Merge pull request #34638 from YHNdnzj/laccess-error-check

various: correct laccess() error check

18 files changed, 64 insertions, 58 deletions

diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
index b3cd2c27a6..223bcdfbcf 100644
--- a/src/basic/cgroup-util.c
+++ b/src/basic/cgroup-util.c
@@ -623,7 +623,7 @@ static int controller_is_v1_accessible(const char *root, const char *controller)
          * - we can modify the hierarchy. */
 
         cpath = strjoina("/sys/fs/cgroup/", dn, root, root ? "/cgroup.procs" : NULL);
-        return laccess(cpath, root ? W_OK : F_OK);
+        return access_nofollow(cpath, root ? W_OK : F_OK);
 }
 
 int cg_get_path_and_check(const char *controller, const char *path, const char *suffix, char **ret) {
diff --git a/src/basic/fs-util.h b/src/basic/fs-util.h
index 2ec4b196f8..82e865180b 100644
--- a/src/basic/fs-util.h
+++ b/src/basic/fs-util.h
@@ -49,7 +49,7 @@ int futimens_opath(int fd, const struct timespec ts[2]);
 int fd_warn_permissions(const char *path, int fd);
 int stat_warn_permissions(const char *path, const struct stat *st);
 
-#define laccess(path, mode)                                             \
+#define access_nofollow(path, mode)                                             \
         RET_NERRNO(faccessat(AT_FDCWD, (path), (mode), AT_SYMLINK_NOFOLLOW))
 
 int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode);
diff --git a/src/basic/os-util.c b/src/basic/os-util.c
index 4eec2f6014..21b6f669e6 100644
--- a/src/basic/os-util.c
+++ b/src/basic/os-util.c
@@ -97,8 +97,9 @@ int path_is_extension_tree(ImageClass image_class, const char *path, const char
         /* Does the path exist at all? If not, generate an error immediately. This is useful so that a missing root dir
          * always results in -ENOENT, and we can properly distinguish the case where the whole root doesn't exist from
          * the case where just the os-release file is missing. */
-        if (laccess(path, F_OK) < 0)
-                return -errno;
+        r = access_nofollow(path, F_OK);
+        if (r < 0)
+                return r;
 
         /* We use /usr/lib/extension-release.d/extension-release[.NAME] as flag for something being a system extension,
          * /etc/extension-release.d/extension-release[.NAME] as flag for something being a system configuration, and finally,
diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
index 540256b73b..234b197394 100644
--- a/src/basic/path-lookup.c
+++ b/src/basic/path-lookup.c
@@ -904,6 +904,7 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
 
 int find_portable_profile(const char *name, const char *unit, char **ret_path) {
         const char *dot;
+        int r;
 
         assert(name);
         assert(ret_path);
@@ -917,13 +918,13 @@ int find_portable_profile(const char *name, const char *unit, char **ret_path) {
                 if (!joined)
                         return -ENOMEM;
 
-                if (laccess(joined, F_OK) >= 0) {
+                r = access_nofollow(joined, F_OK);
+                if (r >= 0) {
                         *ret_path = TAKE_PTR(joined);
                         return 0;
                 }
-
-                if (errno != ENOENT)
-                        return -errno;
+                if (r != -ENOENT)
+                        return r;
         }
 
         return -ENOENT;
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index 9c2b13275e..becc2b92ef 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -2345,7 +2345,7 @@ static int setup_exec_directory(
                         assert_cc(EXEC_DIRECTORY_STATE < EXEC_DIRECTORY_LOGS);
                         assert_cc(EXEC_DIRECTORY_LOGS < EXEC_DIRECTORY_CONFIGURATION);
 
-                        r = laccess(p, F_OK);
+                        r = access_nofollow(p, F_OK);
                         if (r == -ENOENT) {
                                 _cleanup_free_ char *q = NULL;
 
@@ -2363,7 +2363,7 @@ static int setup_exec_directory(
                                         goto fail;
                                 }
 
-                                r = laccess(q, F_OK);
+                                r = access_nofollow(q, F_OK);
                                 if (r >= 0) {
                                         /* It does exist! This hence looks like an update. Symlink the
                                          * configuration directory into the state directory. */
@@ -2429,7 +2429,7 @@ static int setup_exec_directory(
                                 goto fail;
 
                         if (is_dir(p, false) > 0 &&
-                            (laccess(pp, F_OK) == -ENOENT)) {
+                            (access_nofollow(pp, F_OK) == -ENOENT)) {
 
                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
                                  * it over. Most likely the service has been upgraded from one that didn't use
diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 4a01fea5f9..722b5b7529 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -1525,8 +1525,9 @@ static int forward_coredump_to_container(Context *context) {
 
                 pair[0] = safe_close(pair[0]);
 
