Skip to content

L
lxc
Commit 42ff343d by dlezcano
Options

From: Daniel Lezcano <dlezcano@fr.ibm.com>

Remove the CAP_SYS_BOOT capability from the bouding set, so we can poweroff, halt, reboot the container safely without shutting down the real host. Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
parent 96950ed0
Showing with 6 additions and 0 deletions
src/lxc/start.c
...@@ -35,6 +35,7 @@ ...@@ -35,6 +35,7 @@
#include <sys/mount.h> #include <sys/mount.h>
#include <sys/types.h> #include <sys/types.h>
#include <sys/prctl.h> #include <sys/prctl.h>
#include <sys/capability.h>
#include <sys/wait.h> #include <sys/wait.h>
#include <lxc/lxc.h> #include <lxc/lxc.h>
...@@ -138,6 +139,11 @@ int lxc_start(const char *name, int argc, char *argv[], ...@@ -138,6 +139,11 @@ int lxc_start(const char *name, int argc, char *argv[],
goto out_child; goto out_child;
} }
if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
lxc_log_syserror("failed to remove CAP_SYS_BOOT capability");
goto out_child;
}
execvp(argv[0], argv); execvp(argv[0], argv);
lxc_log_syserror("failed to exec %s", argv[0]); lxc_log_syserror("failed to exec %s", argv[0]);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment