systemd credentials name could be abused to escape the credentials
folder and allow for arbitrary writes to the host filesystem allowing
for privilege escalation and denial of service attacks.
We now use Go's OpenRoot (openat2) to restrict all file interactions to
the "credentials" directory, avoiding such attacks.
This addresses CVE-2026-33945
Reported-by: https://7asecurity.com
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
d0f2c86fcb
