Skip to content

L
lxc
Unverified Commit 8d18e582 by Christian Brauner
Options

caps: check uid and euid

When we are running inside of a user namespace getuid() will return a non-zero uid. So let's check euid as well to make sure we correctly drop capabilities Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 3d277c51
Showing with 2 additions and 4 deletions
src/lxc/caps.c
...@@ -154,8 +154,7 @@ int lxc_ambient_caps_up(void) ...@@ -154,8 +154,7 @@ int lxc_ambient_caps_up(void)
int last_cap = CAP_LAST_CAP; int last_cap = CAP_LAST_CAP;
char *cap_names = NULL; char *cap_names = NULL;
/* When we are run as root, we don't want to play with the capabilities. */ if (!getuid() || geteuid())
if (!getuid())
return 0; return 0;
caps = cap_get_proc(); caps = cap_get_proc();
...@@ -222,8 +221,7 @@ int lxc_ambient_caps_down(void) ...@@ -222,8 +221,7 @@ int lxc_ambient_caps_down(void)
cap_t caps; cap_t caps;
cap_value_t cap; cap_value_t cap;
/* When we are run as root, we don't want to play with the capabilities. */ if (!getuid() || geteuid())
if (!getuid())
return 0; return 0;
ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment