diff options
| -rw-r--r-- | Makefile.am | 3 | ||||
| -rw-r--r-- | man/systemd-nspawn.xml | 11 | ||||
| -rw-r--r-- | src/nspawn.c | 26 |
3 files changed, 33 insertions, 7 deletions
diff --git a/Makefile.am b/Makefile.am index 7971b6b774..c446527e1b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1341,7 +1341,8 @@ systemd_cgls_LDADD = \ systemd_nspawn_SOURCES = \ src/nspawn.c \ - src/cgroup-util.c + src/cgroup-util.c \ + src/loopback-setup.c systemd_nspawn_CFLAGS = \ $(AM_CFLAGS) diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 03c39fc3de..8b37519ad5 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -123,6 +123,7 @@ <variablelist> <varlistentry> <term><option>--help</option></term> + <term><option>-h</option></term> <listitem><para>Prints a short help text and exits.</para></listitem> @@ -152,6 +153,16 @@ </para></listitem> </varlistentry> + <varlistentry> + <term><option>--no-net</option></term> + + <listitem><para>Turn off networking in + the container. This makes all network + interfaces unavailable in the + container, with the exception of the + loopback device.</para></listitem> + </varlistentry> + </variablelist> </refsect1> diff --git a/src/nspawn.c b/src/nspawn.c index f4d63ea265..c97649d386 100644 --- a/src/nspawn.c +++ b/src/nspawn.c @@ -44,9 +44,11 @@ #include "cgroup-util.h" #include "sd-daemon.h" #include "strv.h" +#include "loopback-setup.h" static char *arg_directory = NULL; static char *arg_user = NULL; +static bool arg_no_net = false; static int help(void) { @@ -54,7 +56,8 @@ static int help(void) { "Spawn a minimal namespace container for debugging, testing and building.\n\n" " -h --help Show this help\n" " -D --directory=NAME Root directory for the container\n" - " -u --user=USER Run the command under specified user or uid\n", + " -u --user=USER Run the command under specified user or uid\n" + " --no-net Disable network in container\n", program_invocation_short_name); return 0; @@ -62,11 +65,16 @@ static int help(void) { static int parse_argv(int argc, char *argv[]) { + enum { + ARG_NO_NET = 0x100 + }; + static const struct option options[] = { - { "help", no_argument, NULL, 'h' }, - { "directory", required_argument, NULL, 'D' }, - { "user", optional_argument, NULL, 'u' }, - { NULL, 0, NULL, 0 } + { "help", no_argument, NULL, 'h' }, + { "directory", required_argument, NULL, 'D' }, + { "user", required_argument, NULL, 'u' }, + { "no-net", no_argument, NULL, ARG_NO_NET }, + { NULL, 0, NULL, 0 } }; int c; @@ -100,6 +108,10 @@ static int parse_argv(int argc, char *argv[]) { break; + case ARG_NO_NET: + arg_no_net = true; + break; + case '?': return -EINVAL; @@ -698,7 +710,7 @@ int main(int argc, char *argv[]) { sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1); assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0); - if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) { + if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) { log_error("clone() failed: %m"); goto finish; } @@ -777,6 +789,8 @@ int main(int argc, char *argv[]) { umask(0022); + loopback_setup(); + if (drop_capabilities() < 0) goto child_fail; |