From ff01d048b4c1455241c894cf7982662c9d28fd34 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 2 Aug 2011 05:24:58 +0200
Subject: exec: introduce PrivateNetwork= process option to turn off network
 access to specific services

---
 src/nspawn.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

(limited to 'src/nspawn.c')

diff --git a/src/nspawn.c b/src/nspawn.c
index c97649d386..2c1144a7f5 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -48,7 +48,7 @@
 
 static char *arg_directory = NULL;
 static char *arg_user = NULL;
-static bool arg_no_net = false;
+static bool arg_private_network = false;
 
 static int help(void) {
 
@@ -57,7 +57,7 @@ static int help(void) {
                "  -h --help            Show this help\n"
                "  -D --directory=NAME  Root directory for the container\n"
                "  -u --user=USER       Run the command under specified user or uid\n"
-               "     --no-net          Disable network  in container\n",
+               "     --private-network Disable network in container\n",
                program_invocation_short_name);
 
         return 0;
@@ -66,15 +66,15 @@ static int help(void) {
 static int parse_argv(int argc, char *argv[]) {
 
         enum {
-                ARG_NO_NET = 0x100
+                ARG_PRIVATE_NETWORK = 0x100
         };
 
         static const struct option options[] = {
-                { "help",      no_argument,       NULL, 'h'        },
-                { "directory", required_argument, NULL, 'D'        },
-                { "user",      required_argument, NULL, 'u'        },
-                { "no-net",    no_argument,       NULL, ARG_NO_NET },
-                { NULL,        0,                 NULL, 0          }
+                { "help",            no_argument,       NULL, 'h'                 },
+                { "directory",       required_argument, NULL, 'D'                 },
+                { "user",            required_argument, NULL, 'u'                 },
+                { "private-network", no_argument,       NULL, ARG_PRIVATE_NETWORK },
+                { NULL,              0,                 NULL, 0                   }
         };
 
         int c;
@@ -108,8 +108,8 @@ static int parse_argv(int argc, char *argv[]) {
 
                         break;
 
-                case ARG_NO_NET:
-                        arg_no_net = true;
+                case ARG_PRIVATE_NETWORK:
+                        arg_private_network = true;
                         break;
 
                 case '?':
@@ -710,7 +710,7 @@ int main(int argc, char *argv[]) {
         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
 
-        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_no_net ? CLONE_NEWNET : 0), NULL)) < 0) {
+        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;
         }
-- 
cgit v1.2.3-54-g00ecf