to have better error reporting done by caller.
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
Signed-off-by: Michel Normand <normand@fr.ibm.com>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#define __USE_GNU
#include <sys/socket.h>
#undef __USE_GNU
#include <sys/un.h>
#define __USE_GNU
#include <sys/socket.h>
#undef __USE_GNU
#include <sys/un.h>
+#include "log.h"
+
+lxc_log_define(lxc_af_unix, lxc);
int lxc_af_unix_open(const char *path, int type, int flags)
{
int lxc_af_unix_open(const char *path, int type, int flags)
{
cmsg = CMSG_FIRSTHDR(&msg);
cmsg = CMSG_FIRSTHDR(&msg);
if (cmsg && cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)) &&
cmsg->cmsg_level == SOL_SOCKET &&
cmsg->cmsg_type == SCM_CREDENTIALS) {
cred = *((struct ucred *) CMSG_DATA(cmsg));
if (cmsg && cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)) &&
cmsg->cmsg_level == SOL_SOCKET &&
cmsg->cmsg_type == SCM_CREDENTIALS) {
cred = *((struct ucred *) CMSG_DATA(cmsg));
- if (cred.uid == getuid() && cred.gid == getgid())
- ret = 0;
+ if (cred.uid != getuid() || cred.gid != getgid()) {
+ INFO("message denied for '%d/%d'", cred.uid, cred.gid);
+ return -EPERM;
+ }
- if (lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum)))
+ ret = lxc_af_unix_rcv_credential(conn, &ttynum, sizeof(ttynum));
+ if (ret < 0) {
+ SYSERROR("failed to receive data on tty socket");
+ }
+
+ if (!ret) {
+ DEBUG("peer has disconnected");
+ goto out_close;
+ }
+
+ if (ret != sizeof(ttynum)) {
+ WARN("partial request, ignored");
+ goto out_close;
+ }
if (ttynum > 0) {
if (ttynum > tty_info->nbtty)
if (ttynum > 0) {
if (ttynum > tty_info->nbtty)