X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=lxcsu-internal;h=e30358351fe4705ef0cd621cd2bae11e8315d84c;hb=5644df40218b4c1c14ae96a3edca458586b3e9dc;hp=782ae6712688595e17093d4087f3314c5cdba8ef;hpb=cd6d6843b328c330a5934cd665c815fda3eb129f;p=lxc-userspace.git

diff --git a/lxcsu-internal b/lxcsu-internal
index 782ae67..e303583 100755
--- a/lxcsu-internal
+++ b/lxcsu-internal
@@ -3,7 +3,6 @@
 
 import setns
 import os
-import sys
 
 from argparse import ArgumentParser
 
@@ -47,10 +46,10 @@ def main ():
     parser.add_argument ("slice_name")
     parser.add_argument ("command_to_run",nargs="*")
 
-    options = parser.parse_args()
-    slice_name=options.slice_name
+    args = parser.parse_args()
+    slice_name=args.slice_name
     # support for either setting debug at the top of this file, or on the command-line
-    if options.debug:
+    if args.debug:
         global debug
         debug=True
 
@@ -80,7 +79,7 @@ def main ():
                 slice_path = path
                 pid = slice_path.split('/')[2]
                 cmdline = open('/proc/%s/cmdline'%pid).read().rstrip('\n\x00')
-                if (cmdline == '/sbin/init'):
+                if (cmdline == '/sbin/init') or (cmdline.startswith("init [")):
                     slice_spec = slice_path
                     arch = getarch('/proc/%s/exe'%pid)
                     break
@@ -142,19 +141,25 @@ def main ():
 
     setns.chcontext('/proc/%s/ns/uts'%pid)
     setns.chcontext('/proc/%s/ns/ipc'%pid)
+    
+    if (not args.pidns):
+        setns.chcontext('/proc/%s/ns/pid'%pid)
 
-    if (not options.netns):
+    if (not args.netns):
         setns.chcontext('/proc/%s/ns/net'%pid)
 
-    if (not options.mntns):
+    if (not args.mntns):
         setns.chcontext('/proc/%s/ns/mnt'%pid)
 
-    if (not options.pidns):
-        setns.chcontext('/proc/%s/ns/pid'%pid)
+    
 
+    proc_mounted = False
     if (not os.access('/proc/self',0)):
+        proc_mounted = True
         setns.proc_mount()
 
+    
+
     # cgroups is not yet LXC-safe, so we need to use the course grained access control
     # strategy of unmounting the filesystem
 
@@ -171,20 +176,48 @@ def main ():
 
     pid = os.fork()
 
+    # capsh has a --user option starting with f14
+    # so if only for f12 we need to fake this one
+    #
+    # capsh.c does essentially the following when invoked with --user:
+    #	    pwd = getpwnam(user); ...
+    #	    ngroups = MAX_GROUPS; 
+    #	    status = getgrouplist(user, pwd->pw_gid, groups, &ngroups); ...
+    #	    status = setgroups(ngroups, groups); ...
+    #	    status = setgid(pwd->pw_gid); ...
+    #	    status = setuid(pwd->pw_uid); ...
+    # however we cannot simulate that ourselves because if we did in this process then
+    # capsh could not be allowed to mess with caps any more
+
+    def getuid (slicename):
+        import pwd
+        try:
+            return pwd.getpwnam(slicename).pw_uid
+        except:
+            return
+
     if (pid == 0):
         cap_arg = '--drop='+drop_capabilities
 
-        if (not options.root):
-            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--','--login']+options.command_to_run
-# Thierry's suggestion:exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+options.command_to_run
+        if (not args.root):
+            uid = getuid (slice_name)
+            if not uid:
+                print "lxcsu-internal could not spot %s in /etc/passwd - exiting"%slice_name
+                exit(1)
+            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--uid=%s'%uid,'--','--login',]+args.command_to_run
+# once we can drop f12, it would be nicer to instead go for
+#            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run
         else:
-            exec_args = [arch,'/usr/sbin/capsh','--','--login']+options.command_to_run
+            exec_args = [arch,'/usr/sbin/capsh','--','--login']+args.command_to_run
 
         os.environ['SHELL'] = '/bin/sh'
-# Thierry's suggestion:os.environ['HOME'] = '/home/%s'%slice_name
+        os.environ['HOME'] = '/home/%s'%slice_name
+        os.environ['LD_PRELOAD'] = '/etc/planetlab/lib/bind_public.so'
+        os.chdir("/home/%s"%(slice_name))
         if debug: print 'lxcsu-internal:execv:','/usr/bin/setarch',exec_args
         os.execv('/usr/bin/setarch',exec_args)
     else:
+        setns.proc_umount()
         _,status = os.waitpid(pid,0)
         exit(os.WEXITSTATUS(status))