Merge pull request #3692 from brauner/2021-02-23/fixes

src/lxc/attach.c

@@ -1657,6 +1657,13 @@ int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
 		TRACE("Moved transient process %d into container cgroup", pid);
 	}
 
+	/*
+	 * Close sensitive file descriptors we don't need anymore. Even if
+	 * we're the parent.
+	 */
+	if (!attach_context_security_barrier(ctx))
+		goto on_error;
+
 	/* Setup /proc limits */
 	if (!lxc_list_empty(&conf->procs)) {
 		ret = setup_proc_filesystem(&conf->procs, pid);

src/lxc/cgroups/cgfsng.c

@@ -337,7 +337,7 @@ static char **list_add_controllers(char *controllers)
 	__do_free_string_list char **list = NULL;
 	char *it;
 
-	lxc_iterate_parts(it, controllers, " \t\n") {
+	lxc_iterate_parts(it, controllers, ", \t\n") {
 		int ret;
 
 		ret = list_add_string(&list, it);

src/lxc/commands.h

@@ -127,8 +127,7 @@ __hidden extern int lxc_cmd_get_seccomp_notify_fd(const char *name, const char *
 __hidden extern int lxc_cmd_get_cgroup_ctx(const char *name, const char *lxcpath,
 					   const char *controller, bool batch,
 					   size_t size_ret_ctx,
-					   struct cgroup_ctx *ret_ctx)
-    __access_r(6, 5);
+					   struct cgroup_ctx *ret_ctx);
 __hidden extern int lxc_cmd_seccomp_notify_add_listener(const char *name, const char *lxcpath, int fd,
 							/* unused */ unsigned int command,
 							/* unused */ unsigned int flags);