diff --git a/private/util/validate_usr_symlinks.awk b/private/util/validate_usr_symlinks.awk index a51ac9f03..23053a707 100644 --- a/private/util/validate_usr_symlinks.awk +++ b/private/util/validate_usr_symlinks.awk @@ -13,9 +13,9 @@ BEGIN { { original_path = $1 path = original_path - # Normalize: strip leading ./ or / - sub(/^\.\//, "", path) - sub(/^\//, "", path) + # Normalize: strip any combination of leading ./ and / + # This ensures ./bin, /bin, bin, and even //bin are treated the same. + sub(/^(\.\/|\/)+/, "", path) if (path in expected) { if ($0 !~ /type=link/) { diff --git a/private/util/validate_usr_symlinks_test.sh b/private/util/validate_usr_symlinks_test.sh index 9d391a770..371f839f1 100755 --- a/private/util/validate_usr_symlinks_test.sh +++ b/private/util/validate_usr_symlinks_test.sh @@ -43,11 +43,20 @@ run "./lib64 type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/lib64 ./usr/bin/ls type=file mode=0755 nlink=1 uid=0 gid=0 size=12345" \ || fail "content under ./usr/ alongside valid symlinks should pass" +run "/home/user/bin type=dir mode=0755 nlink=2 uid=1000 gid=1000" \ + || fail "deep paths containing 'bin' should pass" + # --- failing cases --- run "./bin type=dir mode=0755 nlink=2 uid=0 gid=0" \ && fail "./bin as a directory should fail" || true +run "//bin type=dir mode=0755 nlink=2 uid=0 gid=0" \ + && fail "//bin as a directory should fail" || true + +run "././bin type=dir mode=0755 nlink=2 uid=0 gid=0" \ + && fail "././bin as a directory should fail" || true + run "./bin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/sbin" \ && fail "./bin -> usr/sbin should fail" || true @@ -57,6 +66,12 @@ run "bin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/fin" \ run "/bin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/fin" \ && fail "/bin -> usr/fin should fail" || true +run "//bin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/fin" \ + && fail "//bin -> usr/fin should fail" || true + +run "././bin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/fin" \ + && fail "././bin -> usr/fin should fail" || true + run "./sbin type=link mode=0777 nlink=1 uid=0 gid=0 link=usr/bin" \ && fail "./sbin -> usr/bin should fail (Debian keeps sbin separate)" || true