From b4706afe06b9a76c44f200491056e8cbb4f1d403 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 11 Jun 2018 12:22:58 +0200
Subject: [PATCH] core: rework how we validate DeviceAllow= settings

Let's make sure we don't validate "char-*" and "block-*" expressions as
paths.
---
 src/basic/path-util.c | 29 +++++++++++++++++++++++++----
 src/basic/path-util.h |  4 +++-
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/src/basic/path-util.c b/src/basic/path-util.c
index 422543140..ed6d0f112 100644
--- a/src/basic/path-util.c
+++ b/src/basic/path-util.c
@@ -902,10 +902,31 @@ bool is_device_path(const char *path) {
                path_startswith(path, "/sys/");
 }
 
-bool is_deviceallow_pattern(const char *path) {
-        return path_startswith(path, "/dev/") ||
-               startswith(path, "block-") ||
-               startswith(path, "char-");
+bool valid_device_node_path(const char *path) {
+
+        /* Some superficial checks whether the specified path is a valid device node path, all without looking at the
+         * actual device node. */
+
+        if (!PATH_STARTSWITH_SET(path, "/dev/", "/run/systemd/inaccessible/"))
+                return false;
+
+        if (endswith(path, "/")) /* can't be a device node if it ends in a slash */
+                return false;
+
+        return path_is_normalized(path);
+}
+
+bool valid_device_allow_pattern(const char *path) {
+        assert(path);
+
+        /* Like valid_device_node_path(), but also allows full-subsystem expressions, like DeviceAllow= and DeviceDeny=
+         * accept it */
+
+        if (startswith(path, "block-") ||
+            startswith(path, "char-"))
+                return true;
+
+        return valid_device_node_path(path);
 }
 
 int systemd_installation_has_version(const char *root, unsigned minimal_version) {
diff --git a/src/basic/path-util.h b/src/basic/path-util.h
index 489a6c472..9f356c94d 100644
--- a/src/basic/path-util.h
+++ b/src/basic/path-util.h
@@ -160,7 +160,9 @@ bool hidden_or_backup_file(const char *filename) _pure_;
 
 #if 0 /// UNNEEDED by elogind
 bool is_device_path(const char *path);
-bool is_deviceallow_pattern(const char *path);
+
+bool valid_device_node_path(const char *path);
+bool valid_device_allow_pattern(const char *path);
 
 int systemd_installation_has_version(const char *root, unsigned minimal_version);
 #endif // 0
-- 
2.30.2