mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-31 04:39:34 +00:00
Code Issues Releases Wiki Activity

Update the openvswitch bridge attach code

Browse Source 
1. don't determine ovs-vsctl path at configure time, do it at runtime

2. lxc-user-nic: set a sane path to protect from unpriv users

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn
2014-08-22 20:29:23 +00:00
committed by Stéphane Graber
parent 361e0e3c08
commit 6ad22d063a
4 changed files with 12 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
configure.ac
View File

@@ -204,16 +204,6 @@ fi
AM_CONDITIONAL([ENABLE_API_DOCS], [test "x$HAVE_DOXYGEN" != "x"])
# Openvswitch
AC_PATH_PROG([OVS_CTL_PATH],[ovs-vsctl])
if test "x$OVS_CTL_PATH" != "x"; then
enable_ovs="yes"
AS_AC_EXPAND(OVS_CTL_PATH, "$OVS_CTL_PATH")
else
enable_ovs="no"
fi
AM_CONDITIONAL([HAVE_OVS], [test "x$enable_ovs" = "xyes"])
# Apparmor
AC_ARG_ENABLE([apparmor],
[AC_HELP_STRING([--enable-apparmor], [enable apparmor support [default=auto]])],
@@ -782,7 +772,6 @@ Environment:
- rpath: $enable_rpath
- GnuTLS: $enable_gnutls
- Bash integration: $enable_bash
- Openvswitch: $enable_ovs
Security features:
- Apparmor: $enable_apparmor

4
src/lxc/Makefile.am
View File

@@ -129,10 +129,6 @@ if ENABLE_APPARMOR
AM_CFLAGS += -DHAVE_APPARMOR
endif
if HAVE_OVS
AM_CFLAGS += -DHAVE_OVS -DOVS_CTL_PATH=\"$(OVS_CTL_PATH)\"
endif
if ENABLE_CGMANAGER
AM_CFLAGS += -DHAVE_CGMANAGER
endif

5
src/lxc/lxc_user_nic.c
View File

@@ -590,6 +590,11 @@ int main(int argc, char *argv[])
char *vethname = NULL;
int pid;
/* set a sane path, because we are setuid-root */
if (setenv("PATH", "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", 1) < 0) {
fprintf(stderr, "Failed to set PATH, exiting\n");
exit(1);
}
if ((me = get_username()) == NULL) {
fprintf(stderr, "Failed to get username\n");
exit(1);

20
src/lxc/network.c
View File

@@ -1171,7 +1171,6 @@ int lxc_ipv6_dest_add(int ifindex, struct in6_addr *dest)
return ip_route_dest_add(AF_INET6, ifindex, dest);
}
#ifdef HAVE_OVS
static bool is_ovs_bridge(const char *bridge)
{
char brdirname[22 + IFNAMSIZ + 1] = {0};
@@ -1186,7 +1185,12 @@ static bool is_ovs_bridge(const char *bridge)
static int attach_to_ovs_bridge(const char *bridge, const char *nic)
{
pid_t pid;
const char *progname;
char *cmd;
cmd = on_path("ovs-vsctl", NULL);
if (!cmd)
return -1;
free(cmd);
pid = fork();
if (pid < 0)
@@ -1194,21 +1198,11 @@ static int attach_to_ovs_bridge(const char *bridge, const char *nic)
if (pid > 0)
return wait_for_pid(pid);
progname = strrchr(OVS_CTL_PATH, '/');
if (!progname) // not sane, should we just fail?
progname = OVS_CTL_PATH;
if (execl(OVS_CTL_PATH, progname, "add-port", bridge, nic, NULL))
if (execlp("ovs-vsctl", "ovs-vsctl", "add-port", bridge, nic, NULL))
exit(1);
// not reached
exit(1);
}
#else
static inline bool is_ovs_bridge(const char *bridge) { return false; }
static inline int attach_to_ovs_bridge(const char *bridge, const char *nic)
{
return -1;
}
#endif
/*
* There is a lxc_bridge_attach, but no need of a bridge detach