diff options
| author | Topi Miettinen <toiwoton@gmail.com> | 2020-03-10 16:43:10 +0200 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2020-03-18 20:24:51 +0100 |
| commit | af339a3122be302446ec79b76123fd4661a120f9 (patch) | |
| tree | 69899fd704d737eec2dadd34a2f3c1e3520cd9fc | |
| parent | d58988be7fab2bf3e037ccf175f3cace41f82b80 (diff) | |
| download | systemd-af339a3122be302446ec79b76123fd4661a120f9.tar.gz | |
namespace: ignore prefix chars when comparing paths
Other callers of path_strv_contains() or PATH_IN_SET() don't seem to handle
paths prefixed with -+.
(cherry picked from commit de46b2be07538b55df0ba5e312a89eebb87c710a)
| -rw-r--r-- | src/basic/path-util.c | 16 | ||||
| -rw-r--r-- | src/basic/path-util.h | 1 | ||||
| -rw-r--r-- | src/core/namespace.c | 8 |
3 files changed, 21 insertions, 4 deletions
diff --git a/src/basic/path-util.c b/src/basic/path-util.c index 49a211a527..ba13de01ff 100644 --- a/src/basic/path-util.c +++ b/src/basic/path-util.c @@ -1125,3 +1125,19 @@ bool path_strv_contains(char **l, const char *path) { return false; } + +bool prefixed_path_strv_contains(char **l, const char *path) { + char **i, *j; + + STRV_FOREACH(i, l) { + j = *i; + if (*j == '-') + j++; + if (*j == '+') + j++; + if (path_equal(j, path)) + return true; + } + + return false; +} diff --git a/src/basic/path-util.h b/src/basic/path-util.h index f49a876f3d..30031fca8e 100644 --- a/src/basic/path-util.h +++ b/src/basic/path-util.h @@ -173,3 +173,4 @@ static inline const char *empty_to_root(const char *path) { } bool path_strv_contains(char **l, const char *path); +bool prefixed_path_strv_contains(char **l, const char *path); diff --git a/src/core/namespace.c b/src/core/namespace.c index cda9d2ca1d..a461a3cce4 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -1192,7 +1192,7 @@ static bool root_read_only( if (protect_system == PROTECT_SYSTEM_STRICT) return true; - if (path_strv_contains(read_only_paths, "/")) + if (prefixed_path_strv_contains(read_only_paths, "/")) return true; return false; @@ -1217,9 +1217,9 @@ static bool home_read_only( if (protect_home != PROTECT_HOME_NO) return true; - if (path_strv_contains(read_only_paths, "/home") || - path_strv_contains(inaccessible_paths, "/home") || - path_strv_contains(empty_directories, "/home")) + if (prefixed_path_strv_contains(read_only_paths, "/home") || + prefixed_path_strv_contains(inaccessible_paths, "/home") || + prefixed_path_strv_contains(empty_directories, "/home")) return true; for (i = 0; i < n_temporary_filesystems; i++) |