X-Git-Url: http://git.onelab.eu/?p=lxc-userspace.git;a=blobdiff_plain;f=lxcsu-internal;h=e30358351fe4705ef0cd621cd2bae11e8315d84c;hp=238d5e088eb052766c3f61ac63906552aec02df2;hb=5644df40218b4c1c14ae96a3edca458586b3e9dc;hpb=31d89c9e322ddc4704340f8b6ed53f2dcae3f52e

diff --git a/lxcsu-internal b/lxcsu-internal
index 238d5e0..e303583 100755
--- a/lxcsu-internal
+++ b/lxcsu-internal
@@ -176,11 +176,37 @@ def main ():
 
     pid = os.fork()
 
+    # capsh has a --user option starting with f14
+    # so if only for f12 we need to fake this one
+    #
+    # capsh.c does essentially the following when invoked with --user:
+    #	    pwd = getpwnam(user); ...
+    #	    ngroups = MAX_GROUPS; 
+    #	    status = getgrouplist(user, pwd->pw_gid, groups, &ngroups); ...
+    #	    status = setgroups(ngroups, groups); ...
+    #	    status = setgid(pwd->pw_gid); ...
+    #	    status = setuid(pwd->pw_uid); ...
+    # however we cannot simulate that ourselves because if we did in this process then
+    # capsh could not be allowed to mess with caps any more
+
+    def getuid (slicename):
+        import pwd
+        try:
+            return pwd.getpwnam(slicename).pw_uid
+        except:
+            return
+
     if (pid == 0):
         cap_arg = '--drop='+drop_capabilities
 
         if (not args.root):
-            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run
+            uid = getuid (slice_name)
+            if not uid:
+                print "lxcsu-internal could not spot %s in /etc/passwd - exiting"%slice_name
+                exit(1)
+            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--uid=%s'%uid,'--','--login',]+args.command_to_run
+# once we can drop f12, it would be nicer to instead go for
+#            exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run
         else:
             exec_args = [arch,'/usr/sbin/capsh','--','--login']+args.command_to_run