start.c: always switch uid and gid

src/lxc/start.c

@@ -797,10 +797,14 @@ void lxc_abort(const char *name, struct lxc_handler *handler)
 
 static int do_start(void *data)
 {
+	int ret;
 	struct lxc_list *iterator;
-	struct lxc_handler *handler = data;
-	int devnull_fd = -1, ret;
 	char path[PATH_MAX];
+	struct lxc_handler *handler = data;
+	bool have_cap_setgid;
+	uid_t new_uid;
+	gid_t new_gid;
+	int devnull_fd = -1;
 
 	if (sigprocmask(SIG_SETMASK, &handler->oldmask, NULL)) {
 		SYSERROR("Failed to set signal mask.");
@@ -1034,10 +1038,8 @@ static int do_start(void *data)
 	/* The container has been setup. We can now switch to an unprivileged
 	 * uid/gid.
 	 */
-	if (handler->conf->is_execute) {
-		bool have_cap_setgid;
-		uid_t new_uid = handler->conf->init_uid;
-		gid_t new_gid = handler->conf->init_gid;
+	new_uid = handler->conf->init_uid;
+	new_gid = handler->conf->init_gid;
 
 	/* If we are in a new user namespace we already dropped all
 	 * groups when we switched to root in the new user namespace
@@ -1056,7 +1058,6 @@ static int do_start(void *data)
 
 	if (lxc_switch_uid_gid(new_uid, new_gid) < 0)
 		goto out_warn_father;
-	}
 
 	/* After this call, we are in error because this ops should not return
 	 * as it execs.