run: Use O_PATH fds for the runtime and app deploy directories

Browse Source

This also allows us to use glnx_chaseat, and other at-functions to
traverse the filesystem tree in a safe way.

This is important because the app and runtime deploy directories can be
under an attackers control. The flatpak portal for example allows
sandboxed apps to provide them.

In particular, attacks where the deploy dirs get replaced by a symlink
pointing into the host system will be stopped by this.

Note that this change alone is not enough to avoid the attack, and the
portal has to be changed as well.

...

This commit is contained in:

500 Internal Server Error

Gitea Version: 1.28.0+dev-477-g8b6ad49a5f