NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-11 07:55:58 -06:00
Code Issues Packages Projects Releases Wiki Activity

drop CAP_SYS_BOOT capability from LXC containers

Browse Source 
* src/lxc_container.c: drop LXC CAP_SYS_BOOT capability to avoid
  reboot from inside containers, patch by Ryota Ozaki
Daniel
This commit is contained in:
Daniel Veillard 2009-05-11 14:05:27 +00:00
parent 0c8a9d2d51
commit 9959a1dd9d
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Mon May 11 16:03:37 CEST 2009 Daniel Veillard <veillard@redhat.com>
* src/lxc_container.c: drop LXC CAP_SYS_BOOT capability to avoid
reboot from inside containers, patch by Ryota Ozaki
Mon May 11 09:51:00 EDT 2009 Cole Robinson <crobinso@redhat.com>
* src/qemu_driver.c : Check that QEMU is still alive while

30
src/lxc_container.c
View File

@ -41,6 +41,9 @@
/* For MS_MOVE */
#include <linux/fs.h>
#include <sys/prctl.h>
#include <sys/capability.h>
#include "virterror_internal.h"
#include "logging.h"
#include "lxc_container.h"
@ -639,6 +642,29 @@ static int lxcContainerSetupMounts(virDomainDefPtr vmDef,
return lxcContainerSetupExtraMounts(vmDef);
}
static int lxcContainerDropCapabilities( virDomainDefPtr vmDef )
{
int i;
const struct {
int id;
const char *name;
} caps[] = {
#define ID_STRING(name) name, #name
{ ID_STRING(CAP_SYS_BOOT) },
};
for (i = 0 ; i < ARRAY_CARDINALITY(caps) ; i++) {
if (prctl(PR_CAPBSET_DROP, caps[i].id, 0, 0, 0)) {
lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR,
_("failed to drop %s"), caps[i].name);
return -1;
}
}
return 0;
}
/**
* lxcChild:
* @argv: Pointer to container arguments
@ -705,6 +731,10 @@ static int lxcContainerChild( void *data )
if (lxcContainerEnableInterfaces(argv->nveths, argv->veths) < 0)
return -1;
/* drop a set of root capabilities */
if (lxcContainerDropCapabilities(vmDef) < 0)
return -1;
/* this function will only return if an error occured */
return lxcContainerExecInit(vmDef);
}