Skip to content

L
lxc
Unverified Commit 5c618243 by Christian Brauner
Options

execute: skip lxc-init logging when unprivileged

Unprivileged app containers will not be able to open the passed in /proc/1/fd/<idx> log path and will thus currently fail completely as soon as any log level or log file is passed. Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com> Reported-by: 's avatarMrinal Dhillon <mdhillon@juniper.net>
parent c5dc704a
Showing with 8 additions and 5 deletions
src/lxc/execute.c
...@@ -43,6 +43,7 @@ static int execute_start(struct lxc_handler *handler, void* data) ...@@ -43,6 +43,7 @@ static int execute_start(struct lxc_handler *handler, void* data)
int argc = 0, i = 0, logfd = -1; int argc = 0, i = 0, logfd = -1;
struct execute_args *my_args = data; struct execute_args *my_args = data;
char logfile[LXC_PROC_PID_FD_LEN]; char logfile[LXC_PROC_PID_FD_LEN];
bool is_privileged = lxc_list_empty(&handler->conf->id_map);
while (my_args->argv[argc++]); while (my_args->argv[argc++]);
...@@ -54,11 +55,13 @@ static int execute_start(struct lxc_handler *handler, void* data) ...@@ -54,11 +55,13 @@ static int execute_start(struct lxc_handler *handler, void* data)
if (!handler->conf->rootfs.path) if (!handler->conf->rootfs.path)
argc_add += 2; argc_add += 2;
if (lxc_log_has_valid_level()) if (is_privileged) {
argc_add += 2; if (lxc_log_has_valid_level())
argc_add += 2;
if (current_config->logfd != -1 || lxc_log_fd != -1) if (current_config->logfd != -1 || lxc_log_fd != -1)
argc_add += 2; argc_add += 2;
}
argv = malloc((argc + argc_add) * sizeof(*argv)); argv = malloc((argc + argc_add) * sizeof(*argv));
if (!argv) { if (!argv) {
...@@ -79,7 +82,7 @@ static int execute_start(struct lxc_handler *handler, void* data) ...@@ -79,7 +82,7 @@ static int execute_start(struct lxc_handler *handler, void* data)
argv[i++] = (char *)lxc_log_priority_to_string(lxc_log_get_level()); argv[i++] = (char *)lxc_log_priority_to_string(lxc_log_get_level());
} }
if (current_config->logfd != -1 || lxc_log_fd != -1) { if (is_privileged && (current_config->logfd != -1 || lxc_log_fd != -1)) {
int ret; int ret;
int to_dup = current_config->logfd; int to_dup = current_config->logfd;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment