From 8688a389cabdff61efe187bb85cc1776de03c460 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 6 Oct 2021 00:19:41 +0900 Subject: [PATCH] core/service: also check path in exec commands --- src/core/service.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/core/service.c b/src/core/service.c index 4c75819a8fb..54d8d0c7607 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -567,11 +567,17 @@ static int service_verify(Service *s) { for (ServiceExecCommand c = 0; c < _SERVICE_EXEC_COMMAND_MAX; c++) { ExecCommand *command; - LIST_FOREACH(command, command, s->exec_command[c]) + LIST_FOREACH(command, command, s->exec_command[c]) { + if (!path_is_absolute(command->path) && !filename_is_valid(command->path)) + return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), + "Service %s= binary path \"%s\" is neither a valid executable name nor an absolute path. Refusing.", + command->path, + service_exec_command_to_string(c)); if (strv_isempty(command->argv)) return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), "Service has an empty argv in %s=. Refusing.", service_exec_command_to_string(c)); + } } if (!s->exec_command[SERVICE_EXEC_START] && !s->exec_command[SERVICE_EXEC_STOP] && -- 2.47.3