External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-24 22:55:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove capng_lock() call when spawning LXC container init process

Browse Source 
The capng_lock() call sets the SECURE_NO_SETUID_FIXUP and SECURE_NOROOT
bits on the process. This prevents the kernel granting capabilities to
processes with an effective UID of 0, or with setuid programs. This is
not actually what we want in the container init process. It should be
allowed to run setuid processes & keep capabilities when root. All that
is required is masking a handful of dangerous capabilities from the
bounding set.

* src/lxc/lxc_container.c: Remove bogus capng_lock() call.
This commit is contained in:
Daniel P. Berrange 2009-11-12 11:03:23 +00:00
parent ce62916b6e
commit e6cbadd588
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/lxc/lxc_container.c
View File

@ -694,12 +694,11 @@ static int lxcContainerDropCapabilities(void)
return -1; return -1;
} }
/* Need to prevent them regaining any caps on exec */ /* We do not need to call capng_lock() in this case. The bounding
if ((ret = capng_lock()) < 0) { * set restriction will prevent them reacquiring sys_boot/module/time,
lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR, * etc which is all that matters for the container. Once inside the
_("Failed to lock capabilities: %d"), ret); * container it is fine for SECURE_NOROOT / SECURE_NO_SETUID_FIXUP to
return -1; * be unmasked - they can never escape the bounding set. */
}
#else #else
VIR_WARN0(_("libcap-ng support not compiled in, unable to clear capabilities")); VIR_WARN0(_("libcap-ng support not compiled in, unable to clear capabilities"));