From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 17 May 2018 02:25:12 +0000 (-0400)
Subject: core: refuse StateDirectory=private, as our internal DynamicUser=1 symlink is called... 
X-Git-Tag: v239~247
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e8865688735ba3bd34297fa89cca6bde7ba33997;p=platform%2Fupstream%2Fsystemd.git

core: refuse StateDirectory=private, as our internal DynamicUser=1 symlink is called that way

Let's better be safe than sorry.
---

diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index e17987b..72c6e10 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -3988,9 +3988,21 @@ int config_parse_exec_directories(
                         continue;
                 }
 
-                if (!path_is_normalized(k) || path_is_absolute(k)) {
+                if (!path_is_normalized(k)) {
                         log_syntax(unit, LOG_ERR, filename, line, 0,
-                                   "%s= path is not valid, ignoring assignment: %s", lvalue, rvalue);
+                                   "%s= path is not normalized, ignoring assignment: %s", lvalue, rvalue);
+                        continue;
+                }
+
+                if (path_is_absolute(k)) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0,
+                                   "%s= path is absolute, ignoring assignment: %s", lvalue, rvalue);
+                        continue;
+                }
+
+                if (path_startswith(k, "private")) {
+                        log_syntax(unit, LOG_ERR, filename, line, 0,
+                                   "%s= path can't be 'private', ingoring assignment: %s", lvalue, rvalue);
                         continue;
                 }