Commit b3677ba8 by Christian Brauner Committed by Stéphane Graber

attach: use ns_info[LXC_NS_MAX] struct

Using custom structs in attach.c risks getting out of sync with the commonly used ns_info[LXC_NS_MAX] struct and thus attaching to wrong namespaces. Switch to using ns_info[LXC_NS_MAX]. Signed-off-by: 's avatarChristian Brauner <christian.brauner@canonical.com>
parent f23504af
...@@ -212,17 +212,7 @@ static void lxc_proc_put_context_info(struct lxc_proc_context_info *ctx) ...@@ -212,17 +212,7 @@ static void lxc_proc_put_context_info(struct lxc_proc_context_info *ctx)
static int lxc_attach_to_ns(pid_t pid, int which) static int lxc_attach_to_ns(pid_t pid, int which)
{ {
/* according to <http://article.gmane.org/gmane.linux.kernel.containers.lxc.devel/1429>, int fd[LXC_NS_MAX];
* the file for user namespaces in /proc/$pid/ns will be called
* 'user' once the kernel supports it
*/
static char *ns[] = { "user", "mnt", "pid", "uts", "ipc", "net", "cgroup" };
static int flags[] = {
CLONE_NEWUSER, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC,
CLONE_NEWNET, CLONE_NEWCGROUP
};
static const int size = sizeof(ns) / sizeof(char *);
int fd[size];
int i, j, saved_errno; int i, j, saved_errno;
...@@ -231,16 +221,16 @@ static int lxc_attach_to_ns(pid_t pid, int which) ...@@ -231,16 +221,16 @@ static int lxc_attach_to_ns(pid_t pid, int which)
return -1; return -1;
} }
for (i = 0; i < size; i++) { for (i = 0; i < LXC_NS_MAX; i++) {
/* ignore if we are not supposed to attach to that /* ignore if we are not supposed to attach to that
* namespace * namespace
*/ */
if (which != -1 && !(which & flags[i])) { if (which != -1 && !(which & ns_info[i].clone_flag)) {
fd[i] = -1; fd[i] = -1;
continue; continue;
} }
fd[i] = lxc_preserve_ns(pid, ns[i]); fd[i] = lxc_preserve_ns(pid, ns_info[i].proc_name);
if (fd[i] < 0) { if (fd[i] < 0) {
saved_errno = errno; saved_errno = errno;
...@@ -251,23 +241,28 @@ static int lxc_attach_to_ns(pid_t pid, int which) ...@@ -251,23 +241,28 @@ static int lxc_attach_to_ns(pid_t pid, int which)
close(fd[j]); close(fd[j]);
errno = saved_errno; errno = saved_errno;
SYSERROR("failed to open namespace: '%s'.", ns[i]); SYSERROR("failed to open namespace: '%s'.", ns_info[i].proc_name);
return -1; return -1;
} }
} }
for (i = 0; i < size; i++) { for (i = 0; i < LXC_NS_MAX; i++) {
if (fd[i] >= 0 && setns(fd[i], 0) != 0) { if (fd[i] < 0)
continue;
if (setns(fd[i], 0) < 0) {
saved_errno = errno; saved_errno = errno;
for (j = i; j < size; j++) for (j = i; j < LXC_NS_MAX; j++)
close(fd[j]); close(fd[j]);
errno = saved_errno; errno = saved_errno;
SYSERROR("failed to set namespace '%s'", ns[i]); SYSERROR("Failed to attach to namespace \"%s\".", ns_info[i].proc_name);
return -1; return -1;
} }
DEBUG("Attached to namespace \"%s\".", ns_info[i].proc_name);
close(fd[i]); close(fd[i]);
} }
...@@ -1192,11 +1187,9 @@ static int attach_child_main(void* data) ...@@ -1192,11 +1187,9 @@ static int attach_child_main(void* data)
flags = fcntl(fd, F_GETFL); flags = fcntl(fd, F_GETFL);
if (flags < 0) if (flags < 0)
continue; continue;
if (flags & FD_CLOEXEC) { if (flags & FD_CLOEXEC)
if (fcntl(fd, F_SETFL, flags & ~FD_CLOEXEC) < 0) { if (fcntl(fd, F_SETFL, flags & ~FD_CLOEXEC) < 0)
SYSERROR("Unable to clear CLOEXEC from fd"); SYSERROR("Unable to clear CLOEXEC from fd");
}
}
} }
/* we don't need proc anymore */ /* we don't need proc anymore */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment