execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink

It should be OK to allow one level of symlink for the various types of directories like StateDirectory=, LogsDirectory= and such.
2023-06-28 22:01:07 +02:00
parent d9e5137185
commit d5602c1632
4 changed files with 8 additions and 5 deletions
@@ -2689,7 +2689,7 @@ static int setup_exec_directory(
                /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
                 * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
                 * assignments to exist. */
-                r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
+                r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777, AT_SYMLINK_FOLLOW);
                if (r < 0)
                        goto fail;
        }