From: Andres Beltran <abeltran@microsoft.com>
Date: Wed, 8 Jul 2026 19:06:16 +0000 (+0000)
Subject: tmpfiles: add hardening in glob_item_recursively
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=001c5dfdf55a05b038e6b5815d8604af22b3f67c;p=thirdparty%2Fsystemd.git

tmpfiles: add hardening in glob_item_recursively
---

diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 923c2c60f74..5d914bc4ba5 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -2897,10 +2897,9 @@ static int glob_item_recursively(
                 /* Make sure we won't trigger/follow file object (such as device nodes, automounts, ...)
                  * pointed out by 'fn' with O_PATH. Note, when O_PATH is used, flags other than
                  * O_CLOEXEC, O_DIRECTORY, and O_NOFOLLOW are ignored. */
-
-                fd = open(*fn, O_CLOEXEC|O_NOFOLLOW|O_PATH);
+                fd = path_open_safe(*fn);
                 if (fd < 0) {
-                        RET_GATHER(r, log_error_errno(errno, "Failed to open '%s': %m", *fn));
+                        RET_GATHER(r, fd);
                         continue;
                 }