Skip to content

L
lxc
Unverified Commit 1286c271 by Kaarle Ritvanen Committed by Christian Brauner
Options

do_lxcapi_create: set umask

Always use 022 as the umask when creating the rootfs directory and executing the template. A too loose umask may cause security issues. A too strict umask may cause programs to fail inside the container. Signed-off-by: 's avatarKaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
parent 3d872a3f
Showing with 4 additions and 0 deletions
src/lxc/lxccontainer.c
...@@ -1601,6 +1601,7 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t, ...@@ -1601,6 +1601,7 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t,
int flags, char *const argv[]) int flags, char *const argv[])
{ {
int partial_fd; int partial_fd;
mode_t mask;
pid_t pid; pid_t pid;
bool ret = false; bool ret = false;
char *tpath = NULL; char *tpath = NULL;
...@@ -1673,6 +1674,8 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t, ...@@ -1673,6 +1674,8 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t,
/* No need to get disk lock bc we have the partial lock. */ /* No need to get disk lock bc we have the partial lock. */
mask = umask(0022);
/* Create the storage. /* Create the storage.
* Note we can't do this in the same task as we use to execute the * Note we can't do this in the same task as we use to execute the
* template because of the way zfs works. * template because of the way zfs works.
...@@ -1732,6 +1735,7 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t, ...@@ -1732,6 +1735,7 @@ static bool do_lxcapi_create(struct lxc_container *c, const char *t,
ret = load_config_locked(c, c->configfile); ret = load_config_locked(c, c->configfile);
out_unlock: out_unlock:
umask(mask);
if (partial_fd >= 0) if (partial_fd >= 0)
remove_partial(c, partial_fd); remove_partial(c, partial_fd);
out: out:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment