From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Tue, 5 Oct 2021 15:19:41 +0000 (+0900)
Subject: core/service: also check path in exec commands
X-Git-Tag: v250-rc1~560^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F20935%2Fhead;p=thirdparty%2Fsystemd.git

core/service: also check path in exec commands
---

diff --git a/src/core/service.c b/src/core/service.c
index 4c75819a8fb..54d8d0c7607 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -567,11 +567,17 @@ static int service_verify(Service *s) {
         for (ServiceExecCommand c = 0; c < _SERVICE_EXEC_COMMAND_MAX; c++) {
                 ExecCommand *command;
 
-                LIST_FOREACH(command, command, s->exec_command[c])
+                LIST_FOREACH(command, command, s->exec_command[c]) {
+                        if (!path_is_absolute(command->path) && !filename_is_valid(command->path))
+                                return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC),
+                                                            "Service %s= binary path \"%s\" is neither a valid executable name nor an absolute path. Refusing.",
+                                                            command->path,
+                                                            service_exec_command_to_string(c));
                         if (strv_isempty(command->argv))
                                 return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC),
                                                             "Service has an empty argv in %s=. Refusing.",
                                                             service_exec_command_to_string(c));
+                }
         }
 
         if (!s->exec_command[SERVICE_EXEC_START] && !s->exec_command[SERVICE_EXEC_STOP] &&