Skip to content

L
lxc
Commit 58558042 by Dwight Engen Committed by Stéphane Graber
Options

don't force dropping capabilities in lxc-init

Commit 0af683cf added clearing of capabilities to lxc-init, but only after lxc_setup_fs() was done, likely so that the mounting done in that routine wouldn't fail. However, in my testing lxc_caps_reset() wasn't really effective anyway since it did not clear the bounding set. Adding prctl PR_CAPBSET_DROP in a loop from 0 to CAP_LAST_CAP would fix this, but I don't think its necessary to forcefully clear all capabilities since users can now specify lxc.cap.keep = none to drop all capabilities. Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com> Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
parent 99e616a6
Showing with 0 additions and 29 deletions
src/lxc/caps.c
...@@ -41,25 +41,6 @@ lxc_log_define(lxc_caps, lxc); ...@@ -41,25 +41,6 @@ lxc_log_define(lxc_caps, lxc);
#define PR_CAPBSET_READ 23 #define PR_CAPBSET_READ 23
#endif #endif
int lxc_caps_reset(void)
{
cap_t cap = cap_init();
int ret = 0;
if (!cap) {
ERROR("cap_init() failed : %m");
return -1;
}
if (cap_set_proc(cap)) {
ERROR("cap_set_proc() failed : %m");
ret = -1;
}
cap_free(cap);
return ret;
}
int lxc_caps_down(void) int lxc_caps_down(void)
{ {
cap_t caps; cap_t caps;
......
src/lxc/caps.h
...@@ -26,16 +26,12 @@ ...@@ -26,16 +26,12 @@
#define __LXC_CAPS_H #define __LXC_CAPS_H
#if HAVE_SYS_CAPABILITY_H #if HAVE_SYS_CAPABILITY_H
extern int lxc_caps_reset(void);
extern int lxc_caps_down(void); extern int lxc_caps_down(void);
extern int lxc_caps_up(void); extern int lxc_caps_up(void);
extern int lxc_caps_init(void); extern int lxc_caps_init(void);
extern int lxc_caps_last_cap(void); extern int lxc_caps_last_cap(void);
#else #else
static inline int lxc_caps_reset(void) {
return 0;
}
static inline int lxc_caps_down(void) { static inline int lxc_caps_down(void) {
return 0; return 0;
} }
......
src/lxc/lxc_init.c
...@@ -104,9 +104,6 @@ int main(int argc, char *argv[]) ...@@ -104,9 +104,6 @@ int main(int argc, char *argv[])
} }
} }
if (lxc_caps_init())
exit(EXIT_FAILURE);
err = lxc_log_init(name, name ? NULL : "none", logpriority, err = lxc_log_init(name, name ? NULL : "none", logpriority,
basename(argv[0]), quiet, lxcpath); basename(argv[0]), quiet, lxcpath);
if (err < 0) if (err < 0)
...@@ -168,9 +165,6 @@ int main(int argc, char *argv[]) ...@@ -168,9 +165,6 @@ int main(int argc, char *argv[])
lxc_setup_fs(); lxc_setup_fs();
if (lxc_caps_reset())
exit(EXIT_FAILURE);
pid = fork(); pid = fork();
if (pid < 0) if (pid < 0)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment