Drop capabilities in lxcsu

diff --git a/lxcsu b/lxcsu
index 67a6974..24fcf45 100755 (executable)
--- a/lxcsu
+++ b/lxcsu
@@ -6,6 +6,8 @@ import os
 
 from optparse import OptionParser
 
 
 from optparse import OptionParser
 

+drop_capabilities='cap_sys_admin,cap_net_admin,cap_sys_boot,cap_sys_module'
+

 parser = OptionParser()
 parser.add_option("-n", "--net",
                   action="store_true", dest="netns", default=False,
 parser = OptionParser()
 parser.add_option("-n", "--net",
                   action="store_true", dest="netns", default=False,


@@ -13,6 +15,9 @@ parser.add_option("-n", "--net",
 parser.add_option("-m", "--mnt",
                   action="store_true", dest="mntns", default=False,
                   help="Enter mount namespace")
 parser.add_option("-m", "--mnt",
                   action="store_true", dest="mntns", default=False,
                   help="Enter mount namespace")

+parser.add_option("-p", "--pid",
+                  action="store_true", dest="pidns", default=False,
+                  help="Enter pid namespace")

 
 (options, args) = parser.parse_args()
 
 
 (options, args) = parser.parse_args()
 


@@ -22,7 +27,6 @@ except IndexError:
        print "You must specify a vm name"
        exit(1)
 
        print "You must specify a vm name"
        exit(1)
 

-

 try:
        cmd = 'grep %s /proc/*/cgroup | grep freezer'%slice_name
        output = os.popen(cmd).readlines()
 try:
        cmd = 'grep %s /proc/*/cgroup | grep freezer'%slice_name
        output = os.popen(cmd).readlines()


@@ -48,17 +52,14 @@ for e in output:
        except:
                break
 
        except:
                break
 

-if (not slice_spec):
-       print "Could not find any processes associated with %s"%slice_name
-
-
-#os.closerange(0,1024)
+if (not slice_spec or not pid):
+    print "Not started: %s"%slice_name
+    exit(1)

 
 r1 = setns.chcontext('/proc/%s/ns/utc'%pid)
 r2 = setns.chcontext('/proc/%s/ns/ipc'%pid)
 path = '/proc/%s/ns/net'%pid
 r3 = setns.chcontext(path)
 
 r1 = setns.chcontext('/proc/%s/ns/utc'%pid)
 r2 = setns.chcontext('/proc/%s/ns/ipc'%pid)
 path = '/proc/%s/ns/net'%pid
 r3 = setns.chcontext(path)

-os.system('whoami')

 open('/proc/lxcsu','w').write(pid)
 open('/proc/lxcsu','w').write(pid)

-os.system('mount none -t proc /proc')
-os.execv('/bin/sh',['/bin/sh'])
+#os.system('mount none -t proc /proc')
+os.execv('/usr/sbin/capsh',['--drop',drop_capabilities,'--'])

diff --git a/lxctools.spec b/lxctools.spec
index a76fcf0..7d54040 100644 (file)
--- a/lxctools.spec
+++ b/lxctools.spec
@@ -52,7 +52,9 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 /usr/sbin
 
 %files
 /usr/sbin

-/lib
+
+%post
+chmod u+s /usr/sbin/vsh

 
 %postun
 
 
 %postun
 

diff --git a/setns.c b/setns.c
index 323825a..776804d 100644 (file)
--- a/setns.c
+++ b/setns.c
@@ -14,7 +14,7 @@ chfscontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {

-       printf("Could not open ns file\n");
+           //printf("Could not open ns file\n");

         sts = -1;
         goto out;
     }
         sts = -1;
         goto out;
     }


@@ -38,7 +38,7 @@ chcontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {

-       printf("Could not open ns file\n");
+//     printf("Could not open ns file\n");

         sts = -1;
         goto out;
     }
         sts = -1;
         goto out;
     }