Fixes to kvmsu function

[lxc-userspace.git] / setns.c

diff --git a/setns.c b/setns.c
index c40d52b..aa907b0 100644 (file)
--- a/setns.c
+++ b/setns.c
@@ -1,8 +1,43 @@
 #include <Python.h>
 #include <fcntl.h>
 #include <stdio.h>
-#include <asm-generic/unistd.h>
+#include <asm/unistd.h>
 #include <sys/mount.h>
+#include <errno.h>
+#include <sys/prctl.h>
+#include <linux/capability.h>
+
+static PyObject *
+drop_caps(PyObject *self, PyObject *args)
+{
+       unsigned int to_drop[128] = {CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_SYS_BOOT,CAP_MKNOD,CAP_MAC_ADMIN,CAP_SYS_MODULE};
+       unsigned int i;
+       for (i = 0;i<6;i++) {
+               if (prctl(PR_CAPBSET_DROP, to_drop[i], 0, 0, 0) == -1) {
+                       perror("prctl");
+                       return Py_BuildValue("i", 2);
+               }
+       }
+       return Py_BuildValue("i", 0);
+}
+
+static PyObject *
+proc_mount(PyObject *self, PyObject *args)
+{
+    int sts; 
+    sts = mount("none","/proc","proc",0,NULL);
+
+    return Py_BuildValue("i", sts);
+}
+
+static PyObject *
+proc_umount(PyObject *self, PyObject *args)
+{
+    int sts; 
+    sts = umount("/proc");
+
+    return Py_BuildValue("i", sts);
+}
 
 static PyObject *
 chfscontext(PyObject *self, PyObject *args)
@@ -15,29 +50,20 @@ chfscontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
-           //printf("Could not open ns file\n");
-        sts = -1;
+        sts = -errno;
         goto out;
     }
     
-    if (setns(fd, 666)) {
-        sts = -1;
+    if (setns(fd, 0)) {
+        sts = -errno;
     }
     close(fd);
+    sts = 0;
 
 out:
     return Py_BuildValue("i", sts);
 }
 
-static PyObject *
-proc_mount(PyObject *self, PyObject *args)
-{
-    int sts; 
-    sts = mount("none","/proc","proc",0,NULL);
-
-    return Py_BuildValue("i", sts);
-}
-
 static PyObject *
 chcontext(PyObject *self, PyObject *args)
 {
@@ -49,15 +75,15 @@ chcontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
-//     printf("Could not open ns file\n");
-        sts = -1;
+        sts = -errno;
         goto out;
     }
     
     if (setns(fd, 0)) {
-        sts = -1;
+        sts = -errno;
     }
     close(fd);
+    sts = 0;
 
 out:
     return Py_BuildValue("i", sts);
@@ -66,7 +92,9 @@ out:
 static PyMethodDef SetnsMethods[] =
 {
          {"proc_mount", proc_mount, METH_VARARGS, "Mount a volume via the mount system call."},
+         {"proc_umount", proc_umount, METH_VARARGS, "Umount a volume via the umount system call."},
          {"chcontext", chcontext, METH_VARARGS, "Switch into an lxc container."},
+         {"drop_caps", drop_caps, METH_VARARGS, "Drop dangerous capabilities."},
          {"chfscontext", chfscontext, METH_VARARGS, "Switch into an lxc container."},
               {NULL, NULL, 0, NULL}
 };