From 0d2c41d0f024088a275ac0c02d50205c800dec8a Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Thu, 26 Feb 2026 11:06:34 +0100 Subject: [PATCH 4/4] core: validate input cgroup path more prudently (cherry picked from commit efa6ba2ab625aaa160ac435a09e6482fc63bdbe8) (cherry picked from commit 3cee294fe8cf4fa0eff933ab21416d099942cabd) (cherry picked from commit 1d22f706bd04f45f8422e17fbde3f56ece17758a) CVE: CVE-2026-29111 Upstream-Status: Backport [https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f] Signed-off-by: Jaipaul Cheernam --- src/core/dbus-manager.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c index c7372ca033..cb84ba9866 100644 --- a/src/core/dbus-manager.c +++ b/src/core/dbus-manager.c @@ -646,6 +646,12 @@ static int method_get_unit_by_control_group(sd_bus_message *message, void *userd if (r < 0) return r; + if (!path_is_absolute(cgroup)) + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not absolute: %s", cgroup); + + if (!path_is_normalized(cgroup)) + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Control group path is not normalized: %s", cgroup); + u = manager_get_unit_by_cgroup(m, cgroup); if (!u) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, -- 2.43.0