From: Thierry Parmentelat Date: Sat, 6 Jul 2013 13:16:47 +0000 (+0200) Subject: capsh --user is available from f14 only X-Git-Tag: lxc-userspace-1.0-6~3 X-Git-Url: http://git.onelab.eu/?p=lxc-userspace.git;a=commitdiff_plain;h=5644df40218b4c1c14ae96a3edca458586b3e9dc capsh --user is available from f14 only use caps --uid instead for now --- diff --git a/lxcsu-internal b/lxcsu-internal index 238d5e0..e303583 100755 --- a/lxcsu-internal +++ b/lxcsu-internal @@ -176,11 +176,37 @@ def main (): pid = os.fork() + # capsh has a --user option starting with f14 + # so if only for f12 we need to fake this one + # + # capsh.c does essentially the following when invoked with --user: + # pwd = getpwnam(user); ... + # ngroups = MAX_GROUPS; + # status = getgrouplist(user, pwd->pw_gid, groups, &ngroups); ... + # status = setgroups(ngroups, groups); ... + # status = setgid(pwd->pw_gid); ... + # status = setuid(pwd->pw_uid); ... + # however we cannot simulate that ourselves because if we did in this process then + # capsh could not be allowed to mess with caps any more + + def getuid (slicename): + import pwd + try: + return pwd.getpwnam(slicename).pw_uid + except: + return + if (pid == 0): cap_arg = '--drop='+drop_capabilities if (not args.root): - exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run + uid = getuid (slice_name) + if not uid: + print "lxcsu-internal could not spot %s in /etc/passwd - exiting"%slice_name + exit(1) + exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--uid=%s'%uid,'--','--login',]+args.command_to_run +# once we can drop f12, it would be nicer to instead go for +# exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--user=%s'%slice_name,'--','--login',]+args.command_to_run else: exec_args = [arch,'/usr/sbin/capsh','--','--login']+args.command_to_run