-                if (laccess("/run/systemd/coredump", W_OK) < 0) {
-                        log_debug_errno(errno, "Cannot find coredump socket, exiting: %m");
+                r = access_nofollow("/run/systemd/coredump", W_OK);
+                if (r < 0) {
+                        log_debug_errno(r, "Cannot find coredump socket, exiting: %m");
                         _exit(EXIT_FAILURE);
                 }
 
diff --git a/src/home/homework-luks.c b/src/home/homework-luks.c
index b859658f00..7c3be8dd9a 100644
--- a/src/home/homework-luks.c
+++ b/src/home/homework-luks.c
@@ -1997,11 +1997,11 @@ static int wait_for_devlink(const char *path) {
                 _cleanup_free_ char *dn = NULL;
                 usec_t w;
 
-                if (laccess(path, F_OK) < 0) {
-                        if (errno != ENOENT)
-                                return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
-                } else
+                r = access_nofollow(path, F_OK);
+                if (r >= 0)
                         return 0; /* Found it */
+                if (r != -ENOENT)
+                        return log_error_errno(r, "Failed to determine whether %s exists: %m", path);
 
                 if (inotify_fd < 0) {
                         /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
diff --git a/src/kernel-install/kernel-install.c b/src/kernel-install/kernel-install.c
index a937d03166..f4f30df07d 100644
--- a/src/kernel-install/kernel-install.c
+++ b/src/kernel-install/kernel-install.c
@@ -1110,13 +1110,11 @@ static int kernel_from_version(const char *version, char **ret_kernel) {
         if (!vmlinuz)
                 return log_oom();
 
-        r = laccess(vmlinuz, F_OK);
-        if (r < 0) {
-                if (r == -ENOENT)
-                        return log_error_errno(r, "Kernel image not installed to '%s', requiring manual kernel image path specification.", vmlinuz);
-
+        r = access_nofollow(vmlinuz, F_OK);
+        if (r == -ENOENT)
+                return log_error_errno(r, "Kernel image not installed to '%s', requiring manual kernel image path specification.", vmlinuz);
+        if (r < 0)
                 return log_error_errno(r, "Failed to determine if kernel image is installed to '%s': %m", vmlinuz);
-        }
 
         *ret_kernel = TAKE_PTR(vmlinuz);
         return 0;
diff --git a/src/libsystemd/sd-daemon/sd-daemon.c b/src/libsystemd/sd-daemon/sd-daemon.c
index 4945d82150..b5469b5d98 100644
--- a/src/libsystemd/sd-daemon/sd-daemon.c
+++ b/src/libsystemd/sd-daemon/sd-daemon.c
@@ -738,17 +738,18 @@ _public_ int sd_pid_notifyf_with_fds(
 }
 
 _public_ int sd_booted(void) {
-        /* We test whether the runtime unit file directory has been
-         * created. This takes place in mount-setup.c, so is
-         * guaranteed to happen very early during boot. */
+        int r;
 
-        if (laccess("/run/systemd/system/", F_OK) >= 0)
-                return true;
+        /* We test whether the runtime unit file directory has been created. This takes place in mount-setup.c,
+         * so is guaranteed to happen very early during boot. */
 
-        if (errno == ENOENT)
+        r = access_nofollow("/run/systemd/system/", F_OK);
+        if (r >= 0)
+                return true;
+        if (r == -ENOENT)
                 return false;
 
-        return -errno;
+        return r;
 }
 
 _public_ int sd_watchdog_enabled(int unset_environment, uint64_t *usec) {
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index fb1954320e..47eff33e46 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -6154,7 +6154,7 @@ static int run(int argc, char *argv[]) {
                                 goto finish;
                         }
 
-                        if (laccess(p, F_OK) < 0) {
+                        if (access_nofollow(p, F_OK) < 0) {
                                 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                                     "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                 goto finish;
diff --git a/src/portable/portablectl.c b/src/portable/portablectl.c
index e4eb437b2e..7f770f5f92 100644
--- a/src/portable/portablectl.c
+++ b/src/portable/portablectl.c
@@ -69,7 +69,7 @@ static int determine_image(const char *image, bool permit_non_existing, char **r
         if (image_name_is_valid(image)) {
                 char *c;
 
-                if (!arg_quiet && laccess(image, F_OK) >= 0)
+                if (!arg_quiet && access_nofollow(image, F_OK) >= 0)
                         log_warning("Ambiguous invocation: current working directory contains file matching non-path argument '%s', ignoring. "
                                     "Prefix argument with './' to force reference to file in current working directory.", image);
 
diff --git a/src/shared/condition.c b/src/shared/condition.c
index da5c6f6309..9dfa1f8901 100644
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -169,10 +169,11 @@ static int condition_test_credential(Condition *c, char **env) {
                 if (!j)
                         return -ENOMEM;
 
-                if (laccess(j, F_OK) >= 0)
+                r = access_nofollow(j, F_OK);
+                if (r >= 0)
                         return true; /* yay! */
-                if (errno != ENOENT)
-                        return -errno;
+                if (r != -ENOENT)
+                        return r;
 
                 /* not found in this dir */
         }
diff --git a/src/shared/journal-util.c b/src/shared/journal-util.c
index 11d5d68478..85b369c36d 100644
--- a/src/shared/journal-util.c
+++ b/src/shared/journal-util.c
@@ -34,7 +34,7 @@ static int access_check_var_log_journal(sd_journal *j, bool want_other_users) {
         _cleanup_strv_free_ char **g = NULL;
         const char* dir;
 
