Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb()

[Jakub Wilk <jwilk () jwilk net>]

* Matthias Gerstner <mgerstner () suse de>, 2018-07-02, 14:21:
> I think the easiest way to fix this is to normalize the user supplied 
> filename e.g. using realpath()

Using realpath(3) for access control is almost always a mistake: this 
function expands symlinks, including attacker-controlled symlinks.

You patch uses g_file_get_path(), which AFIACT doesn't use any 
filesystem I/O for canonicalisation, so that should be fine.

--
Jakub Wilk