shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-13 00:58:27 +03:00
Code

execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink

Browse Source 
It should be OK to allow one level of symlink for the various types of
directories like StateDirectory=, LogsDirectory= and such.
This commit is contained in:
Lennart Poettering 2023-06-27 11:09:03 +02:00
parent d9e5137185
commit d5602c1632
4 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/execute.c
View File

@ -2689,7 +2689,7 @@ static int setup_exec_directory(
/* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
* drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
* assignments to exist. */
r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777, AT_SYMLINK_FOLLOW);
if (r < 0)
goto fail;
}

7
src/shared/chown-recursive.c
View File

@ -111,12 +111,15 @@ int path_chown_recursive(
const char *path,
uid_t uid,
gid_t gid,
mode_t mask) {
mode_t mask,
int flags) {
_cleanup_close_ int fd = -EBADF;
struct stat st;
fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME);
assert((flags & ~AT_SYMLINK_FOLLOW) == 0);
fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOATIME|(FLAGS_SET(flags, AT_SYMLINK_FOLLOW) ? 0 : O_NOFOLLOW));
if (fd < 0)
return -errno;

2
src/shared/chown-recursive.h
View File

@ -3,6 +3,6 @@
#include <sys/types.h>
int path_chown_recursive(const char *path, uid_t uid, gid_t gid, mode_t mask);
int path_chown_recursive(const char *path, uid_t uid, gid_t gid, mode_t mask, int flags);
int fd_chown_recursive(int fd, uid_t uid, gid_t gid, mode_t mask);

2
src/test/test-chown-rec.c
View File

@ -104,7 +104,7 @@ TEST(chown_recursive) {
assert_se(st.st_gid == gid);
assert_se(has_xattr(p));
assert_se(path_chown_recursive(t, 1, 2, 07777) >= 0);
assert_se(path_chown_recursive(t, 1, 2, 07777, 0) >= 0);
p = strjoina(t, "/dir");
assert_se(lstat(p, &st) >= 0);