From 7315edd36a144e746dbcc43cef2206441969ca34 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 22 Jan 2015 18:19:58 +0100 Subject: import: lock tar into its own private network namespace That way it cannot get access to the network --- src/import/import-common.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/import/import-common.c b/src/import/import-common.c index b490c435d2..f4643133e9 100644 --- a/src/import/import-common.c +++ b/src/import/import-common.c @@ -507,11 +507,12 @@ int import_fork_tar(const char *path, pid_t *ret) { fd_cloexec(STDOUT_FILENO, false); fd_cloexec(STDERR_FILENO, false); + if (unshare(CLONE_NEWNET) < 0) + log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m"); + r = capability_bounding_set_drop(~retain, true); - if (r < 0) { - log_error_errno(errno, "Failed to drop capabilities, ignoring: %m"); - _exit(EXIT_FAILURE); - } + if (r < 0) + log_error_errno(r, "Failed to drop capabilities, ignoring: %m"); execlp("tar", "tar", "--numeric-owner", "-C", path, "-px", NULL); log_error_errno(errno, "Failed to execute tar: %m"); -- cgit v1.2.3-54-g00ecf