X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=lxcsu-internal;h=9dbb9ef022b5679b62c31c8b9d6c562b080168e2;hb=856c2228df620c4051ab41dd2665a5fa2f2a7264;hp=184b68f49664765927b9d14f0472dedc660629ba;hpb=88ab4535591a1f764b77b469bf5d86683428dc8e;p=lxc-userspace.git diff --git a/lxcsu-internal b/lxcsu-internal index 184b68f..9dbb9ef 100755 --- a/lxcsu-internal +++ b/lxcsu-internal @@ -80,7 +80,7 @@ def main (): slice_path = path pid = slice_path.split('/')[2] cmdline = open('/proc/%s/cmdline'%pid).read().rstrip('\n\x00') - if (cmdline == '/sbin/init'): + if (cmdline == '/sbin/init') or (cmdline.startswith("init [")): slice_spec = slice_path arch = getarch('/proc/%s/exe'%pid) break @@ -142,6 +142,9 @@ def main (): setns.chcontext('/proc/%s/ns/uts'%pid) setns.chcontext('/proc/%s/ns/ipc'%pid) + + if (not args.pidns): + setns.chcontext('/proc/%s/ns/pid'%pid) if (not args.netns): setns.chcontext('/proc/%s/ns/net'%pid) @@ -149,12 +152,15 @@ def main (): if (not args.mntns): setns.chcontext('/proc/%s/ns/mnt'%pid) - if (not args.pidns): - setns.chcontext('/proc/%s/ns/pid'%pid) + + proc_mounted = False if (not os.access('/proc/self',0)): + proc_mounted = True setns.proc_mount() + + # cgroups is not yet LXC-safe, so we need to use the course grained access control # strategy of unmounting the filesystem @@ -175,8 +181,7 @@ def main (): cap_arg = '--drop='+drop_capabilities if (not args.root): - exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--','--login']+args.command_to_run -# Thierry's suggestion:exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run + exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run else: exec_args = [arch,'/usr/sbin/capsh','--','--login']+args.command_to_run @@ -185,6 +190,7 @@ def main (): if debug: print 'lxcsu-internal:execv:','/usr/bin/setarch',exec_args os.execv('/usr/bin/setarch',exec_args) else: + setns.proc_umount() _,status = os.waitpid(pid,0) exit(os.WEXITSTATUS(status))