diff options
| author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2021-10-06 18:53:51 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-06 18:53:51 +0200 |
| commit | d489317f5951850e91682b05ca7c96c5c3bc3f4d (patch) | |
| tree | e2dce6b1ff33be1fbf0291832fbdfef7af8bb364 /src/core/service.c | |
| parent | Merge pull request #18145 from kinvolk/iaguis/lsm-bpf (diff) | |
| parent | core/service: also check path in exec commands (diff) | |
| download | systemd-d489317f5951850e91682b05ca7c96c5c3bc3f4d.tar.xz systemd-d489317f5951850e91682b05ca7c96c5c3bc3f4d.zip | |
Merge pull request #20935 from unusual-thoughts/fix-empty-argv
Fix #20933
Diffstat (limited to 'src/core/service.c')
| -rw-r--r-- | src/core/service.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/core/service.c b/src/core/service.c index f331c45de0..16d9456719 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -564,6 +564,22 @@ static int service_verify(Service *s) { assert(s); assert(UNIT(s)->load_state == UNIT_LOADED); + for (ServiceExecCommand c = 0; c < _SERVICE_EXEC_COMMAND_MAX; c++) { + ExecCommand *command; + + LIST_FOREACH(command, command, s->exec_command[c]) { + if (!path_is_absolute(command->path) && !filename_is_valid(command->path)) + return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), + "Service %s= binary path \"%s\" is neither a valid executable name nor an absolute path. Refusing.", + command->path, + service_exec_command_to_string(c)); + if (strv_isempty(command->argv)) + return log_unit_error_errno(UNIT(s), SYNTHETIC_ERRNO(ENOEXEC), + "Service has an empty argv in %s=. Refusing.", + service_exec_command_to_string(c)); + } + } + if (!s->exec_command[SERVICE_EXEC_START] && !s->exec_command[SERVICE_EXEC_STOP] && UNIT(s)->success_action == EMERGENCY_ACTION_NONE) /* FailureAction= only makes sense if one of the start or stop commands is specified. |