From d61fd29d854b416feaaf128bf650325cd2182165 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Sat, 19 Jul 2025 16:30:26 +1000 Subject: [PATCH] libct/system: use securejoin for /proc/$pid/stat Signed-off-by: Aleksa Sarai --- libcontainer/system/proc.go | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/libcontainer/system/proc.go b/libcontainer/system/proc.go index 774443ec9..34850dd83 100644 --- a/libcontainer/system/proc.go +++ b/libcontainer/system/proc.go @@ -2,10 +2,12 @@ package system import ( "fmt" + "io" "os" - "path/filepath" "strconv" "strings" + + "github.com/opencontainers/runc/internal/pathrs" ) // State is the status of a process. @@ -66,8 +68,16 @@ type Stat_t struct { } // Stat returns a Stat_t instance for the specified process. -func Stat(pid int) (stat Stat_t, err error) { - bytes, err := os.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat")) +func Stat(pid int) (Stat_t, error) { + var stat Stat_t + + statFile, err := pathrs.ProcPidOpen(pid, "stat", os.O_RDONLY) + if err != nil { + return stat, err + } + defer statFile.Close() + + bytes, err := io.ReadAll(statFile) if err != nil { return stat, err }