From 271e1110bd698dbe319dc8cbf7510a1648c551c2 Mon Sep 17 00:00:00 2001 From: Rajkaran Date: Sat, 25 Jul 2026 12:51:38 +0530 Subject: [PATCH] linux: do not skip EACCES in do_masked_or_readonly_path Only skip ENOENT when opening masked/readonly path targets, matching runc's fail-closed behavior. Previously EACCES was also silently ignored, which could leave a configured maskedPaths/readonlyPaths entry unprotected. Fixes: #2139 Signed-off-by: Rajkaran --- src/libcrun/linux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libcrun/linux.c b/src/libcrun/linux.c index de489fc6cb..a3ff0b4881 100644 --- a/src/libcrun/linux.c +++ b/src/libcrun/linux.c @@ -1223,7 +1223,7 @@ do_masked_or_readonly_path (libcrun_container_t *container, const char *rel_path if (UNLIKELY (pathfd < 0)) { errno = crun_error_get_errno (err); - if (errno != ENOENT && errno != EACCES) + if (errno != ENOENT) return pathfd; crun_error_release (err);