X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Frpm-fake.c;h=6d52e98b6dc23428994ad5051892f4d9bf121f2a;hb=148ab3024621f97b9cf95091657db2448098bc66;hp=e19fe889cb51954c38c22c34c5cd1d830e56a5f5;hpb=497c1688595953b76fcc0e79226e4038753c423f;p=util-vserver.git diff --git a/src/rpm-fake.c b/src/rpm-fake.c index e19fe88..6d52e98 100644 --- a/src/rpm-fake.c +++ b/src/rpm-fake.c @@ -96,6 +96,8 @@ static unsigned int debug_level = 0; static bool is_initialized = false; +static bool ctx_created = false; + //DECLARE(rpm_execcon); //DECLARE(execv); DECLARE(getpwnam); @@ -255,6 +257,7 @@ setupContext(xid_t xid, char const **xid_str) char buf[sizeof(xid_t)*3 + 128]; size_t l; struct vc_ctx_caps caps; + struct vc_ctx_flags flags; strcpy(buf, "rpm-fake.so #"); l = utilvserver_fmt_uint(buf+sizeof("rpm-fake.so #")-1, getppid()); @@ -265,11 +268,16 @@ setupContext(xid_t xid, char const **xid_str) caps.bcaps = ~vc_get_insecurebcaps(); caps.bmask = ~0ull; Evc_set_ccaps(rc, &caps); + + flags.flagword = 0; + flags.mask = VC_VXF_SC_HELPER; + Evc_set_cflags(rc, &flags); // context will be activated later... xid = rc; res = true; + ctx_created = true; } } @@ -411,22 +419,30 @@ initPwSocket() static void reduceCapabilities() { + int retried = 0; struct __user_cap_header_struct header; - struct __user_cap_data_struct user; + struct __user_cap_data_struct user[2]; - header.version = _LINUX_CAPABILITY_VERSION; + header.version = _LINUX_CAPABILITY_VERSION_3; header.pid = 0; - if (capget(&header, &user)==-1) { +retry: + if (capget(&header, user)==-1) { + if (!retried && + header.version != _LINUX_CAPABILITY_VERSION_3) { + header.version = _LINUX_CAPABILITY_VERSION_1; + retried = 1; + goto retry; + } perror("capget()"); exit(wrapper_exit_code); } - user.effective &= ~(1<