[lxc-devel] [lxc/master] start.c: always handing uid and gid
tanyifeng on Github
lxc-bot at linuxcontainers.org
Fri Nov 24 05:45:44 UTC 2017
A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 845 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20171124/1840df04/attachment.bin>
-------------- next part --------------
From 217e9f97ab00f4950f1c6bb473cbb44da51f041e Mon Sep 17 00:00:00 2001
From: Yifeng Tan <tanyifeng1 at huawei.com>
Date: Fri, 24 Nov 2017 20:03:47 +0800
Subject: [PATCH] start.c: always handing uid and gid
Signed-off-by: Yifeng Tan <tanyifeng1 at huawei.com>
---
src/lxc/start.c | 40 +++++++++++++++++++---------------------
1 file changed, 19 insertions(+), 21 deletions(-)
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 4d583125b..300d338db 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -1009,30 +1009,28 @@ static int do_start(void *data)
/* The container has been setup. We can now switch to an unprivileged
* uid/gid.
*/
- if (handler->conf->is_execute) {
- bool have_cap_setgid;
- uid_t new_uid = handler->conf->init_uid;
- gid_t new_gid = handler->conf->init_gid;
-
- /* If we are in a new user namespace we already dropped all
- * groups when we switched to root in the new user namespace
- * further above. Only drop groups if we can, so ensure that we
- * have necessary privilege.
- */
- #if HAVE_LIBCAP
- have_cap_setgid = lxc_proc_cap_is_set(CAP_SETGID, CAP_EFFECTIVE);
- #else
- have_cap_setgid = false;
- #endif
- if (lxc_list_empty(&handler->conf->id_map) && have_cap_setgid) {
- if (lxc_setgroups(0, NULL) < 0)
- goto out_warn_father;
- }
-
- if (lxc_switch_uid_gid(new_uid, new_gid) < 0)
+ bool have_cap_setgid;
+ uid_t new_uid = handler->conf->init_uid;
+ gid_t new_gid = handler->conf->init_gid;
+
+ /* If we are in a new user namespace we already dropped all
+ * groups when we switched to root in the new user namespace
+ * further above. Only drop groups if we can, so ensure that we
+ * have necessary privilege.
+ */
+ #if HAVE_LIBCAP
+ have_cap_setgid = lxc_proc_cap_is_set(CAP_SETGID, CAP_EFFECTIVE);
+ #else
+ have_cap_setgid = false;
+ #endif
+ if (lxc_list_empty(&handler->conf->id_map) && have_cap_setgid) {
+ if (lxc_setgroups(0, NULL) < 0)
goto out_warn_father;
}
+ if (lxc_switch_uid_gid(new_uid, new_gid) < 0)
+ goto out_warn_father;
+
/* After this call, we are in error because this ops should not return
* as it execs.
*/
More information about the lxc-devel
mailing list