From 6b9132a9c40355356b4d4f5b20b6338c0eb74dfa Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 14 Feb 2014 16:35:18 +0100 Subject: [PATCH] nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first. --- src/nspawn/nspawn.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 3a6d428cd5..2a0edf6abc 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -1555,9 +1555,21 @@ int main(int argc, char *argv[]) { goto finish; } - if (arg_boot && path_is_os_tree(arg_directory) <= 0) { - log_error("Directory %s doesn't look like an OS root directory (/etc/os-release is missing). Refusing.", arg_directory); - goto finish; + if (arg_boot) { + if (path_is_os_tree(arg_directory) <= 0) { + log_error("Directory %s doesn't look like an OS root directory (/etc/os-release is missing). Refusing.", arg_directory); + goto finish; + } + } else { + const char *p; + + p = strappenda(arg_directory, + argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/"); + if (access(p, F_OK) < 0) { + log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory); + goto finish; + + } } log_close();