From 1337f966080eceed63e17693b718f60d919d8d30 Mon Sep 17 00:00:00 2001 From: Daniel Jagszent Date: Thu, 25 Jun 2026 11:03:42 +0200 Subject: [PATCH] check_disk: prevent using stat on inaccessible filesystems --- plugins/check_disk.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/plugins/check_disk.c b/plugins/check_disk.c index 65169105..accccc8e 100644 --- a/plugins/check_disk.c +++ b/plugins/check_disk.c @@ -753,6 +753,16 @@ check_disk_config_wrapper process_arguments(int argc, char **argv) { se = mp_int_fs_list_append(&result.config.path_select_list, me->me_mountdir); } + + /* This path was selected directly from a specific mount entry, so + * pin it to that entry. Otherwise set_best_match() may re-resolve an + * inaccessible filesystem (e.g. a root-only docker overlay mount whose + * statfs() returns EACCES) to a parent filesystem, which defeats the + * -X/-x/-i exclusion checks and makes the plugin stat() and fail on a + * path the user explicitly excluded. + */ + se->best_match = me; + se->group = group; set_all_thresholds(se, warn_freespace_units, crit_freespace_units, warn_freespace_percent, crit_freespace_percent,