Ensure fds are closed after exiting ioctl (#7061)

Co-authored-by: Amaury Chamayou <amchamay@microsoft.com>

Author: cjen1-msft

include/ccf/ds/nonstd.h

@@ -8,6 +8,7 @@
 #include <string>
 #include <string_view>
 #include <type_traits>
+#include <unistd.h>
 #include <vector>
 
 #define FMT_HEADER_ONLY
@@ -203,4 +204,18 @@ namespace ccf::nonstd
       tuple_for_each<I + 1>(t, f);
     }
   }
+
+  static void close_fd(int* fd)
+  {
+    if (fd != nullptr && *fd >= 0)
+    {
+      close(*fd);
+      *fd = -1;
+    }
+  }
+  using CloseFdGuard = std::unique_ptr<int, decltype(&close_fd)>;
+  static inline CloseFdGuard make_close_fd_guard(int* fd)
+  {
+    return CloseFdGuard(fd, close_fd);
+  }
 }

include/ccf/pal/snp_ioctl5.h

@@ -2,6 +2,7 @@
 // Licensed under the Apache 2.0 License.
 #pragma once
 
+#include "ccf/ds/nonstd.h"
 #include "ccf/pal/attestation_sev_snp.h"
 
 #include <fcntl.h>
@@ -106,8 +107,10 @@ namespace ccf::pal::snp::ioctl5
       int fd = open(DEVICE, O_RDWR | O_CLOEXEC);
       if (fd < 0)
       {
-        throw std::logic_error(fmt::format("Failed to open \"{}\"", DEVICE));
+        throw std::logic_error(
+          fmt::format("Failed to open \"{}\" ({})", DEVICE, fd));
       }
+      auto close_guard = nonstd::make_close_fd_guard(&fd);
 
       // Documented at
       // https://www.kernel.org/doc/html/latest/virt/coco/sev-guest.html

include/ccf/pal/snp_ioctl6.h

@@ -2,6 +2,7 @@
 // Licensed under the Apache 2.0 License.
 #pragma once
 
+#include "ccf/ds/nonstd.h"
 #include "ccf/pal/attestation_sev_snp.h"
 
 #include <algorithm>
@@ -229,6 +230,7 @@ namespace ccf::pal::snp::ioctl6
         throw std::logic_error(
           fmt::format("Failed to open \"{}\" ({})", DEVICE, fd));
       }
+      auto close_guard = nonstd::make_close_fd_guard(&fd);
 
       // Documented at
       // https://www.kernel.org/doc/html/latest/virt/coco/sev-guest.html
@@ -283,6 +285,7 @@ namespace ccf::pal::snp::ioctl6
         throw std::logic_error(
           fmt::format("Failed to open \"{}\" ({})", DEVICE, fd));
       }
+      auto close_guard = nonstd::make_close_fd_guard(&fd);
 
       // This req by default mixes in HostData and the CPU VCEK
       DerivedKeyReq req = {};