From 83d5dab4de8a143e2380f09b1091551a7e33bd5b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 5 Feb 2024 17:11:12 +0100 Subject: [PATCH] nspawn: and also add comment, making clear chdir() should come late --- src/nspawn/nspawn.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 957bc582176..48394a3100e 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -3522,6 +3522,9 @@ static int inner_child( if (!barrier_place_and_sync(barrier)) /* #5 */ return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early"); + /* Note, this should be done this late (💣 and not moved earlier! 💣), so that all namespacing + * changes are already in effect by now, so that any resolved paths here definitely reference + * resources inside the container, and not outside of them. */ if (arg_chdir) if (chdir(arg_chdir) < 0) return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir); -- 2.47.3