From: Mike Yuan <me@yhndnzj.com>
Date: Thu, 26 Feb 2026 10:06:34 +0000 (+0100)
Subject: core: validate input cgroup path more prudently
X-Git-Tag: v260-rc2~73^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=efa6ba2ab625aaa160ac435a09e6482fc63bdbe8;p=thirdparty%2Fsystemd.git

core: validate input cgroup path more prudently
---

diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index ad79c6e96ab..5e02d189072 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -652,6 +652,12 @@ static int method_get_unit_by_control_group(sd_bus_message *message, void *userd
         if (r < 0)
                 return r;
 
+        if (!path_is_absolute(cgroup))
+                return sd_bus_error_setf(reterr_error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not absolute: %s", cgroup);
+
+        if (!path_is_normalized(cgroup))
+                return sd_bus_error_setf(reterr_error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not normalized: %s", cgroup);
+
         u = manager_get_unit_by_cgroup(m, cgroup);
         if (!u)
                 return sd_bus_error_setf(reterr_error, BUS_ERROR_NO_SUCH_UNIT,
diff --git a/src/core/varlink-unit.c b/src/core/varlink-unit.c
index c554a11f5e4..3babe02732d 100644
--- a/src/core/varlink-unit.c
+++ b/src/core/varlink-unit.c
@@ -457,7 +457,7 @@ static int lookup_unit_by_parameters(
         }
 
         if (p->cgroup) {
-                if (!path_is_safe(p->cgroup))
+                if (!path_is_absolute(p->cgroup) || !path_is_normalized(p->cgroup))
                         return sd_varlink_error_invalid_parameter_name(link, "cgroup");
 
                 Unit *cgroup_unit = manager_get_unit_by_cgroup(manager, p->cgroup);