Skip to content

L
lxc
Commit 7b188fe5 by Serge Hallyn Committed by Stéphane Graber
Options

chmod container dir to 0770 (v2)

This prevents u2 from going into /home/u1/.local/share/lxc/u1/rootfs and running setuid-root applications to get write access to u1's container rootfs. v2: set umask to 002 for the mkdir. Otherwise if umask happens to be, say, 022, then user does not have write permissions under the container dir and creation of $containerdir/partial file will fail. Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com> Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
parent 435e1b87
Showing with 30 additions and 13 deletions
src/lxc/lxccontainer.c
...@@ -738,6 +738,31 @@ static bool lxcapi_stop(struct lxc_container *c) ...@@ -738,6 +738,31 @@ static bool lxcapi_stop(struct lxc_container *c)
return ret == 0; return ret == 0;
} }
static int do_create_container_dir(const char *path, struct lxc_conf *conf)
{
int ret = -1, lasterr;
char *p = alloca(strlen(path)+1);
mode_t mask = umask(0002);
ret = mkdir(path, 0770);
lasterr = errno;
umask(mask);
errno = lasterr;
if (ret) {
if (errno == EEXIST)
ret = 0;
else {
SYSERROR("failed to create container path %s", path);
return -1;
}
}
strcpy(p, path);
if (!lxc_list_empty(&conf->id_map) && chown_mapped_root(p, conf) != 0) {
ERROR("Failed to chown container dir");
ret = -1;
}
return ret;
}
/* /*
* create the standard expected container dir * create the standard expected container dir
*/ */
...@@ -755,13 +780,7 @@ static bool create_container_dir(struct lxc_container *c) ...@@ -755,13 +780,7 @@ static bool create_container_dir(struct lxc_container *c)
free(s); free(s);
return false; return false;
} }
ret = mkdir(s, 0755); ret = do_create_container_dir(s, c->lxc_conf);
if (ret) {
if (errno == EEXIST)
ret = 0;
else
SYSERROR("failed to create container path for %s", c->name);
}
free(s); free(s);
return ret == 0; return ret == 0;
} }
...@@ -2618,17 +2637,15 @@ sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \ ...@@ -2618,17 +2637,15 @@ sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
only rootfs gets converted (copied/snapshotted) on clone. only rootfs gets converted (copied/snapshotted) on clone.
*/ */
static int create_file_dirname(char *path) static int create_file_dirname(char *path, struct lxc_conf *conf)
{ {
char *p = strrchr(path, '/'); char *p = strrchr(path, '/');
int ret; int ret = -1;
if (!p) if (!p)
return -1; return -1;
*p = '\0'; *p = '\0';
ret = mkdir(path, 0755); ret = do_create_container_dir(path, conf);
if (ret && errno != EEXIST)
SYSERROR("creating container path %s", path);
*p = '/'; *p = '/';
return ret; return ret;
} }
...@@ -2672,7 +2689,7 @@ static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *n ...@@ -2672,7 +2689,7 @@ static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *n
goto out; goto out;
} }
ret = create_file_dirname(newpath); ret = create_file_dirname(newpath, c->lxc_conf);
if (ret < 0 && errno != EEXIST) { if (ret < 0 && errno != EEXIST) {
ERROR("Error creating container dir for %s", newpath); ERROR("Error creating container dir for %s", newpath);
goto out; goto out;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment