From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 10 Jul 2026 17:48:35 +0000 (+0100)
Subject: shift-uid: close consumed directory fds on early return
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3eafb10a0b886876316bca6f9af06db67308ad0;p=thirdparty%2Fsystemd.git

shift-uid: close consumed directory fds on early return

recurse_fd() consumes each directory fd passed to it, but it has no
cleanup set up until after take_fdopendir() succeeds.
Errors and skipped procfs, sysfs, or read-only subtrees therefore leak the
incoming fd.

Follow-up for b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d
---

diff --git a/src/shared/shift-uid.c b/src/shared/shift-uid.c
index e455306be91..e1c53dcb884 100644
--- a/src/shared/shift-uid.c
+++ b/src/shared/shift-uid.c
@@ -295,8 +295,9 @@ static int is_fs_fully_userns_compatible(const struct statfs *sfs) {
                F_TYPE_EQUAL(sfs->f_type, SYSFS_MAGIC);
 }
 
-static int recurse_fd(int fd, const struct stat *st, uid_t shift, bool is_toplevel) {
+static int recurse_fd(int input_fd, const struct stat *st, uid_t shift, bool is_toplevel) {
         _cleanup_closedir_ DIR *d = NULL;
+        _cleanup_close_ int fd = input_fd;
         bool changed = false;
         struct statfs sfs;
         int r;