X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Fsecure-mount.c;h=ae0650f2fe363e31998494c26d5b423ad177a34f;hb=dffca81b18d54e1ea6db1213b85e1741bd85861f;hp=4cf996f4519b21bf65d4745b55db3912d3fa90bc;hpb=2d5d2b0bb8a115b5e16d1b4977a0099211330812;p=util-vserver.git diff --git a/src/secure-mount.c b/src/secure-mount.c index 4cf996f..ae0650f 100644 --- a/src/secure-mount.c +++ b/src/secure-mount.c @@ -82,6 +82,7 @@ struct Options { bool mount_all; RootFsOption rootfs; + char cur_dir_path[PATH_MAX]; int cur_dir_fd; int cur_rootdir_fd; }; @@ -445,7 +446,7 @@ canHandleInternal(struct MountInfo const *mnt) } static bool -mountSingle(struct MountInfo const *mnt, struct Options const *opt) +mountSingle(struct MountInfo const *mnt, struct Options *opt) { assert(mnt->dst!=0); @@ -459,8 +460,19 @@ mountSingle(struct MountInfo const *mnt, struct Options const *opt) perror("secure-mount: mount()"); return false; } - if ((mnt->flag & MS_BIND) && - (mnt->flag & ~(MS_BIND|MS_REC))) { + if (strcmp(mnt->dst, "/") == 0) { + /* XXX: Hack */ + if (chdir(opt->cur_dir_path) == -1) { + perror("secure-mount: chdir(.)"); + return false; + } + close(opt->cur_dir_fd); + opt->cur_dir_fd = Eopen(".", O_RDONLY|O_DIRECTORY, 0); + Efcntl(opt->cur_dir_fd, F_SETFD, FD_CLOEXEC); + } + if (!vc_isSupported(vcFEATURE_BME) && + (mnt->flag & MS_BIND) && + (mnt->mask & ~(MS_BIND|MS_REC))) { /* This is needed to put us in the new mountpoint */ if (!secureChdir(mnt->dst, opt)) return false; @@ -607,7 +619,7 @@ adjustFileMount(struct MountInfo *mnt) } static bool -mountFstab(struct Options const *opt) +mountFstab(struct Options *opt) { bool res = false; int fd; @@ -687,6 +699,11 @@ initFDs(struct Options *opt) Efcntl(opt->cur_dir_fd, F_SETFD, FD_CLOEXEC); Efcntl(opt->cur_rootdir_fd, F_SETFD, FD_CLOEXEC); + + if (getcwd(opt->cur_dir_path, sizeof(opt->cur_dir_path)) == NULL) { + perror("secure-mount: getcwd()"); + exit(wrapper_exit_code); + } } static RootFsOption