basic/chase-symlinks: add note that CHASE_WARN is not for PID 1

This should be enough to make us remember that constraint. A more heavy-weight
approach like renaming the option to CHASE_WARN_NSS_LOOKUP would be possible,
but it'd make the callers quite verbose and doesn't seem worth it.

diff --git a/src/basic/chase-symlinks.c b/src/basic/chase-symlinks.c
index ad1c92900b605b7a4aacf56f61dee05c88978690..afab54f06758f328d271c293f2236c933166ffbe 100644 (file)
--- a/src/basic/chase-symlinks.c
+++ b/src/basic/chase-symlinks.c
@@ -125,11 +125,12 @@ int chase_symlinks(
          *
          * 4. With CHASE_SAFE: in this case the path must not contain unsafe transitions, i.e. transitions from
          *    unprivileged to privileged files or directories. In such cases the return value is -ENOLINK. If
-         *    CHASE_WARN is also set, a warning describing the unsafe transition is emitted.
+         *    CHASE_WARN is also set, a warning describing the unsafe transition is emitted. CHASE_WARN cannot
+         *    be used in PID 1.
          *
          * 5. With CHASE_NO_AUTOFS: in this case if an autofs mount point is encountered, path normalization
          *    is aborted and -EREMOTE is returned. If CHASE_WARN is also set, a warning showing the path of
-         *    the mount point is emitted.
+         *    the mount point is emitted. CHASE_WARN cannot be used in PID 1.
          */
 
         /* A root directory of "/" or "" is identical to none */

diff --git a/src/basic/chase-symlinks.h b/src/basic/chase-symlinks.h
index 7e45b0cbab5b02aca8c3fc3ce439d6117743df3c..a9ee58f9f73b1fd9193200781381b86b9ab90cbc 100644 (file)
--- a/src/basic/chase-symlinks.h
+++ b/src/basic/chase-symlinks.h
@@ -15,7 +15,8 @@ typedef enum ChaseSymlinksFlags {
         CHASE_STEP        = 1 << 5, /* Just execute a single step of the normalization */
         CHASE_NOFOLLOW    = 1 << 6, /* Do not follow the path's right-most component. With ret_fd, when the path's
                                      * right-most component refers to symlink, return O_PATH fd of the symlink. */
-        CHASE_WARN        = 1 << 7, /* Emit an appropriate warning when an error is encountered */
+        CHASE_WARN        = 1 << 7, /* Emit an appropriate warning when an error is encountered.
+                                     * Note: this may do an NSS lookup, hence this flag cannot be used in PID 1. */
 } ChaseSymlinksFlags;
 
 bool unsafe_transition(const struct stat *a, const struct stat *b);