diff options
| author | Lennart Poettering <lennart@poettering.net> | 2011-08-02 05:24:58 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2011-08-02 05:24:58 +0200 |
| commit | ff01d048b4c1455241c894cf7982662c9d28fd34 (patch) | |
| tree | 025e54f24e3e4879898e4be84b4e082367902f6a /src/nspawn.c | |
| parent | 4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16 (diff) | |
exec: introduce PrivateNetwork= process option to turn off network access to specific services
Diffstat (limited to 'src/nspawn.c')
| -rw-r--r-- | src/nspawn.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/src/nspawn.c b/src/nspawn.c index c97649d386..2c1144a7f5 100644 --- a/src/nspawn.c +++ b/src/nspawn.c @@ -48,7 +48,7 @@ static char *arg_directory = NULL; static char *arg_user = NULL; -static bool arg_no_net = false; +static bool arg_private_network = false; static int help(void) { @@ -57,7 +57,7 @@ static int help(void) { " -h --help Show this help\n" " -D --directory=NAME Root directory for the container\n" " -u --user=USER Run the command under specified user or uid\n" - " --no-net Disable network in container\n", + " --private-network Disable network in container\n", program_invocation_short_name); return 0; @@ -66,15 +66,15 @@ static int help(void) { static int parse_argv(int argc, char *argv[]) { enum { - ARG_NO_NET = 0x100 + ARG_PRIVATE_NETWORK = 0x100 }; static const struct option options[] = { - { "help", no_argument, NULL, 'h' }, - { "directory", required_argument, NULL, 'D' }, - { "user", required_argument, NULL, 'u' }, - { "no-net", no_argument, NULL, ARG_NO_NET }, - { NULL, 0, NULL, 0 } + { "help", no_argument, NULL, 'h' }, + { "directory", required_argument, NULL, 'D' }, + { "user", required_argument, NULL, 'u' }, + { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK }, + { NULL, 0, NULL, 0 } }; int c; @@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) { break; - case ARG_NO_NET: - arg_no_net = true; + case ARG_PRIVATE_NETWORK: + arg_private_network = true; break; case '?': @@ -710,7 +710,7 @@ int main(int argc, char *argv[]) { sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1); assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0); - if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) { + if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) { log_error("clone() failed: %m"); goto finish; } |