Skip to content

L
lxc
Commit 526e288e by dlezcano
Options

Add read permission checking for the container

From: Daniel Lezcano <dlezcano@fr.ibm.com> When an user tries to look at the pids or network information belonging to a container not owned by the user. The command silently fails, I changed that to check the read permission, display an error and exit. Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
parent 4bbb9c57
Showing with 13 additions and 4 deletions
src/lxc/lxc-netstat.in
...@@ -30,10 +30,15 @@ if [ ! -d $lxcpath/$name ]; then ...@@ -30,10 +30,15 @@ if [ ! -d $lxcpath/$name ]; then
exit 1 exit 1
fi fi
if [ ! -r $lxcpath/$name ]; then
echo "Can not access '$name': permission denied"
exit 1
fi
if [ ! -f $lxcpath/$name/init ]; then if [ ! -f $lxcpath/$name/init ]; then
exit 0 exit 0
fi fi
initpid=$(cat $lxcpath/$name/init) initpid=$(cat $lxcpath/$name/init) && \
mount --bind /proc/$initpid/net /proc/$$/net && \
mount --bind /proc/$initpid/net /proc/$$/net && exec netstat $* exec netstat $*
\ No newline at end of file
src/lxc/lxc-ps.in
...@@ -30,6 +30,11 @@ if [ ! -d $lxcpath/$name ]; then ...@@ -30,6 +30,11 @@ if [ ! -d $lxcpath/$name ]; then
exit 1 exit 1
fi fi
if [ ! -r $lxcpath/$name ]; then
echo "Can not access '$name', permission denied"
exit 1
fi
if [ -h $lxcpath/$name/nsgroup ]; then if [ -h $lxcpath/$name/nsgroup ]; then
ps $* -p $(cat $lxcpath/$name/nsgroup/tasks) ps $* -p $(cat $lxcpath/$name/nsgroup/tasks)
fi fi
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment