From 572e163ef53b5ba6553cc4722bafd8322a569fcd Mon Sep 17 00:00:00 2001 From: Matteo Croce Date: Thu, 4 Jul 2024 03:14:22 +0200 Subject: [PATCH 1/5] use O_PATH when getting cgroup fd O_PATH mode is enough to attach a bpf program to a cgroup, use it instead of O_RDONLY --- src/core/bpf-restrict-ifaces.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/bpf-restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c index 64d8d1a7e5..a39f4895f2 100644 --- a/src/core/bpf-restrict-ifaces.c +++ b/src/core/bpf-restrict-ifaces.c @@ -128,7 +128,7 @@ static int restrict_ifaces_install_impl(Unit *u) { if (r < 0) return r; - cgroup_fd = open(cgroup_path, O_RDONLY | O_CLOEXEC | O_DIRECTORY, 0); + cgroup_fd = open(cgroup_path, O_PATH | O_CLOEXEC | O_DIRECTORY, 0); if (cgroup_fd < 0) return -errno; From b22befa9f56d8015690c877f35431f69b7ad5331 Mon Sep 17 00:00:00 2001 From: Matteo Croce Date: Thu, 4 Jul 2024 03:16:29 +0200 Subject: [PATCH 2/5] use O_PATH to obtain cgroupfs fd We get a fd to cgroupfs just to avoid it being umounted, O_PATH is enough, use it instead of O_RDONLY. --- src/core/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/cgroup.c b/src/core/cgroup.c index 9620436f68..6c13167346 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -4270,7 +4270,7 @@ int manager_setup_cgroup(Manager *m) { /* 6. And pin it, so that it cannot be unmounted */ safe_close(m->pin_cgroupfs_fd); - m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK); + m->pin_cgroupfs_fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY); if (m->pin_cgroupfs_fd < 0) return log_error_errno(errno, "Failed to open pin file: %m"); From e51d8e0aa4b151fd54c0a3e345690522272499f2 Mon Sep 17 00:00:00 2001 From: Matteo Croce Date: Tue, 9 Jul 2024 01:24:50 +0200 Subject: [PATCH 3/5] use O_PATH to get the root fds `switch_root()` opens two file descriptors to do the switch but never reads from them. Open them with O_PATH. --- src/shared/switch-root.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/switch-root.c b/src/shared/switch-root.c index e64b6f6c8f..621161a1c0 100644 --- a/src/shared/switch-root.c +++ b/src/shared/switch-root.c @@ -58,7 +58,7 @@ int switch_root(const char *new_root, if (old_root_fd < 0) return log_error_errno(errno, "Failed to open root directory: %m"); - new_root_fd = open(new_root, O_DIRECTORY|O_CLOEXEC); + new_root_fd = open(new_root, O_PATH|O_DIRECTORY|O_CLOEXEC); if (new_root_fd < 0) return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root); From 2bae668311df819de5843936ef12bf03b23db19e Mon Sep 17 00:00:00 2001 From: Matteo Croce Date: Tue, 9 Jul 2024 01:50:53 +0200 Subject: [PATCH 4/5] homed: use O_PATH for FDs `Home->pin_fd` is used only for pinning, open it with O_PATH. --- src/home/homed-home.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/home/homed-home.c b/src/home/homed-home.c index da64d1a8b6..664397e55e 100644 --- a/src/home/homed-home.c +++ b/src/home/homed-home.c @@ -386,7 +386,7 @@ static void home_pin(Home *h) { return; } - h->pin_fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC); + h->pin_fd = open(path, O_PATH|O_DIRECTORY|O_CLOEXEC); if (h->pin_fd < 0) { log_warning_errno(errno, "Couldn't open home directory '%s' for pinning, ignoring: %m", path); return; From cfa477b6157fe1ab641e72439234929f7dbe159b Mon Sep 17 00:00:00 2001 From: Matteo Croce Date: Tue, 9 Jul 2024 02:05:29 +0200 Subject: [PATCH 5/5] homed: open blob dir with O_PATH `sys_base_dfd` is only used as dirfd argument to *_at functions, open it with O_PATH. --- src/home/homework-blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/home/homework-blob.c b/src/home/homework-blob.c index 6b22ab6f24..0ad2941539 100644 --- a/src/home/homework-blob.c +++ b/src/home/homework-blob.c @@ -218,7 +218,7 @@ int home_reconcile_blob_dirs(UserRecord *h, int root_fd, int reconciled) { if (reconciled == USER_RECONCILE_IDENTICAL) return 0; - sys_base_dfd = open(home_system_blob_dir(), O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); + sys_base_dfd = open(home_system_blob_dir(), O_PATH|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); if (sys_base_dfd < 0) return log_error_errno(errno, "Failed to open system blob dir: %m");