From: Christian Brauner Date: Thu, 4 Feb 2021 14:05:43 +0000 (+0100) Subject: cgroups: restrict open calls in cgroup_attach_create_leaf() X-Git-Tag: lxc-5.0.0~301^2~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7043e2b4704415cbad0ee149f2f99f0ea622b179;p=thirdparty%2Flxc.git cgroups: restrict open calls in cgroup_attach_create_leaf() Signed-off-by: Christian Brauner --- diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c index f4eccbd76..6c13bd111 100644 --- a/src/lxc/cgroups/cgfsng.c +++ b/src/lxc/cgroups/cgfsng.c @@ -2311,12 +2311,12 @@ static int cgroup_attach_create_leaf(const struct lxc_conf *conf, if (ret < 0 && errno != EEXIST) return log_error_errno(-1, errno, "Failed to create leaf cgroup \".lxc\""); - target_fd0 = openat(unified_fd, ".lxc/cgroup.procs", O_WRONLY | O_CLOEXEC | O_NOFOLLOW); + target_fd0 = open_at(unified_fd, ".lxc/cgroup.procs", PROTECT_OPEN_W, PROTECT_LOOKUP_BENEATH, 0); if (target_fd0 < 0) return log_error_errno(-errno, errno, "Failed to open \".lxc/cgroup.procs\""); target_fds[0] = target_fd0; - target_fd1 = openat(unified_fd, "cgroup.procs", O_WRONLY | O_CLOEXEC | O_NOFOLLOW); + target_fd1 = open_at(unified_fd, "cgroup.procs", PROTECT_OPEN_W, PROTECT_LOOKUP_BENEATH, 0); if (target_fd1 < 0) return log_error_errno(-errno, errno, "Failed to open \".lxc/cgroup.procs\""); target_fds[1] = target_fd1;