From 2d81c15de37a21275c1a0912d0feab3c4842666d Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 24 Sep 2026 16:40:59 +0100 Subject: [PATCH 1/2] Use O_PATH when opening parent directories Otherwise we need read permission on every path component from the root to the mount point. This isn't available if we are mounting onto the `$TMPDIR` created by `pam_tmpdir` or `pam_mktemp`, which create a root-owned directory with `a+x` but not `a+r` permission, and then a per-uid directory inside that. Fixes: c77dd38e "setup: Use O_PATH fds and disalllow symlink targest" Resolves: https://github.com/containers/bubblewrap/issues/806 Resolves: https://github.com/ValveSoftware/steam-runtime/issues/855 Signed-off-by: Simon McVittie --- bubblewrap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bubblewrap.c b/bubblewrap.c index 87da2307..30856da9 100644 --- a/bubblewrap.c +++ b/bubblewrap.c @@ -1042,7 +1042,7 @@ ensure_newroot_parents_at (const char *path, fn = xstrdup (path); p = fn; - cleanup_fd int parent_fd = openat_in_root ("/newroot", "/", O_DIRECTORY); + cleanup_fd int parent_fd = openat_in_root ("/newroot", "/", O_DIRECTORY | O_PATH); while (*p == '/') p++; @@ -1072,7 +1072,7 @@ ensure_newroot_parents_at (const char *path, char saved = *after_component; *after_component = 0; - cleanup_fd int new_parent_fd = openat_in_root ("/newroot", fn, O_DIRECTORY); + cleanup_fd int new_parent_fd = openat_in_root ("/newroot", fn, O_DIRECTORY | O_PATH); *after_component = saved; if (new_parent_fd < 0) return -1; From e45ef35bdfbe6536fc40bbb937295bb02cdf3bb5 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 24 Sep 2026 16:45:43 +0100 Subject: [PATCH 2/2] Also add O_CLOEXEC while I'm changing these lines already In this case it has no functional effect, because we close these fds with `cleanup_fd` before exec'ing anything (either within this function or in its only caller), but it's good to get into a habit of making all fds be close-on-exec except for the few that we specifically want to allow child processes to inherit. Signed-off-by: Simon McVittie --- bubblewrap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bubblewrap.c b/bubblewrap.c index 30856da9..2ab88d2f 100644 --- a/bubblewrap.c +++ b/bubblewrap.c @@ -1042,7 +1042,7 @@ ensure_newroot_parents_at (const char *path, fn = xstrdup (path); p = fn; - cleanup_fd int parent_fd = openat_in_root ("/newroot", "/", O_DIRECTORY | O_PATH); + cleanup_fd int parent_fd = openat_in_root ("/newroot", "/", O_DIRECTORY | O_PATH | O_CLOEXEC); while (*p == '/') p++; @@ -1072,7 +1072,7 @@ ensure_newroot_parents_at (const char *path, char saved = *after_component; *after_component = 0; - cleanup_fd int new_parent_fd = openat_in_root ("/newroot", fn, O_DIRECTORY | O_PATH); + cleanup_fd int new_parent_fd = openat_in_root ("/newroot", fn, O_DIRECTORY | O_PATH | O_CLOEXEC); *after_component = saved; if (new_parent_fd < 0) return -1;