summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2011-08-02 04:49:37 +0200
committerLennart Poettering <lennart@poettering.net>2011-08-02 04:49:37 +0200
commita41fe3a29372f8e6c4e7733bf85940a023811301 (patch)
tree17a7ef7e41da9f0f0501f7f02a996acd0f67d155
parent72b9ed828bd22f3ddd74b6853c183eebf006d6d8 (diff)
nspawn: add new --no-net switch to turn off networking in the container
-rw-r--r--Makefile.am3
-rw-r--r--man/systemd-nspawn.xml11
-rw-r--r--src/nspawn.c26
3 files changed, 33 insertions, 7 deletions
diff --git a/Makefile.am b/Makefile.am
index 7971b6b774..c446527e1b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1341,7 +1341,8 @@ systemd_cgls_LDADD = \
systemd_nspawn_SOURCES = \
src/nspawn.c \
- src/cgroup-util.c
+ src/cgroup-util.c \
+ src/loopback-setup.c
systemd_nspawn_CFLAGS = \
$(AM_CFLAGS)
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 03c39fc3de..8b37519ad5 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -123,6 +123,7 @@
<variablelist>
<varlistentry>
<term><option>--help</option></term>
+ <term><option>-h</option></term>
<listitem><para>Prints a short help
text and exits.</para></listitem>
@@ -152,6 +153,16 @@
</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>--no-net</option></term>
+
+ <listitem><para>Turn off networking in
+ the container. This makes all network
+ interfaces unavailable in the
+ container, with the exception of the
+ loopback device.</para></listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
diff --git a/src/nspawn.c b/src/nspawn.c
index f4d63ea265..c97649d386 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -44,9 +44,11 @@
#include "cgroup-util.h"
#include "sd-daemon.h"
#include "strv.h"
+#include "loopback-setup.h"
static char *arg_directory = NULL;
static char *arg_user = NULL;
+static bool arg_no_net = false;
static int help(void) {
@@ -54,7 +56,8 @@ static int help(void) {
"Spawn a minimal namespace container for debugging, testing and building.\n\n"
" -h --help Show this help\n"
" -D --directory=NAME Root directory for the container\n"
- " -u --user=USER Run the command under specified user or uid\n",
+ " -u --user=USER Run the command under specified user or uid\n"
+ " --no-net Disable network in container\n",
program_invocation_short_name);
return 0;
@@ -62,11 +65,16 @@ static int help(void) {
static int parse_argv(int argc, char *argv[]) {
+ enum {
+ ARG_NO_NET = 0x100
+ };
+
static const struct option options[] = {
- { "help", no_argument, NULL, 'h' },
- { "directory", required_argument, NULL, 'D' },
- { "user", optional_argument, NULL, 'u' },
- { NULL, 0, NULL, 0 }
+ { "help", no_argument, NULL, 'h' },
+ { "directory", required_argument, NULL, 'D' },
+ { "user", required_argument, NULL, 'u' },
+ { "no-net", no_argument, NULL, ARG_NO_NET },
+ { NULL, 0, NULL, 0 }
};
int c;
@@ -100,6 +108,10 @@ static int parse_argv(int argc, char *argv[]) {
break;
+ case ARG_NO_NET:
+ arg_no_net = true;
+ break;
+
case '?':
return -EINVAL;
@@ -698,7 +710,7 @@ int main(int argc, char *argv[]) {
sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
- if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) {
+ if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
log_error("clone() failed: %m");
goto finish;
}
@@ -777,6 +789,8 @@ int main(int argc, char *argv[]) {
umask(0022);
+ loopback_setup();
+
if (drop_capabilities() < 0)
goto child_fail;