mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-09-01 01:11:10 +00:00
Code Issues Releases Wiki Activity

Set UID/GID to parent value for lxc-execute

Browse Source 
Signed-off-by: Patrick Toomey <ptoomey3@biasedcoin.com>
This commit is contained in:
Patrick Toomey
2015-07-20 12:37:20 -06:00
parent e06155c9ab
commit 56f8ff00e3
3 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/lxc/conf.c
View File

@@ -2604,6 +2604,9 @@ struct lxc_conf *lxc_conf_init(void)
for (i = 0; i < LXC_NS_MAX; i++)
new->inherit_ns_fd[i] = -1;
new->parent_uid = getuid();
new->parent_gid = getgid();
return new;
}

4
src/lxc/conf.h
View File

@@ -365,6 +365,10 @@ struct lxc_conf {
/* init command */
char *init_cmd;
/* The UID/GID of the process creating the container */
uid_t parent_uid;
gid_t parent_gid;
};
#ifdef HAVE_TLS

10
src/lxc/start.c
View File

@@ -667,13 +667,15 @@ static int do_start(void *data)
* privilege over our namespace. We don't become root for lxc-execute, as
* the intent is to execute a command as the original user.
*/
if (!handler->conf->is_execute && !lxc_list_empty(&handler->conf->id_map)) {
NOTICE("switching to gid/uid 0 in new user namespace");
if (setgid(0)) {
if (!lxc_list_empty(&handler->conf->id_map)) {
gid_t new_gid = handler->conf->is_execute ? handler->conf->parent_gid : 0;
gid_t new_uid = handler->conf->is_execute ? handler->conf->parent_uid : 0;
NOTICE("switching to gid/uid %d/%d in new user namespace", new_gid, new_uid);
if (setgid(new_gid)) {
SYSERROR("setgid");
goto out_warn_father;
}
if (setuid(0)) {
if (setuid(new_uid)) {
SYSERROR("setuid");
goto out_warn_father;
}