TOCTOU and lifecycle races across runtime boundaries fixes

src/util/secure_fs/mod.rs

@@ -9,7 +9,7 @@ mod write;
 
 pub(crate) use path::{
     AnchoredPath, chdir_nofollow_or_create, open_dir_nofollow,
-    open_dir_nofollow_or_create, open_trusted_dir_nofollow_or_create,
+    open_trusted_dir_nofollow_or_create,
 };
 pub(crate) use write::{
     atomic_replace, atomic_replace_async, open_append_regular, open_append_regular_at,

src/util/secure_fs/path.rs

@@ -182,10 +182,11 @@ fn validate_trusted_directory(descriptor: &OwnedFd, allow_sticky_parent: bool) -
 
 /// Creates missing components and changes cwd to the exact opened directory inode.
 pub(crate) fn chdir_nofollow_or_create(path: &Path, mode: u32) -> io::Result<()> {
-    let descriptor = open_or_create_dir_nofollow(path, mode)?;
+    let descriptor = open_dir_nofollow_or_create(path, mode)?;
     nix::unistd::fchdir(&descriptor).map_err(errno_to_io)
 }
 
+/// Converts one `nix` errno without discarding its platform error code.
 pub(super) fn errno_to_io(error: nix::errno::Errno) -> io::Error {
     io::Error::from_raw_os_error(error as i32)
 }

src/util/trusted_command.rs

@@ -2,7 +2,18 @@ use std::os::unix::fs::{MetadataExt, PermissionsExt};
 use std::path::{Path, PathBuf};
 
 const TRUSTED_HELPER_DIRS: [&str; 4] = ["/usr/sbin", "/usr/bin", "/sbin", "/bin"];
-const TRUSTED_HELPERS: [&str; 5] = ["nft", "iptables", "ip6tables", "conntrack", "pfctl"];
+const TRUSTED_HELPERS: [&str; 10] = [
+    "nft",
+    "iptables",
+    "ip6tables",
+    "conntrack",
+    "pfctl",
+    "systemctl",
+    "rc-update",
+    "rc-service",
+    "sysrc",
+    "service",
+];
 
 /// Resolves a privileged helper only through the fixed system allowlist.
 pub(crate) fn resolve_trusted_helper(binary: &str) -> Option<PathBuf> {