drop capabilities in lxc-init (V2)

[mirror_lxc.git] / src / lxc / lxc_init.c

diff --git a/src/lxc/lxc_init.c b/src/lxc/lxc_init.c
index a34818e5f13ecbe4952f39fe70ff3a30f3cceb12..270bf35c451364da733eb3e18ac0e7336de2bfd0 100644 (file)
--- a/src/lxc/lxc_init.c
+++ b/src/lxc/lxc_init.c
@@ -30,6 +30,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <sys/capability.h>
 #define _GNU_SOURCE
 #include <getopt.h>
 
@@ -48,6 +49,25 @@ static struct option options[] = {
 
 static int was_interrupted = 0;
 
+static int cap_reset(void)
+{
+       cap_t cap = cap_init();
+       int ret = 0;
+
+       if (!cap) {
+               ERROR("cap_init() failed : %m");
+               return -1;
+       }
+
+       if (cap_set_proc(cap)) {
+               ERROR("cap_set_proc() failed : %m");
+               ret = -1;
+       }
+
+       cap_free(cap);
+       return ret;
+}
+
 int main(int argc, char *argv[])
 {
 
@@ -98,6 +118,12 @@ int main(int argc, char *argv[])
                sigaction(i, &act, NULL);
        }
 
+       if (lxc_setup_fs())
+               exit(err);
+
+       if (cap_reset())
+               exit(err);
+
        pid = fork();
        
        if (pid < 0)
@@ -109,13 +135,10 @@ int main(int argc, char *argv[])
                        signal(i, SIG_DFL);
                sigprocmask(SIG_SETMASK, &omask, NULL);
 
-               if (lxc_setup_fs())
-                       exit(err);
-
                NOTICE("about to exec '%s'", aargv[0]);
 
                execvp(aargv[0], aargv);
-               ERROR("failed to exec: '%s' : %s", aargv[0], strerror(errno));
+               ERROR("failed to exec: '%s' : %m", aargv[0]);
                exit(err);
        }