summaryrefslogtreecommitdiff
path: root/src/machine
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2013-12-13 22:02:47 +0100
committerLennart Poettering <lennart@poettering.net>2013-12-14 05:10:25 +0100
commitbc9fd78c7bfc39881e19457e476393635f8b0442 (patch)
tree3c4dc6461460a2b4094516eb35424d36f52f455a /src/machine
parent3fa5dd6de798e17d93531bc900b8e2dc587c38f3 (diff)
bus: when connecting to a container's kdbus instance, enter namespace first
Previously we'd open the connection in the originating namespace, which meant most peers of the bus would not be able to make sense of the PID/UID/... identity of us since we didn't exist in the namespace they run in. However they require this identity for privilege decisions, hence disallowing access to anything from the host. Instead, when connecting to a container, create a temporary subprocess, make it join the container's namespace and then connect from there to the kdbus instance. This is similar to how we do it for socket conections already. THis also unifies the namespacing code used by machinectl and the bus APIs.
Diffstat (limited to 'src/machine')
-rw-r--r--src/machine/machinectl.c41
1 files changed, 12 insertions, 29 deletions
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index 7bb7086056..f5485b3d42 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -398,8 +398,8 @@ static int terminate_machine(sd_bus *bus, char **args, unsigned n) {
}
static int openpt_in_namespace(pid_t pid, int flags) {
+ _cleanup_close_pipe_ int pair[2] = { -1, -1 };
_cleanup_close_ int nsfd = -1, rootfd = -1;
- _cleanup_close_pipe_ int sock[2] = { -1, -1 };
union {
struct cmsghdr cmsghdr;
uint8_t buf[CMSG_SPACE(sizeof(int))];
@@ -410,23 +410,14 @@ static int openpt_in_namespace(pid_t pid, int flags) {
};
struct cmsghdr *cmsg;
int master = -1, r;
- char *ns, *root;
pid_t child;
siginfo_t si;
- ns = procfs_file_alloca(pid, "ns/mnt");
-
- nsfd = open(ns, O_RDONLY|O_NOCTTY|O_CLOEXEC);
- if (nsfd < 0)
- return -errno;
-
- root = procfs_file_alloca(pid, "root");
-
- rootfd = open(root, O_RDONLY|O_NOCTTY|O_CLOEXEC|O_DIRECTORY);
- if (rootfd < 0)
- return -errno;
+ r = namespace_open(pid, &nsfd, &rootfd);
+ if (r < 0)
+ return r;
- if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sock) < 0)
+ if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0)
return -errno;
child = fork();
@@ -434,19 +425,13 @@ static int openpt_in_namespace(pid_t pid, int flags) {
return -errno;
if (child == 0) {
- close_nointr_nofail(sock[0]);
- sock[0] = -1;
+ close_nointr_nofail(pair[0]);
+ pair[0] = -1;
- r = setns(nsfd, CLONE_NEWNS);
+ r = namespace_enter(nsfd, rootfd);
if (r < 0)
_exit(EXIT_FAILURE);
- if (fchdir(rootfd) < 0)
- _exit(EXIT_FAILURE);
-
- if (chroot(".") < 0)
- _exit(EXIT_FAILURE);
-
master = posix_openpt(flags);
if (master < 0)
_exit(EXIT_FAILURE);
@@ -459,18 +444,16 @@ static int openpt_in_namespace(pid_t pid, int flags) {
mh.msg_controllen = cmsg->cmsg_len;
- r = sendmsg(sock[1], &mh, MSG_NOSIGNAL);
- close_nointr_nofail(master);
- if (r < 0)
+ if (sendmsg(pair[1], &mh, MSG_NOSIGNAL) < 0)
_exit(EXIT_FAILURE);
_exit(EXIT_SUCCESS);
}
- close_nointr_nofail(sock[1]);
- sock[1] = -1;
+ close_nointr_nofail(pair[1]);
+ pair[1] = -1;
- if (recvmsg(sock[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
+ if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
return -errno;
for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))