File fix-CVE-2012-1174.patch of Package systemd.openSUSE_12.1_Update

Subject: util: never follow symlinks in rm_rf_children()

The function checks if the entry is a directory before recursing, but
there is a window between the check and the open, during which the
directory could be replaced with a symlink.
---
 src/util.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/src/util.c b/src/util.c
index e9869ea..f7f450f 100644
--- a/src/util.c
+++ b/src/util.c
@@ -3566,7 +3566,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
                 if (is_dir) {
                         int subdir_fd;
 
-                        if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
+                        subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
+                        if (subdir_fd < 0) {
                                 if (ret == 0 && errno != ENOENT)
                                         ret = -errno;
                                 continue;
-- 
1.7.7.6