static int service_load_pid_file(Service *s, bool may_warn) {

        r = chase_symlinks(s->pid_file, NULL, CHASE_SAFE, NULL, &fd);

        if (r == -ENOLINK) {

                questionable_pid_file = true;

        }

        r = service_is_suitable_main_pid(s, pid, prio);

        if (r < 0)

                return r;

        if (r == 0) {

                struct stat st;

                if (questionable_pid_file) {

                        log_unit_error(UNIT(s), "Refusing to accept PID outside of service control group, acquired through unsafe symlink chain: %s", s->pid_file);

                        return -EPERM;

                }

}

int chase_symlinks(const char *path, const char *original_root, unsigned flags, char **ret_path, int *ret_fd) {

                if (fstat(child, &st) < 0)

                        return -errno;

                previous_stat = st;

                fd = open(root ?: "/", O_CLOEXEC|O_NOFOLLOW|O_PATH);     //O_NOFOLLOW表示如果是软链，打开失败

                if (fd < 0)

                    return -errno;

                if (flags & CHASE_SAFE) {

                    if (fstat(fd, &st) < 0)

                        return -errno;

                if (unsafe_transition(&previous_stat, &st))

                    return log_unsafe_transition(child, fd, path, flags);

                    previous_stat = st;

                }

}

static bool unsafe_transition(const struct stat *a, const struct stat *b) {

        /* Returns true if the transition from a to b is safe, i.e. that we never transition from unprivileged to

         * privileged files or directories. Why bother? So that unprivileged code can't symlink to privileged files

         * making us believe we read something safe even though it isn't safe in the specific context we open it in. */

        if (a->st_uid == 0) /* Transitioning from privileged to unprivileged is always fine */

                return false;

        return a->st_uid != b->st_uid; /* Otherwise we need to stay within the same UID */

}