Use securejoin

Signed-off-by: Evan Phoenix <evan@phx.io>

libcontainer/cgroups/systemd/common.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	systemdDbus "github.com/coreos/go-systemd/v22/dbus"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	dbus "github.com/godbus/dbus/v5"
 	"github.com/sirupsen/logrus"
 
@@ -293,11 +294,18 @@ func generateDeviceProperties(r *configs.Resources) ([]systemdDbus.Property, err
 			// rules separately to systemd) we can safely skip entries that don't
 			// have a corresponding path.
 			if _, err := os.Stat(entry.Path); err != nil {
-				// Also check /sys/dev so that we don't depend on /dev/{block,char} being populated.
-				// (/dev/{block,char} is populated by udev, which isn't strictly required for systemd).
-				// Ironically, this happens most easily when starting containerd within a runc created
-				// container itself.
-				if _, err := os.Stat("/sys" + entry.Path); err != nil {
+				// Also check /sys/dev so that we don't depend on /dev/{block,char}
+				// being populated. (/dev/{block,char} is populated by udev, which
+				// isn't strictly required for systemd). Ironically, this happens most
+				// easily when starting containerd within a runc created container
+				// itself.
+				testPath, err := securejoin.SecureJoin("/sys", entry.Path)
+				if err != nil {
+					logrus.Errorf("error joining entry path: %s", err)
+					continue
+				}
+
+				if _, err := os.Stat(testPath); err != nil {
 					logrus.Warnf("skipping device %s for systemd: %s", entry.Path, err)
 					continue
 				}