better check for lock dir

Consider the case where we're running in a user namespace but in the host's
mount ns with the host's filesystem (something like
lxc-usernsexec ... lxc-execute ...), in this case, we'll be euid 0, but we
can't actually write to /run. Let's improve this locking check to make sure
we can actually write to /run before we decide to actually use it as our
locking dir.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index 0b88416301972e6e3739c6a43d569313e171c540..c7812fdac97a7e09bcc2bd2f0e38c51b6bc2a61b 100644 (file)
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -245,8 +245,13 @@ char *get_rundir()
 {
        char *rundir;
        const char *homedir;
+       struct stat sb;
+
+       if (stat(RUNTIME_PATH, &sb) < 0) {
+               return NULL;
+       }
 
-       if (geteuid() == 0) {
+       if (geteuid() == sb.st_uid || getegid() == sb.st_gid) {
                rundir = strdup(RUNTIME_PATH);
                return rundir;
        }