On Tue, Aug 18, 2026 at 03:53:58PM -0600, Jim Fehlig via Devel wrote:
From: Jim Fehlig <jfehlig@suse.com>
libvirt chown()s the swtpm log file to the swtpm user:group when starting a VM. The swtpm log directory is writable by swtmp user, who could replace the logfile with a symlink to a root-owned path. At next VM start, libvirt will chown() that path to the swtpm user:group, which breaks the intended separation between the confined swtpm account and root-owned files.
Use fchown() on an fd opened with O_NOFOLLOW to avoid the potential symlink attack.
I thought the O_NOFOLLOW was a BSDism and went to check whether it is POSIX or not. I looked at the man page and instantly felt old.
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>