From 001c5dfdf55a05b038e6b5815d8604af22b3f67c Mon Sep 17 00:00:00 2001 From: Andres Beltran Date: Wed, 8 Jul 2026 19:06:16 +0000 Subject: [PATCH] tmpfiles: add hardening in glob_item_recursively --- src/tmpfiles/tmpfiles.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index 923c2c60f7..5d914bc4ba 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -2897,10 +2897,9 @@ static int glob_item_recursively( /* Make sure we won't trigger/follow file object (such as device nodes, automounts, ...) * pointed out by 'fn' with O_PATH. Note, when O_PATH is used, flags other than * O_CLOEXEC, O_DIRECTORY, and O_NOFOLLOW are ignored. */ - - fd = open(*fn, O_CLOEXEC|O_NOFOLLOW|O_PATH); + fd = path_open_safe(*fn); if (fd < 0) { - RET_GATHER(r, log_error_errno(errno, "Failed to open '%s': %m", *fn)); + RET_GATHER(r, fd); continue; }