From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Wed, 3 Jun 2026 15:16:38 +0000 (+0300)
Subject: [PATCH 4/5] acl: dovecot-acl-list is never supposed to be a symlink - use O_NOFOLLOW... 
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~97
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=12c9f19e74fbf0eb1222259f99b900694eddd299;p=dovecot.git

[PATCH 4/5] acl: dovecot-acl-list is never supposed to be a symlink - use O_NOFOLLOW flag


Gbp-Pq: Name 0004-acl-dovecot-acl-list-is-never-supposed-to-be-a-symli.patch
---

diff --git a/src/plugins/acl/acl-backend-vfile-acllist.c b/src/plugins/acl/acl-backend-vfile-acllist.c
index 75efdec..7bf471b 100644
--- a/src/plugins/acl/acl-backend-vfile-acllist.c
+++ b/src/plugins/acl/acl-backend-vfile-acllist.c
@@ -115,7 +115,7 @@ static int acl_backend_vfile_acllist_read(struct acl_backend_vfile *backend)
 			return 0;
 	}
 
-	fd = open(path, O_RDONLY);
+	fd = open(path, O_RDONLY | O_NOFOLLOW);
 	if (fd == -1) {
 		if (errno == ENOENT) {
 			backend->acllist_mtime = 0;