From 72a19d2f382d11d3f10c6f439d35b8a8f0b16122 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Tue, 2 Feb 2021 09:54:10 +0100 Subject: [PATCH] attach: stricter lookup semantics for fdopen_at() calls Signed-off-by: Christian Brauner --- src/lxc/attach.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lxc/attach.c b/src/lxc/attach.c index 05ccb7a79..4f1fee271 100644 --- a/src/lxc/attach.c +++ b/src/lxc/attach.c @@ -229,7 +229,7 @@ static int userns_setup_ids(struct attach_context *ctx, if (!(options->namespaces & CLONE_NEWUSER)) return 0; - f_uidmap = fdopen_at(ctx->dfd_init_pid, "uid_map", "re", PROTECT_OPEN, PROTECT_LOOKUP_ABSOLUTE); + f_uidmap = fdopen_at(ctx->dfd_init_pid, "uid_map", "re", PROTECT_OPEN, PROTECT_LOOKUP_BENEATH); if (!f_uidmap) return log_error_errno(-errno, errno, "Failed to open uid_map"); @@ -249,7 +249,7 @@ static int userns_setup_ids(struct attach_context *ctx, } } - f_gidmap = fdopen_at(ctx->dfd_init_pid, "gid_map", "re", PROTECT_OPEN, PROTECT_LOOKUP_ABSOLUTE); + f_gidmap = fdopen_at(ctx->dfd_init_pid, "gid_map", "re", PROTECT_OPEN, PROTECT_LOOKUP_BENEATH); if (!f_gidmap) return log_error_errno(-errno, errno, "Failed to open gid_map"); @@ -314,7 +314,7 @@ static int parse_init_status(struct attach_context *ctx, lxc_attach_options_t *o bool caps_found = false; int ret; - f = fdopen_at(ctx->dfd_init_pid, "status", "re", PROTECT_OPEN, PROTECT_LOOKUP_ABSOLUTE); + f = fdopen_at(ctx->dfd_init_pid, "status", "re", PROTECT_OPEN, PROTECT_LOOKUP_BENEATH); if (!f) return log_error_errno(-errno, errno, "Failed to open status file"); -- 2.47.2