From 63eb3cf57b67ca8abc22e61d9dda1f572f4f7562 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Tue, 5 May 2026 17:24:48 +0200
Subject: [PATCH] update TODO

---
 TODO.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/TODO.md b/TODO.md
index b785ac6178..61114235f3 100644
--- a/TODO.md
+++ b/TODO.md
@@ -132,6 +132,10 @@ SPDX-License-Identifier: LGPL-2.1-or-later
   systems for SBC. Should be doing what sysinstall does with the credentials,
   and maybe even *be* sysinstall.
 
+- make sure we always pass O_NOFOLLOW on O_CREAT
+
+- xopenat(): maybe imply O_NOFOLLOW on O_CREAT
+
 - StorageProvider interface + storagectl
   - hook-up in systemd-nspawn
   - hook-up in systemd-vmspawn