From 66acd48f9d423e1a5551aa4cc6a8fab91ddec945 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 15 Apr 2026 01:44:21 +1000 Subject: [PATCH] rootfs: make cgroupv1 subsystem symlinks fd-based As with /dev symlinks, this was missed in commit d40b3439a961 ("rootfs: switch to fd-based handling of mountpoint targets"). It's not really clear to what extent this was exploitable (/sys/fs/cgroup is a tmpfs we create) but it's better to just fix this anyway. Fixes: d40b3439a961 ("rootfs: switch to fd-based handling of mountpoint targets") Signed-off-by: Aleksa Sarai --- libcontainer/rootfs_linux.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 7accf3648..71122dd21 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -387,7 +387,8 @@ func mountCgroupV1(m mountEntry, c *mountConfig) error { // symlink(2) is very dumb, it will just shove the path into // the link and doesn't do any checks or relative path // conversion. Also, don't error out if the cgroup already exists. - if err := os.Symlink(mc, filepath.Join(c.root.Name(), m.Destination, ss)); err != nil && !errors.Is(err, os.ErrExist) { + ssPath := filepath.Join(m.Destination, ss) + if err := pathrs.SymlinkInRoot(mc, c.root, ssPath); err != nil && !errors.Is(err, os.ErrExist) { return err } }