From 6f7f3a33514a2ce9bfeba5b58a22ac74a5d8b52d Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 23 Jan 2018 19:36:36 +0100
Subject: [PATCH 1/3] namespace: use stack allocation for paths, where we can

---
 src/core/namespace.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/core/namespace.c b/src/core/namespace.c
index e030a57597..7b9ef85ff8 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -497,7 +497,7 @@ static void drop_outside_root(const char *root_directory, MountEntry *m, unsigne
 }
 
 static int clone_device_node(const char *d, const char *temporary_mount) {
-        _cleanup_free_ char *dn = NULL;
+        const char *dn;
         struct stat st;
         int r;
 
@@ -514,14 +514,11 @@ static int clone_device_node(const char *d, const char *temporary_mount) {
         if (st.st_rdev == 0)
                 return 0;
 
-        dn = strappend(temporary_mount, d);
-        if (!dn)
-                return -ENOMEM;
+        dn = strjoina(temporary_mount, d);
 
         mac_selinux_create_file_prepare(d, st.st_mode);
         r = mknod(dn, st.st_mode, st.st_rdev);
         mac_selinux_create_file_clear();
-
         if (r < 0)
                 return log_debug_errno(errno, "mknod failed for %s: %m", d);
 

From 36ce7110b05128d124a43d515abe95c16f72530b Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 23 Jan 2018 19:36:55 +0100
Subject: [PATCH 2/3] namespace: use is_symlink() helper

We have this prett ylittle helper, let's use it, it makes things a tiny
bit more readable.
---
 src/core/namespace.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 7b9ef85ff8..565b954482 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -42,6 +42,7 @@
 #include "path-util.h"
 #include "selinux-util.h"
 #include "socket-util.h"
+#include "stat-util.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
@@ -537,7 +538,6 @@ static int mount_private_dev(MountEntry *m) {
         char temporary_mount[] = "/tmp/namespace-dev-XXXXXX";
         const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL;
         _cleanup_umask_ mode_t u;
-        struct stat st;
         int r;
 
         assert(m);
@@ -567,11 +567,10 @@ static int mount_private_dev(MountEntry *m) {
          *
          * in nspawn and other containers it will be a symlink, in that case make it a symlink
          */
-        if (lstat("/dev/ptmx", &st) < 0) {
-                r = -errno;
+        r = is_symlink("/dev/ptmx");
+        if (r < 0)
                 goto fail;
-        }
-        if (S_ISLNK(st.st_mode)) {
+        if (r > 0) {
                 devptmx = strjoina(temporary_mount, "/dev/ptmx");
                 if (symlink("pts/ptmx", devptmx) < 0) {
                         r = -errno;

From 152c475f95c7b9b20d293dafea06108b0c488866 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 23 Jan 2018 19:37:59 +0100
Subject: [PATCH 3/3] namepace: fix error handling when clone_device_node()
 returns 0

Before this patch, we'd treat clone_device_node() returning 0 (as
opposed to 1) as error, but then propagate this non-error result in
confusion.

This makes sure that if we ptmx isn't around we propagate that as
-ENXIO.

This is a follow-up for 98b1d2b8d9ea27087a5980b4b902b6a6ab716e03
---
 src/core/namespace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 565b954482..70089f212a 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -578,8 +578,12 @@ static int mount_private_dev(MountEntry *m) {
                 }
         } else {
                 r = clone_device_node("/dev/ptmx", temporary_mount);
-                if (r != 1)
+                if (r < 0)
                         goto fail;
+                if (r == 0) {
+                        r = -ENXIO;
+                        goto fail;
+                }
         }
 
         devshm = strjoina(temporary_mount, "/dev/shm");