{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/762","labels_url":"https://api.github.com/repos/systemd/systemd/issues/762/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/762/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/762/events","html_url":"https://github.com/systemd/systemd/pull/762","id":97825120,"number":762,"title":"tmpfiles: Make sure not to follow symlinks when recursing","user":{"login":"magcius","id":40890,"avatar_url":"https://avatars.githubusercontent.com/u/40890?v=3","gravatar_id":"","url":"https://api.github.com/users/magcius","html_url":"https://github.com/magcius","followers_url":"https://api.github.com/users/magcius/followers","following_url":"https://api.github.com/users/magcius/following{/other_user}","gists_url":"https://api.github.com/users/magcius/gists{/gist_id}","starred_url":"https://api.github.com/users/magcius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magcius/subscriptions","organizations_url":"https://api.github.com/users/magcius/orgs","repos_url":"https://api.github.com/users/magcius/repos","events_url":"https://api.github.com/users/magcius/events{/privacy}","received_events_url":"https://api.github.com/users/magcius/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-28T23:48:43Z","updated_at":"2015-07-29T05:45:09Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/systemd/systemd/pulls/762","html_url":"https://github.com/systemd/systemd/pull/762","diff_url":"https://github.com/systemd/systemd/pull/762.diff","patch_url":"https://github.com/systemd/systemd/pull/762.patch"},"body":"The code below was extremely careful not to follow symlinks when\r\nrecursing through the tmpfiles directory, but it unfortunately forgot\r\nto tell fstatat() not to resolve them."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/125849782","html_url":"https://github.com/systemd/systemd/pull/762#issuecomment-125849782","issue_url":"https://api.github.com/repos/systemd/systemd/issues/762","id":125849782,"user":{"login":"magcius","id":40890,"avatar_url":"https://avatars.githubusercontent.com/u/40890?v=3","gravatar_id":"","url":"https://api.github.com/users/magcius","html_url":"https://github.com/magcius","followers_url":"https://api.github.com/users/magcius/followers","following_url":"https://api.github.com/users/magcius/following{/other_user}","gists_url":"https://api.github.com/users/magcius/gists{/gist_id}","starred_url":"https://api.github.com/users/magcius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magcius/subscriptions","organizations_url":"https://api.github.com/users/magcius/orgs","repos_url":"https://api.github.com/users/magcius/repos","events_url":"https://api.github.com/users/magcius/events{/privacy}","received_events_url":"https://api.github.com/users/magcius/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T05:45:09Z","updated_at":"2015-07-29T05:45:09Z","body":"The fd is opened above with `O_PATH`, which, for my understanding, just returns a dummy fd which refers to the inode, and doesn't follow symlinks upon opening.\r\n\r\nThe behavior here we were seeing is that tmpfiles, when doing a recursive `chown` using the `Z` mode, would follow symlinks which would cause us to not modify the symlink permissions, and instead try to change where it points to. This is especially bad if we had a symlink to `/` or `/usr/` which caused it to recursively chown the entire directory. Thankfully, we had it mounted as root-only, so it only caused a bunch of spew in our logs.\r\n\r\nThere seems to be code immediately below that `fstatat` which looks at `S_ISLNK` on the resulting stat, so it definitely seems like it was trying to pay attention to symlinks and ignore them."}}