From: Sapan Bhatia <gwsapan@gmail.com>
Date: Thu, 6 Sep 2012 11:10:28 +0000 (-0400)
Subject: Drop capabilities in lxcsu
X-Git-Tag: lxctools-0.9-1~13
X-Git-Url: http://git.onelab.eu/?p=lxc-userspace.git;a=commitdiff_plain;h=6b7a68f13c328f74592f5397e362ff6cabe4f209

Drop capabilities in lxcsu
---

diff --git a/lxcsu b/lxcsu
index 67a6974..24fcf45 100755
--- a/lxcsu
+++ b/lxcsu
@@ -6,6 +6,8 @@ import os
 
 from optparse import OptionParser
 
+drop_capabilities='cap_sys_admin,cap_net_admin,cap_sys_boot,cap_sys_module'
+
 parser = OptionParser()
 parser.add_option("-n", "--net",
                   action="store_true", dest="netns", default=False,
@@ -13,6 +15,9 @@ parser.add_option("-n", "--net",
 parser.add_option("-m", "--mnt",
                   action="store_true", dest="mntns", default=False,
                   help="Enter mount namespace")
+parser.add_option("-p", "--pid",
+                  action="store_true", dest="pidns", default=False,
+                  help="Enter pid namespace")
 
 (options, args) = parser.parse_args()
 
@@ -22,7 +27,6 @@ except IndexError:
 	print "You must specify a vm name"
 	exit(1)
 
-
 try:
 	cmd = 'grep %s /proc/*/cgroup | grep freezer'%slice_name
 	output = os.popen(cmd).readlines()
@@ -48,17 +52,14 @@ for e in output:
 	except:
 		break
 
-if (not slice_spec):
-	print "Could not find any processes associated with %s"%slice_name
-
-
-#os.closerange(0,1024)
+if (not slice_spec or not pid):
+    print "Not started: %s"%slice_name
+    exit(1)
 
 r1 = setns.chcontext('/proc/%s/ns/utc'%pid)
 r2 = setns.chcontext('/proc/%s/ns/ipc'%pid)
 path = '/proc/%s/ns/net'%pid
 r3 = setns.chcontext(path)
-os.system('whoami')
 open('/proc/lxcsu','w').write(pid)
-os.system('mount none -t proc /proc')
-os.execv('/bin/sh',['/bin/sh'])
+#os.system('mount none -t proc /proc')
+os.execv('/usr/sbin/capsh',['--drop',drop_capabilities,'--'])
diff --git a/lxctools.spec b/lxctools.spec
index a76fcf0..7d54040 100644
--- a/lxctools.spec
+++ b/lxctools.spec
@@ -52,7 +52,9 @@ rm -rf $RPM_BUILD_ROOT
 
 %files
 /usr/sbin
-/lib
+
+%post
+chmod u+s /usr/sbin/vsh
 
 %postun
 
diff --git a/setns.c b/setns.c
index 323825a..776804d 100644
--- a/setns.c
+++ b/setns.c
@@ -14,7 +14,7 @@ chfscontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
-	printf("Could not open ns file\n");
+	    //printf("Could not open ns file\n");
         sts = -1;
         goto out;
     }
@@ -38,7 +38,7 @@ chcontext(PyObject *self, PyObject *args)
 
     int fd = open(filepath, O_RDONLY);
     if (fd < 0) {
-	printf("Could not open ns file\n");
+//	printf("Could not open ns file\n");
         sts = -1;
         goto out;
     }