-        if (laccess("/run/log/journal", F_OK) >= 0)
+        if (access_nofollow("/run/log/journal", F_OK) >= 0)
                 dir = "/run/log/journal";
         else
                 dir = "/var/log/journal";
diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c
index d98df3809d..1353395c89 100644
--- a/src/shared/mount-util.c
+++ b/src/shared/mount-util.c
@@ -427,8 +427,9 @@ int bind_remount_one_with_mountinfo(
 
         fs = mnt_table_find_target(table, path, MNT_ITER_FORWARD);
         if (!fs) {
-                if (laccess(path, F_OK) < 0) /* Hmm, it's not in the mount table, but does it exist at all? */
-                        return -errno;
+                r = access_nofollow(path, F_OK); /* Hmm, it's not in the mount table, but does it exist at all? */
+                if (r < 0)
+                        return r;
 
                 return -EINVAL; /* Not a mount point we recognize */
         }
@@ -878,7 +879,7 @@ static int mount_in_namespace_legacy(
         assert(!options || (flags & MOUNT_IN_NAMESPACE_IS_IMAGE));
 
         p = strjoina(propagate_path, "/");
-        r = laccess(p, F_OK);
+        r = access_nofollow(p, F_OK);
         if (r < 0)
                 return log_debug_errno(r == -ENOENT ? SYNTHETIC_ERRNO(EOPNOTSUPP) : r, "Target does not allow propagation of mount points");
 
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index b40f5b7b47..f6b38d6615 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -1760,13 +1760,11 @@ static int merge_subprocess(
                 if (!p)
                         return log_oom();
 
-                if (laccess(p, F_OK) < 0) {
-                        if (errno != ENOENT)
-                                return log_error_errno(errno, "Failed to check if '%s' exists: %m", p);
-
-                        /* Hierarchy apparently was empty in all extensions, and wasn't mounted, ignoring. */
+                r = access_nofollow(p, F_OK);
+                if (r == -ENOENT) /* Hierarchy apparently was empty in all extensions, and wasn't mounted, ignoring. */
                         continue;
-                }
+                if (r < 0)
+                        return log_error_errno(r, "Failed to check if '%s' exists: %m", p);
 
                 r = chase(*h, arg_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved, NULL);
                 if (r < 0)
diff --git a/src/system-update-generator/system-update-generator.c b/src/system-update-generator/system-update-generator.c
index a1782d5c05..8be8879dec 100644
--- a/src/system-update-generator/system-update-generator.c
+++ b/src/system-update-generator/system-update-generator.c
@@ -20,22 +20,26 @@
 static const char *arg_dest = NULL;
 
 static int generate_symlink(void) {
+        int r;
+
         FOREACH_STRING(p, "/system-update", "/etc/system-update") {
-                if (laccess(p, F_OK) >= 0) {
-                        _cleanup_free_ char *j = NULL;
+                r = access_nofollow(p, F_OK);
+                if (r < 0) {
+                        if (r != -ENOENT)
+                                log_warning_errno(r, "Failed to check if %s symlink exists, ignoring: %m", p);
+                        continue;
+                }
 
-                        j = path_join(arg_dest, SPECIAL_DEFAULT_TARGET);
-                        if (!j)
-                                return log_oom();
+                _cleanup_free_ char *j = NULL;
 
-                        if (symlink(SYSTEM_DATA_UNIT_DIR "/system-update.target", j) < 0)
-                                return log_error_errno(errno, "Failed to create symlink %s: %m", j);
+                j = path_join(arg_dest, SPECIAL_DEFAULT_TARGET);
+                if (!j)
+                        return log_oom();
 
-                        return 1;
-                }
+                if (symlink(SYSTEM_DATA_UNIT_DIR "/system-update.target", j) < 0)
+                        return log_error_errno(errno, "Failed to create symlink %s: %m", j);
 
-                if (errno != ENOENT)
-                        log_warning_errno(errno, "Failed to check if %s symlink exists, ignoring: %m", p);
+                return 1;
         }
 
         return 0;
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 825818fbae..a7655aad1c 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -3900,7 +3900,7 @@ static int parse_line(
 
                 path_simplify(i.argument);
 
-                if (laccess(i.argument, F_OK) == -ENOENT) {
+                if (access_nofollow(i.argument, F_OK) == -ENOENT) {
                         /* Silently skip over lines where the source file is missing. */
                         log_syntax(NULL, LOG_DEBUG, fname, line, 0,
                                    "Copy source path '%s' does not exist, skipping line.", i.argument);
diff --git a/src/udev/udevadm-wait.c b/src/udev/udevadm-wait.c
index 6ffc86bbf1..39e31ad2bf 100644
--- a/src/udev/udevadm-wait.c
+++ b/src/udev/udevadm-wait.c
@@ -52,7 +52,7 @@ static int check_device(const char *path) {
         assert(path);
 
         if (arg_wait_until == WAIT_UNTIL_REMOVED) {
-                r = laccess(path, F_OK);
+                r = access_nofollow(path, F_OK);
                 if (r == -ENOENT)
                         return true;
                 if (r < 0)