Skip to content

L
lxc
Unverified Commit f88d8e68 by Christian Brauner Committed by GitHub
Options

Merge pull request #3466 from alivenets/fix-no-new-privs

attach: set no_new_privs flag after LSM label
parents 7c8b10e5 6ce8e678
Showing with 11 additions and 11 deletions
src/lxc/attach.c
...@@ -770,17 +770,6 @@ static int attach_child_main(struct attach_clone_payload *payload) ...@@ -770,17 +770,6 @@ static int attach_child_main(struct attach_clone_payload *payload)
else else
new_gid = ns_root_gid; new_gid = ns_root_gid;
if ((init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->no_new_privs) ||
(options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
prctl_arg(0), prctl_arg(0));
if (ret < 0)
goto on_error;
TRACE("Set PR_SET_NO_NEW_PRIVS");
}
if (needs_lsm) { if (needs_lsm) {
bool on_exec; bool on_exec;
...@@ -795,6 +784,17 @@ static int attach_child_main(struct attach_clone_payload *payload) ...@@ -795,6 +784,17 @@ static int attach_child_main(struct attach_clone_payload *payload)
TRACE("Set %s LSM label to \"%s\"", lsm_name(), init_ctx->lsm_label); TRACE("Set %s LSM label to \"%s\"", lsm_name(), init_ctx->lsm_label);
} }
if ((init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->no_new_privs) ||
(options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
prctl_arg(0), prctl_arg(0));
if (ret < 0)
goto on_error;
TRACE("Set PR_SET_NO_NEW_PRIVS");
}
if (init_ctx->container && init_ctx->container->lxc_conf && if (init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->seccomp.seccomp) { init_ctx->container->lxc_conf->seccomp.seccomp) {
struct lxc_conf *conf = init_ctx->container->lxc_conf; struct lxc_conf *conf = init_ctx->container->lxc_conf;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment