On Tue, Aug 18, 2026 at 03:53:58PM -0600, Jim Fehlig via Devel wrote:
From: Jim Fehlig <[email protected]>libvirt chown()s the swtpm log file to the swtpm user:group when starting a VM. The swtpm log directory is writable by swtmp user, who could replace the logfile with a symlink to a root-owned path. At next VM start, libvirt will chown() that path to the swtpm user:group, which breaks the intended separation between the confined swtpm account and root-owned files. Use fchown() on an fd opened with O_NOFOLLOW to avoid the potential symlink attack.
I thought the O_NOFOLLOW was a BSDism and went to check whether it is POSIX or not. I looked at the man page and instantly felt old.
Signed-off-by: Jim Fehlig <[email protected]>
Reviewed-by: Martin Kletzander <[email protected]>
signature.asc
Description: PGP signature
