int nbctx = 0;
int ctxs[16];
int disconnect = 0;
- int fakeinit = 0;
int silent = 0;
int flags = 0;
unsigned remove_cap = 0;
unsigned add_cap = 0;
- unsigned long secure = ( (1<<VC_CAP_LINUX_IMMUTABLE)
- |(1<<VC_CAP_NET_BROADCAST)
- |(1<<VC_CAP_NET_ADMIN)
- |(1<<VC_CAP_NET_RAW)
- |(1<<VC_CAP_IPC_LOCK)
- |(1<<VC_CAP_IPC_OWNER)
- |(1<<VC_CAP_SYS_MODULE)
- |(1<<VC_CAP_SYS_RAWIO)
- |(1<<VC_CAP_SYS_PACCT)
- |(1<<VC_CAP_SYS_ADMIN)
- |(1<<VC_CAP_SYS_BOOT)
- |(1<<VC_CAP_SYS_NICE)
- |(1<<VC_CAP_SYS_RESOURCE)
- |(1<<VC_CAP_SYS_TIME)
- |(1<<VC_CAP_MKNOD));
+ unsigned long secure = ( ( 1<<VC_CAP_LINUX_IMMUTABLE)
+ |(1<<VC_CAP_NET_BROADCAST)
+ |(1<<VC_CAP_NET_ADMIN)
+ |(1<<VC_CAP_NET_RAW)
+ |(1<<VC_CAP_IPC_LOCK)
+ |(1<<VC_CAP_IPC_OWNER)
+ |(1<<VC_CAP_SYS_MODULE)
+ |(1<<VC_CAP_SYS_RAWIO)
+ |(1<<VC_CAP_SYS_PACCT)
+ |(1<<VC_CAP_SYS_ADMIN)
+ |(1<<VC_CAP_SYS_BOOT)
+ |(1<<VC_CAP_SYS_NICE)
+ |(1<<VC_CAP_SYS_RESOURCE)
+ |(1<<VC_CAP_SYS_TIME)
+ |(1<<VC_CAP_MKNOD)
+ |(1<<VC_CAP_QUOTACTL));
const char *hostname=NULL, *domainname=NULL;
for (i=1; i<argc; i++){
}else if (strcmp(opt,"private")==0){
flags |= 8;
}else if (strcmp(opt,"fakeinit")==0){
- fakeinit = 1;
flags |= 16;
}else if (strcmp(opt,"hideinfo")==0){
flags |= 32;
*/
if (disconnect == 0 || fork()==0){
int newctx;
+ int xflags = flags & 16;
+
if (nbctx == 0) ctxs[nbctx++] = -1;
- newctx = vc_new_s_context(ctxs[0],0,flags);
+ newctx = vc_new_s_context(ctxs[0],0,flags&~16);
if (newctx != -1){
if (hostname != NULL){
if (sethostname (hostname,strlen(hostname))==-1){
}
}
remove_cap &= (~add_cap);
- if (remove_cap != 0) vc_new_s_context (-2,remove_cap,0);
+ if (remove_cap!=0 || xflags!=0)
+ vc_new_s_context (-2,remove_cap,xflags);
if (!silent){
printf ("New security context is %d\n"
,ctxs[0] == -1 ? newctx : ctxs[0]);