
 				sh.cpipe[1] = fd;
 			}
+#if F_dupfd_cloexec != F_DUPFD
+			needs_cloexec = 0;
+#endif
 		}
 		if(fcntl(*sh.cpipe,F_SETFD,FD_CLOEXEC)>=0)
 			sh.fdstatus[sh.cpipe[0]] |= IOCLEX;
 		sh.fdptrs[sh.cpipe[0]] = sh.cpipe;
-		if(fcntl(sh.cpipe[1],F_SETFD,FD_CLOEXEC) >=0)
+		if(needs_cloexec && fcntl(sh.cpipe[1],F_SETFD,FD_CLOEXEC) >=0)
 			sh.fdstatus[sh.cpipe[1]] |= IOCLEX;
 	}
 	sh.outpipe = sh.cpipe;
diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
index 7132949ae..911ee07a5 100755
--- a/src/cmd/ksh93/tests/subshell.sh
+++ b/src/cmd/ksh93/tests/subshell.sh
@@ -607,7 +607,7 @@ then    integer i
 	for ((i=11; i < 29; i++))
 	do      if      ! [[ -r /dev/fd/$i  || -w /dev/fd/$i ]]
 		then    a=$($SHELL -c "[[ -r /dev/fd/$i || -w /dev/fd/$i ]]")
-			(( $? )) || err_exit "file descriptor $i not close on exec"
+			(( $? )) || err_exit "file descriptor $i not close-on-exec"
 		fi
 	done
 fi
diff --git a/src/lib/libast/include/sfio.h b/src/lib/libast/include/sfio.h
index f608da2f6..87f4f3093 100644
--- a/src/lib/libast/include/sfio.h
+++ b/src/lib/libast/include/sfio.h
@@ -203,6 +203,7 @@ extern int		sfraise(Sfio_t*, int, void*);
 extern int		sfnotify(void(*)(Sfio_t*, int, void*));
 extern int		sfset(Sfio_t*, int, int);
 extern int		sfsetfd(Sfio_t*, int);
+extern int		sfsetfd_cloexec(Sfio_t*, int);
 extern Sfio_t*		sfpool(Sfio_t*, Sfio_t*, int);
 extern ssize_t		sfread(Sfio_t*, void*, size_t);
 extern ssize_t		sfwrite(Sfio_t*, const void*, size_t);
diff --git a/src/lib/libast/man/sfio.3 b/src/lib/libast/man/sfio.3
index 6c8ff68e5..00173cc88 100644
--- a/src/lib/libast/man/sfio.3
+++ b/src/lib/libast/man/sfio.3
@@ -190,6 +190,7 @@ SFIO_EVENT
 int        sfresize(Sfio_t* f, Sfoff_t size);
 int        sfset(Sfio_t* f, int flags, int i);
 int        sfsetfd(Sfio_t* f, int fd);
+int        sfsetfd_cloexec(Sfio_t* f, int fd);
 Sfio_t*    sfstack(Sfio_t* base, Sfio_t* top);
 char*      sfstruse(Sfio_t *f);
 Sfio_t*    sfswap(Sfio_t* f1, Sfio_t* f2);
@@ -1758,6 +1759,9 @@ Then, except for \f3sfclose()\fP, the stream will be inaccessible
 until a future \f3sfsetfd()\fP call resets the file descriptor to a non-negative value.
 Thus, \f3sfsetfd(f,-1)\fP can be used to avoid closing the file descriptor
 of \f3f\fP when \f3f\fP is closed.
+.Ss "  int sfsetfd_cloexec(Sfio_t* f, int fd)"
+This function is identical to \f3sfsetfd()\fP, with the exception that it will
+give duplicated file descriptors the close-on-exec flag.
 .Ss "  Sfio_t* sfstack(Sfio_t* base, Sfio_t* top)"
 This function stacks or unstacks stream.
 Every stream stack is identified by a base stream
diff --git a/src/lib/libast/sfio/sfsetfd.c b/src/lib/libast/sfio/sfsetfd.c
index 3f24d81c2..d48722ede 100644
--- a/src/lib/libast/sfio/sfsetfd.c
+++ b/src/lib/libast/sfio/sfsetfd.c
@@ -23,30 +23,23 @@
 **	Written by Kiem-Phong Vo.
 */
 
-static int _sfdup(int fd, int newfd)
+static int _sfdup(int fd, int newfd, int cloexec)
 {
 	int	dupfd;
 
-#ifdef F_DUPFD	/* the simple case */
+#if F_dupfd_cloexec == F_DUPFD
 	while((dupfd = fcntl(fd,F_DUPFD,newfd)) < 0 && errno == EINTR)
 		errno = 0;
-	return dupfd;
-
-#else	/* do it the hard way */
-	if((dupfd = dup(fd)) < 0 || dupfd >= newfd)
-		return dupfd;
-
-	/* dup() succeeded but didn't get the right number, recurse */
-	newfd = _sfdup(fd,newfd);
-
-	/* close the one that didn't match */
-	CLOSE(dupfd);
-
-	return newfd;
+	if(cloexec && dupfd > -1)
+		fcntl(dupfd,F_SETFD,FD_CLOEXEC);
+#else
+	while((dupfd = fcntl(fd,cloexec?F_dupfd_cloexec:F_DUPFD,newfd)) < 0 && errno == EINTR)
+		errno = 0;
 #endif
+	return dupfd;
 }
 
-int sfsetfd(Sfio_t* f, int newfd)
+static int sfsetfd_internal(Sfio_t* f, int newfd, int cloexec)
 {
 	int		oldfd;
 
@@ -70,7 +63,7 @@ int sfsetfd(Sfio_t* f, int newfd)
 		oldfd = f->file;
 		if(oldfd >= 0)
 		{	if(newfd >= 0)
-			{	if((newfd = _sfdup(oldfd,newfd)) < 0)
+			{	if((newfd = _sfdup(oldfd,newfd,cloexec)) < 0)
 				{	SFOPEN(f,0);
 					return -1;
 				}
@@ -119,3 +112,13 @@ int sfsetfd(Sfio_t* f, int newfd)
 
 	return newfd;
 }
+
+int sfsetfd(Sfio_t* f, int newfd)
+{
+	return sfsetfd_internal(f, newfd, 0);
+}
+
+int sfsetfd_cloexec(Sfio_t* f, int newfd)
+{
+	return sfsetfd_internal(f, newfd, 1);
+}
-- 
2.47.1