X-Git-Url: http://git.onelab.eu/?p=lxc-userspace.git;a=blobdiff_plain;f=setns.c;h=84116d951b9aa4561c793fe1ea7c049b3effee60;hp=36aa360bbb803efb6010559cfe710043684f5d06;hb=HEAD;hpb=91f7d4ab476dc6fb2fa5cfeb9a20c6484cc24700

diff --git a/setns.c b/setns.c
index 36aa360..84116d9 100644
--- a/setns.c
+++ b/setns.c
@@ -4,11 +4,29 @@
 #include <asm/unistd.h>
 #include <sys/mount.h>
 #include <errno.h>
+#include <sys/prctl.h>
+#include <linux/capability.h>
+
+static PyObject *
+drop_caps(PyObject *self, PyObject *args)
+{
+	unsigned int to_drop[128]
+		= {CAP_NET_ADMIN, CAP_SYS_ADMIN, CAP_SYS_BOOT,
+			CAP_MKNOD, CAP_MAC_ADMIN, CAP_SYS_MODULE};
+	unsigned int i;
+	for (i = 0; i<6 ; i++) {
+		if (prctl(PR_CAPBSET_DROP, to_drop[i], 0, 0, 0) == -1) {
+			perror("prctl");
+			return Py_BuildValue("i", 2);
+		}
+	}
+	return Py_BuildValue("i", 0);
+}
 
 static PyObject *
 proc_mount(PyObject *self, PyObject *args)
 {
-    int sts; 
+    int sts;
     sts = mount("none","/proc","proc",0,NULL);
 
     return Py_BuildValue("i", sts);
@@ -17,7 +35,7 @@ proc_mount(PyObject *self, PyObject *args)
 static PyObject *
 proc_umount(PyObject *self, PyObject *args)
 {
-    int sts; 
+    int sts;
     sts = umount("/proc");
 
     return Py_BuildValue("i", sts);
@@ -37,7 +55,7 @@ chfscontext(PyObject *self, PyObject *args)
         sts = -errno;
         goto out;
     }
-    
+
     if (setns(fd, 0)) {
         sts = -errno;
     }
@@ -62,7 +80,7 @@ chcontext(PyObject *self, PyObject *args)
         sts = -errno;
         goto out;
     }
-    
+
     if (setns(fd, 0)) {
         sts = -errno;
     }
@@ -75,16 +93,29 @@ out:
 
 static PyMethodDef SetnsMethods[] =
 {
-         {"proc_mount", proc_mount, METH_VARARGS, "Mount a volume via the mount system call."},
-         {"proc_umount", proc_umount, METH_VARARGS, "Umount a volume via the umount system call."},
-         {"chcontext", chcontext, METH_VARARGS, "Switch into an lxc container."},
-         {"chfscontext", chfscontext, METH_VARARGS, "Switch into an lxc container."},
-              {NULL, NULL, 0, NULL}
+	{"proc_mount", proc_mount, METH_VARARGS, "Mount a volume via the mount system call."},
+	{"proc_umount", proc_umount, METH_VARARGS, "Umount a volume via the umount system call."},
+	{"chcontext", chcontext, METH_VARARGS, "Switch into an lxc container."},
+	{"drop_caps", drop_caps, METH_VARARGS, "Drop dangerous capabilities."},
+	{"chfscontext", chfscontext, METH_VARARGS, "Switch into an lxc container."},
+	{NULL, NULL, 0, NULL}
 };
- 
-PyMODINIT_FUNC
- 
-initsetns(void)
-{
-         (void) Py_InitModule("setns", SetnsMethods);
+
+static struct PyModuleDef moduledef = {
+	PyModuleDef_HEAD_INIT,
+	"setns",
+	"http://git.onelab.eu/?p=lxc-userspace.git;a=summary",
+	-1,
+	SetnsMethods,
+	NULL,
+	NULL,
+	NULL,
+	NULL
+};
+
+PyObject *PyInit_setns(void){
+	PyObject *module = PyModule_Create(&moduledef);
+    if (module == NULL)
+        return NULL;
+	return module;
 }