Assorted remote/shared/resolved hardening fixes flagged by kres (#42978)

src/shared/rm-rf.c

@@ -443,7 +443,20 @@ int rm_rf_at(int dir_fd, const char *path, RemoveFlags flags) {
 
         /* We refuse to clean the root file system with this call. This is extra paranoia to never cause a
          * really seriously broken system. */
-        if (path_is_root_at(dir_fd, path) > 0)
+        r = path_is_root_at(dir_fd, path);
+        if (r == -ENOENT) {
+                struct stat st;
+
+                if (fstatat(dir_fd, path, &st, AT_SYMLINK_NOFOLLOW) < 0)
+                        r = -errno;
+                else
+                        r = 0; /* The entry exists, but is most likely a dangling symlink. */
+        }
+        if (FLAGS_SET(flags, REMOVE_MISSING_OK) && r == -ENOENT)
+                return 0;
+        if (r < 0)
+                return log_error_errno(r, "Failed to determine whether '%s' is the root file system: %m", path);
+        if (r > 0)
                 return log_error_errno(SYNTHETIC_ERRNO(EPERM),
                                        "Attempted to remove entire root file system, and we can't allow that.");
 

src/shared/shift-uid.c

@@ -295,8 +295,9 @@ static int is_fs_fully_userns_compatible(const struct statfs *sfs) {
                F_TYPE_EQUAL(sfs->f_type, SYSFS_MAGIC);
 }
 
-static int recurse_fd(int fd, const struct stat *st, uid_t shift, bool is_toplevel) {
+static int recurse_fd(int input_fd, const struct stat *st, uid_t shift, bool is_toplevel) {
         _cleanup_closedir_ DIR *d = NULL;
+        _cleanup_close_ int fd = input_fd;
         bool changed = false;
         struct statfs sfs;
         int r;

src/shared/vconsole-util.c

@@ -352,9 +352,11 @@ int find_converted_keymap(const X11Context *xc, char **ret) {
         int r;
 
         assert(xc);
-        assert(!isempty(xc->layout));
         assert(ret);
 
+        if (isempty(xc->layout))
+                return -EINVAL;
+
         if (xc->variant)
                 n = strjoin(xc->layout, "-", xc->variant);
         else