declare -a OPTS_VCONTEXT_MIGRATE=()
declare -a OPTS_VCONTEXT_ENTER=()
OPT_VCONTEXT_CHROOT=--chroot
+OPT_VCONTEXT_CLOSE_FD=""
declare -a OPTS_VATTRIBUTE=( --flag fakeinit )
declare -a OPTS_VSCHED=()
declare -a OPTS_ENV=()
OPTS_VCONTEXT_CREATE=( $SILENT_OPT \
${ctx:+--xid "$ctx"} )
+ findFile file "$vdir"/keepfds "$__CONFDIR/.defaults/keepfds" ""
+ test -n "$file" || OPT_VCONTEXT_CLOSE_FD=( "--closefd" )
## put '--secure' at front so that it can be overridden
OPTS_VATTRIBUTE=( --secure --flag default "${OPTS_VATTRIBUTE[@]}" )
}
$_VATTRIBUTE --set "${OPTS_VATTRIBUTE[@]}" -- \
$_SAVE_CTXINFO "$VSERVER_DIR" \
$_ENV -i "${OPTS_ENV[@]}" \
- $_VCONTEXT --migrate-self --endsetup $OPT_VCONTEXT_CHROOT $SILENT_OPT \
+ $_VCONTEXT --migrate-self --endsetup $OPT_VCONTEXT_CHROOT $OPT_VCONTEXT_CLOSE_FD $SILENT_OPT \
"${OPTS_VCONTEXT_MIGRATE[@]}" "${OPTS_VCONTEXT_ENTER[@]}" -- \
"${INITCMD_START[@]}"
else
${USE_VNAMESPACE:+$_VNAMESPACE --enter "$S_CONTEXT" -- } \
$_VSPACE --enter "$S_CONTEXT" "${OPTS_VSPACE[@]}" "${OPTS_VSPACE_SHARED[@]}" -- \
$_VTAG --migrate "${OPTS_VTAG_ENTER[@]}" --silent -- \
- $_VCONTEXT $SILENT_OPT --migrate $OPT_VCONTEXT_CHROOT \
+ $_VCONTEXT $SILENT_OPT --migrate $OPT_VCONTEXT_CHROOT $OPT_VCONTEXT_CLOSE_FD \
--xid "$S_CONTEXT" --uid "$user" "${OPTS_VCONTEXT_ENTER[@]}" -- \
"$@"
else
#define CMD_PERSFLAG 0x400f
#define CMD_VLOGIN 0x4010
#define CMD_PIVOT_ROOT 0x4011
+#define CMD_CLOSE_FD 0x4012
#ifndef MNT_DETACH
{ "personality-flags", required_argument, 0, CMD_PERSFLAG },
{ "vlogin", no_argument, 0, CMD_VLOGIN },
{ "pivot-root", no_argument, 0, CMD_PIVOT_ROOT },
+ { "closefd", no_argument, 0, CMD_CLOSE_FD },
#if 1
{ "fakeinit", no_argument, 0, CMD_INITPID }, // compatibility
#endif
int verbosity;
bool do_chroot;
bool do_pivot_root;
+ bool do_close_fd;
char const * uid;
xid_t xid;
char const * sync_sock;
" ... use <message> as synchronization message; by\n"
" default, 'ok' will be used\n"
" --vlogin ... enable terminal proxy\n"
+ " --closefd ... close all open file descriptors >2\n"
"\n"
"'vcontext --create' exits with code 254 iff the context exists already.\n"
"\n"
doSyncStage0(p, args->do_disconnect);
+ if (args->do_close_fd) {
+ int fd;
+ for (fd = 3; fd < sysconf(_SC_OPEN_MAX); fd++) {
+ if (fd == ext_sync_fd)
+ continue;
+ close(fd);
+ }
+ }
+
if (args->do_create) {
xid = vc_ctx_create(args->xid, NULL);
if (xid==VC_NOCTX) {
.do_disconnect = false,
.do_endsetup = false,
.do_vlogin = false,
+ .do_close_fd = false,
.is_initpid = false,
.is_silentexist = false,
.set_namespace = false,
case CMD_PIVOT_ROOT : args.do_pivot_root = true; break;
case CMD_NAMESPACE : args.set_namespace = true; break;
case CMD_SILENTEXIST : args.is_silentexist = true; break;
+ case CMD_CLOSE_FD : args.do_close_fd = true; break;
case CMD_SYNCSOCK : args.sync_sock = optarg; break;
case CMD_SYNCMSG : args.sync_msg = optarg; break;
case CMD_UID : args.uid = optarg; break;