[PATCH container] fix #7380: get systemd version: avoid wrong /proc/PID/root link resolution

[PATCH container] fix #7380: get systemd version: avoid wrong /proc/PID/root link resolution

[Fiona Ebner]

Commit c30fb19 ("setup: constrain and untaint path for systemd version
detection") added an abs_path() call to resolve the path to the init
binary inside the container. However, when the rootdir is
/proc/$vmid/root, then abs_path() will fail to take into account the
namespacing and while walking the path, will resolve the link (example
output from stat):
> File: /proc/162278/root -> /
to the actual host root. Afterwards, the function would die because of
the path not being prefixed by the rootdir path.

The path to init binary is already resolved in get_ct_init_path() in a
protected call, but was not yet untainted. Revert the faulty
abs_path() call and instead untaint the result in get_ct_init_path()
so that check_systemd_nesting() can be called in a -T environment, like
the post-clone hook.

Fixes: c30fb19 ("setup: constrain and untaint path for systemd version detection")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/LXC/Setup.pm      | 1 +
 src/PVE/LXC/Setup/Base.pm | 9 +--------
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/PVE/LXC/Setup.pm b/src/PVE/LXC/Setup.pm
index 5387dc6..d936af2 100644
--- a/src/PVE/LXC/Setup.pm
+++ b/src/PVE/LXC/Setup.pm
@@ -390,6 +390,7 @@ sub get_ct_init_path {
         return $self->{plugin}->get_ct_init_path();
     });
 
+    ($init) = $init =~ m|(/.*)| or die "unable to resolve init path - got '$init'\n"; # untaint
     return $init;
 }
 
diff --git a/src/PVE/LXC/Setup/Base.pm b/src/PVE/LXC/Setup/Base.pm
index f679558..be7afde 100644
--- a/src/PVE/LXC/Setup/Base.pm
+++ b/src/PVE/LXC/Setup/Base.pm
@@ -605,16 +605,9 @@ sub clear_machine_id {
 sub get_systemd_version {
     my ($self, $init) = @_;
 
-    my $binary = abs_path($self->{rootdir} . $init);
-    if ($binary =~ /(^\Q$self->{rootdir}\E.*)/) {
-        $binary = $1; # untainted
-    } else {
-        die "Could not construct path to systemd binary: $self->{rootdir}, $init";
-    }
-
     my $version = undef;
     PVE::Tools::run_command(
-        ['objdump', '-p', $binary],
+        ['objdump', '-p', $self->{rootdir} . $init],
         outfunc => sub {
             my $line = shift;
             if ($line =~ /libsystemd-shared-(\d+)(?:[-_.][a-zA-Z0-9]+)*\.so:?$/) {
-- 
2.47.3