Skip to content

L
lxc
Commit 88e38993 by Bogdan Purcareata Committed by Stéphane Graber
Options

lxc-busybox: Prevent copying binaries from /usr/local to container

On certain systems, some binaries needed by the container features (dropbear, openssh), may be placed in non-standard (aka non-distribution-managed locations), such as /usr/local/*, /opt/local/*, etc. Don't copy the respective binaries in the container and return a clear error why. The user should only use these binaries if they are installed at system-wide locations on the host, such as /{s,}bin or /usr/{s,}bin. v2: - check that binary paths adhere to /{,usr/}{,s}bin only Signed-off-by: 's avatarBogdan Purcareata <bogdan.purcareata@freescale.com> Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
parent 4432b512
Showing with 28 additions and 15 deletions
templates/lxc-busybox.in
...@@ -38,6 +38,31 @@ am_in_userns() { ...@@ -38,6 +38,31 @@ am_in_userns() {
in_userns=0 in_userns=0
[ $(am_in_userns) = "yes" ] && in_userns=1 [ $(am_in_userns) = "yes" ] && in_userns=1
copy_binary()
{
binary_path=`which $1`
if [ $? -ne 0 ]; then
echo "Unable to find $1 binary on the system"
return 1
fi
dir_path="${binary_path%/*}"
echo /{,usr/}{,s}bin | grep $dir_path >/dev/null 2>&1
if [ $? -ne 0 ]; then
echo "Binary $1 is located at $binary_path and will not be copied"
echo "($dir_path not supported)"
return 1
fi
cp $binary_path $rootfs/$binary_path
if [ $? -ne 0 ]; then
echo "Failed to copy $binary_path to rootfs"
return 1
fi
return 0
}
install_busybox() install_busybox()
{ {
rootfs=$1 rootfs=$1
...@@ -164,11 +189,7 @@ EOF ...@@ -164,11 +189,7 @@ EOF
install_dropbear() install_dropbear()
{ {
# copy dropbear binary # copy dropbear binary
cp $(which dropbear) $rootfs/usr/sbin copy_binary dropbear || return 1
if [ $? -ne 0 ]; then
echo "Failed to copy dropbear in the rootfs"
return 1
fi
# make symlinks to various ssh utilities # make symlinks to various ssh utilities
utils="\ utils="\
...@@ -224,19 +245,11 @@ $rootfs/var/run/sshd \ ...@@ -224,19 +245,11 @@ $rootfs/var/run/sshd \
# copy binaries # copy binaries
for bin in $server_utils $client_utils; do for bin in $server_utils $client_utils; do
tool_path=`which $bin` copy_binary $bin || return 1
cp $tool_path $rootfs/$tool_path
if [ $? -ne 0 ]; then
echo "Unable to copy $tool_path in the rootfs"
return 1
fi
done done
for bin in $client_optional_utils; do for bin in $client_optional_utils; do
tool_path=`which $bin` tool_path=`which $bin` && copy_binary $bin
if [ $? -eq 0 ]; then
cp $tool_path $rootfs/$tool_path
fi
done done
# add user and group # add user and group
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment