+.*-up-to-date
+.deps
COPYING
ChangeLog
INSTALL
Makefile
+aclocal.m4
+autom4te.cache
+autoscan.log
compile
config.h
config.h.in
config.log
config.status
+configure.scan
depcomp
install-sh
missing
sysv_SCRIPTS = $(sysv_SCRPTS)
sysconf_DATA = $(sysv_CFG)
-BUILT_SOURCES = linuxcaps.h pathconfig.h
+BUILT_SOURCES = linuxcaps.h pathconfig.h linuxvirtual.h
man_MANS = $(man_DATMAN)
AM_CPPFLAGS = -I $(top_srcdir)/lib -D _GNU_SOURCE
AM_CFLAGS = -Wall -pedantic
-CLEANFILES = $(sysv_GENSCRPTS) $(scripts_GENSCRPTS) \
+CLEANFILES = $(sysv_GENSCRPTS) $(scripts_GENSCRPTS) $(BUILT_SOURCES) \
.*.pathsubst.stamp */.*.pathsubst.stamp \
linuxcaps.h pathconfig.h
linuxcaps.h:
ln -sf ${kernelincludedir}/linux/capability.h linuxcaps.h
+linuxvirtual.h:
+ ln -sf '$(kernelincludedir)/linux/virtual.h' '$@' && test -e '$@' || \
+ ln -sf '$(top_srcdir)/lib/virtual.h' '$@'
+
pathconfig.h: .pathconfig.h.pathsubst.stamp
.%.pathsubst.stamp: %.pathsubst Makefile
@mkdir -p $$(dirname '$@')
install-data-local:
$(INSTALL) -d -m755 $(DESTDIR)$(localstatedir)/run/vservers
+
include $(top_srcdir)/lib/Makefile-files
include $(top_srcdir)/src/Makefile-files
include $(top_srcdir)/doc/Makefile-files
+version 0.23.6
+==============
+
+ - fixed '--level' option on 'vserver ... chkconfig'
dnl
AC_PREREQ(2.57)
-AC_INIT(util-vserver, 0.23.89.1, enrico.scholz@informatik.tu-chemnitz.de)
+AC_INIT(util-vserver, 0.23.190.1, enrico.scholz@informatik.tu-chemnitz.de)
AC_CONFIG_SRCDIR([src/capchroot.c])
AC_CONFIG_HEADER([config.h])
AC_SUBST(kernelincludedir)
AC_MSG_RESULT($kernelincludedir/linux)
+AC_MSG_CHECKING([for supported APIs])
+AC_ARG_ENABLE([apis],
+ [AC_HELP_STRING([--enable-apis=APIS],
+ [enable support for the given apis; possible values are: legacy,compat,ALL (default: ALL)])],
+ [],
+ [supported_apis=ALL])
+
+test x"$supported_apis" != xALL || supported_apis='legacy,compat'
+old_IFS=$IFS
+IFS=,;
+for i in $supported_apis; do
+ case "$i" in
+ compat) AC_DEFINE(VC_ENABLE_API_COMPAT, 1, [Enable support for compatibily syscall API]);;
+ legacy) AC_DEFINE(VC_ENABLE_API_LEGACY, 1, [Enable support for old, /proc parsing API]);;
+ *) AC_MSG_ERROR(['$i' is not a supported API]);;
+ esac
+done
+IFS=$old_IFS
+AC_MSG_RESULT([$supported_apis])
+
+AC_CHECK_FUNCS([sys_virtual_context])
AC_CHECK_DECLS(MS_MOVE,,,[#include <linux/fs.h>])
AC_CHECK_TYPES(ctx_t,,,[#include <sys/types.h>])
PKGCONFIG_FILES = lib/util-vserver
lib_SRCS = lib/syscall.c \
+ lib/checkversion.c \
lib/getctx.c \
- lib/int2str.c
+ lib/getversion.c \
+ lib/uint2str.c
lib_HDRS = lib/vserver.h
-lib_XHDRS = lib/internal.h
+lib_XHDRS = lib/syscall-compat.hc \
+ lib/syscall-legacy.hc \
+ lib/getctx-compat.hc \
+ lib/getctx-legacy.hc \
+ lib/getversion-internal.hc \
+ lib/safechroot-internal.hc \
+ lib/virtual.h \
+ lib/vserver-internal.h
lib_lib_LIBS = lib/libvserver.a
lib_libvserver_a_SOURCES = $(lib_SRCS)
-lib_libvserver_a_CPPFLAGS = -I$(kernelincludedir) -D_REENTRANT
+lib_libvserver_a_CPPFLAGS = -I$(kernelincludedir) -D_REENTRANT -D_GNU_SOURCE
# _REENTRANT is needed for dietlibc to use __error_location
if USE_DIETLIBC
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "vserver.h"
+#include "getversion-internal.hc"
+
+int
+utilvserver_checkCompatVersion()
+{
+ static int res=0;
+ static int v_errno;
+
+ if (res==0) {
+ res = vc_get_version_internal(VC_CAT_COMPAT);
+ v_errno = errno;
+#ifdef VC_ENABLE_API_LEGACY
+ if (res==-1 && errno==ENOSYS) res=0;
+#endif
+ }
+
+ errno = v_errno;
+ return res;
+}
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifndef H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H
+#define H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H
+
+#include "getctx-legacy.hc"
+
+static inline ALWAYSINLINE ctx_t
+vc_X_getctx_compat(pid_t pid)
+{
+ return vc_X_getctx_legacy(pid);
+}
+
+#endif // H_UTIL_VSERVER_LIB_GETCTX_COMPAT_H
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifndef H_UTIL_VSERVER_LIB_GETCTX_LEGACY_H
+#define H_UTIL_VSERVER_LIB_GETCTX_LEGACY_H
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "vserver.h"
+#include "vserver-internal.h"
+#include <string.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#define CTX_TAG "\ns_context: "
+
+static ctx_t
+vc_X_getctx_legacy(pid_t pid)
+{
+ static volatile size_t bufsize=4097;
+ // TODO: is this really race-free?
+ size_t cur_bufsize = bufsize;
+ int fd;
+ char status_name[ sizeof("/proc/01234/status") ];
+ char buf[cur_bufsize];
+ size_t len;
+ char *pos = 0;
+
+ strcpy(status_name, "/proc/");
+ len = utilvserver_uint2str(status_name+sizeof("/proc/")-1,
+ sizeof(status_name)-sizeof("/proc//status")+1,
+ pid, 10);
+ strcpy(status_name+sizeof("/proc/")+len-1, "/status");
+
+ fd = open(status_name, O_RDONLY);
+ if (fd==-1) return VC_NOCTX;
+
+ len = read(fd, buf, cur_bufsize);
+ close(fd);
+
+ if (len<cur_bufsize) {
+ buf[len] = '\0';
+ pos = strstr(buf, CTX_TAG);
+ }
+ else if (len!=(size_t)-1) {
+ bufsize = cur_bufsize * 2 - 1;
+ errno = EAGAIN;
+ }
+
+ if (pos!=0) return atoi(pos+sizeof(CTX_TAG)-1);
+ else return VC_NOCTX;
+}
+
+#endif // H_UTIL_VSERVER_LIB_GETCTX_LEGACY_H
#ifdef HAVE_CONFIG_H
# include <config.h>
#endif
-
#include "compat.h"
#include "vserver.h"
-#include "internal.h"
-#include <string.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <errno.h>
-
-#define CTX_TAG "\ns_context: "
-
-ctx_t
-getctx(pid_t pid)
-{
- static volatile size_t bufsize=4097;
- // TODO: is this really race-free?
- size_t cur_bufsize = bufsize;
- int fd;
- char status_name[ sizeof("/proc/01234/status") ];
- char buf[cur_bufsize];
- size_t len;
- char *pos = 0;
-
- strcpy(status_name, "/proc/");
- len = utilvserver_uint2str(status_name+sizeof("/proc/")-1,
- sizeof(status_name)-sizeof("/proc//status")+1,
- pid, 10);
- strcpy(status_name+sizeof("/proc/")+len-1, "/status");
+#include "vserver-internal.h"
- fd = open(status_name, O_RDONLY);
- if (fd==-1) return CTX_NOCTX;
+#ifdef VC_ENABLE_API_COMPAT
+# include "getctx-compat.hc"
+#endif
- len = read(fd, buf, cur_bufsize);
- close(fd);
+#ifdef VC_ENABLE_API_LEGACY
+# include "getctx-legacy.hc"
+#endif
- if (len<cur_bufsize)
- pos = strstr(buf, CTX_TAG);
- else if (len!=(size_t)-1) {
- bufsize = cur_bufsize * 2 - 1;
- errno = EAGAIN;
- }
+#include <sys/types.h>
- if (pos!=0) return atoi(pos+sizeof(CTX_TAG)-1);
- else return CTX_NOCTX;
-}
-
-#if 0
ctx_t
-getcctx()
+vc_X_getctx(pid_t pid)
{
- return getctx(getpid());
+ CALL_VC(CALL_VC_COMPAT(vc_X_getctx, pid),
+ CALL_VC_LEGACY(vc_X_getctx, pid));
}
-#endif
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifndef H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H
+#define H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "vserver-internal.h"
+#include "linuxvirtual.h"
+
+static inline ALWAYSINLINE int
+vc_get_version_internal(int cat)
+{
+ return sys_virtual_context(VC_CMD(VERSION, 0, 0), cat, 0);
+}
+
+#endif // H_UTIL_VSERVER_LIB_GETVERSION_INTERNAL_H
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "getversion-internal.hc"
+
+int
+vc_get_version(int cat)
+{
+ return vc_get_version(cat);
+}
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifndef H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H
+#define H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef NDEBUG
+static void
+vc_tell_unsafe_chroot()
+{
+ static int flag = -1;
+ if (flag==-1) {
+ char const * const e = getenv("VC_TELL_UNSAFE_CHROOT");
+ flag = e ? atoi(e) : 0;
+ flag = flag ? 1 : 0;
+ }
+
+ if (flag) write(2, "Unsafe chroot() used\n", 23);
+}
+#else
+static ALWAYSINLINE UNUSED void vc_tell_unsafe_chroot() {}
+#endif
+
+
+#endif // H_UTIL_VSERVER_LIB_SAFECHROOT_INTERNAL_H
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "safechroot-internal.hc"
+
+#include "vserver.h"
+#include "vserver-internal.h"
+
+#include <unistd.h>
+
+static inline ALWAYSINLINE int
+vc_new_s_context_compat(ctx_t ctx, unsigned int remove_cap, unsigned int flags)
+{
+ struct vcmd_new_s_context_v1 msg;
+ msg.remove_cap = remove_cap;
+ msg.flags = flags;
+
+ return sys_virtual_context(VC_CMD(COMPAT, 1, 1), ctx, &msg);
+}
+
+static inline ALWAYSINLINE int
+vc_set_ipv4root_compat(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips)
+{
+ struct vcmd_set_ipv4root_v3 msg;
+ size_t i;
+
+ if (nb>=NB_IPV4ROOT) {
+ errno = -EINVAL;
+ return -1;
+ }
+
+ msg.broadcast = bcast;
+
+ for (i=0; i<nb; ++i) {
+ msg.ip_mask_pair[i].ip = ips[i].ip;
+ msg.ip_mask_pair[i].mask = ips[i].mask;
+ }
+
+ return sys_virtual_context(VC_CMD(COMPAT, 2, 3), nb, &msg);
+}
+
+static inline ALWAYSINLINE int
+vc_chrootsafe_compat(char const *dir)
+{
+ vc_tell_unsafe_chroot();
+ return chroot(dir);
+}
--- /dev/null
+// $Id$ --*- c -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+// based on syscall.cc by Jacques Gelinas
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2, or (at your option)
+// any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+/*
+ This tells the system call number for new_s_context and set_ipv4root
+ using /proc/self/status. This helps until the vserver project is
+ included officially in the kernel (and has its own syscall).
+
+ We rely on /proc/self/status to find the syscall number.
+
+ If it is not there, we rely on adm/unistd.h.
+
+ If this file does not have those system calls (not a patched kernel source)
+ we rely on static values in this file.
+*/
+#include "safechroot-internal.hc"
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <syscall.h>
+#include <asm/unistd.h>
+
+// Here is the trick. We keep a copy of the define, then undef it
+// and then later, we try to locate the value reading /proc/self/status
+// If this fails, we have the old preserved copy.
+static int def_NR_set_ipv4root = 274;
+#undef __NR_set_ipv4root
+
+static int __NR_set_ipv4root_rev0;
+static int __NR_set_ipv4root_rev1;
+static int __NR_set_ipv4root_rev2;
+static int __NR_set_ipv4root_rev3;
+static int rev_ipv4root=0;
+
+
+static _syscall1(int, set_ipv4root_rev0, unsigned long, ip)
+static _syscall2(int, set_ipv4root_rev1, unsigned long, ip, unsigned long, bcast)
+static _syscall3(int, set_ipv4root_rev2, unsigned long *, ip, int, nb, unsigned long, bcast)
+static _syscall4(int, set_ipv4root_rev3, unsigned long *, ip, int, nb, unsigned long, bcast, unsigned long *, mask)
+
+static int def_NR_new_s_context = 273;
+#undef __NR_new_s_context
+static int __NR_new_s_context_rev0;
+ //static int __NR_new_s_context_rev1;
+static int rev_s_context=0;
+
+static _syscall3(int, new_s_context_rev0, int, newctx, int, remove_cap, int, flags)
+ //static _syscall4(int, new_s_context_rev1, int, nbctx, int *, ctxs, int, remove_cap, int, flags)
+
+#if 0
+#undef __NR_set_ctxlimit
+static int __NR_set_ctxlimit=-1;
+static int rev_set_ctxlimit=-1;
+
+static _syscall2 (int, set_ctxlimit, int, resource, long, limit)
+#endif
+
+#undef __NR_chrootsafe
+static int __NR_chrootsafe=-1;
+static int rev_chrootsafe=-1;
+
+static _syscall1 (int, chrootsafe, const char *, dir)
+
+static void init()
+{
+ static int is_init = 0;
+ if (!is_init){
+ FILE *fin = fopen ("/proc/self/status","r");
+ __NR_set_ipv4root_rev0 = def_NR_set_ipv4root;
+ __NR_set_ipv4root_rev1 = def_NR_set_ipv4root;
+ __NR_set_ipv4root_rev2 = def_NR_set_ipv4root;
+ __NR_set_ipv4root_rev3 = def_NR_set_ipv4root;
+ __NR_new_s_context_rev0 = def_NR_new_s_context;
+ //__NR_new_s_context_rev1 = def_NR_new_s_context;
+ if (fin != NULL){
+ char line[100];
+ while (fgets(line,sizeof(line)-1,fin)!=NULL){
+ int num;
+ char title[100],rev[100];
+ rev[0] = '\0';
+ if (sscanf(line,"%s %d %s",title,&num,rev)>=2){
+ if (strcmp(title,"__NR_set_ipv4root:")==0){
+ __NR_set_ipv4root_rev0 = num;
+ __NR_set_ipv4root_rev1 = num;
+ __NR_set_ipv4root_rev2 = num;
+ __NR_set_ipv4root_rev3 = num;
+ if (strncmp(rev,"rev",3)==0){
+ rev_ipv4root = atoi(rev+3);
+ }
+#if 0
+ }else if (strcmp(title,"__NR_set_ctxlimit:")==0){
+ __NR_set_ctxlimit = num;
+ if (strncmp(rev,"rev",3)==0){
+ rev_set_ctxlimit = atoi(rev+3);
+ }
+#endif
+ }else if (strcmp(title,"__NR_chrootsafe:")==0){
+ __NR_chrootsafe = num;
+ if (strncmp(rev,"rev",3)==0){
+ rev_chrootsafe = atoi(rev+3);
+ }
+ }else if (strcmp(title,"__NR_new_s_context:")==0){
+ __NR_new_s_context_rev0 = num;
+ //__NR_new_s_context_rev1 = num;
+ if (strncmp(rev,"rev",3)==0){
+ rev_s_context = atoi(rev+3);
+ }
+ }
+ }
+ }
+ fclose (fin);
+ }
+ is_init = 1;
+ }
+}
+
+void vc_init_legacy()
+{
+ init();
+}
+
+static ALWAYSINLINE int
+vc_new_s_context_legacy(int ctx, int remove_cap, int flags)
+{
+ int ret = -1;
+ init();
+ if (rev_s_context == 0){
+ return new_s_context_rev0(ctx, remove_cap, flags);
+ }else{
+ errno = -ENOSYS;
+ ret = -1;
+ }
+ return ret;
+}
+
+static ALWAYSINLINE int
+vc_set_ipv4root_legacy_internal (
+ unsigned long ip[],
+ int nb,
+ unsigned long bcast,
+ unsigned long mask[])
+{
+ init();
+ if (rev_ipv4root == 0){
+ if (nb > 1){
+ fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n");
+ }
+ return set_ipv4root_rev0 (ip[0]);
+ }else if (rev_ipv4root == 1){
+ if (nb > 1){
+ fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n");
+ }
+ return set_ipv4root_rev1 (ip[0],bcast);
+ }else if (rev_ipv4root == 2){
+ return set_ipv4root_rev2 (ip,nb,bcast);
+ }else if (rev_ipv4root == 3){
+ return set_ipv4root_rev3 (ip,nb,bcast,mask);
+ }
+ errno = EINVAL;
+ return -1;
+}
+
+static ALWAYSINLINE int
+vc_set_ipv4root_legacy(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips)
+{
+ unsigned long ip[nb];
+ unsigned long mask[nb];
+ size_t i;
+
+ for (i=0; i<nb; ++i) {
+ ip[i] = ips[i].ip;
+ mask[i] = ips[i].mask;
+ }
+
+ return vc_set_ipv4root_legacy_internal(ip, nb, bcast, mask);
+}
+
+static ALWAYSINLINE int
+vc_chrootsafe_legacy (const char *dir)
+{
+ init();
+ if (rev_chrootsafe == -1){
+ vc_tell_unsafe_chroot();
+ return chroot(dir);
+ }else if (rev_chrootsafe == 0){
+ return chrootsafe (dir);
+ }else{
+ fprintf (stderr,"chrootsafe: kernel support version %d, application expects version 0\n"
+ ,rev_chrootsafe);
+ }
+ errno = EINVAL;
+ return -1;
+}
+
+#if 0
+/*
+ Return != 0 if chrootsafe is available
+*/
+int has_chrootsafe()
+{
+ init();
+ return rev_chrootsafe != -1;
+}
+
+int call_set_ctxlimit (int res, long limit)
+{
+ init();
+ if (rev_set_ctxlimit == -1){
+ fprintf (stderr,"set_ctxlimit: Unsupported system call, update kernel\n");
+ }else if (rev_set_ctxlimit == 0){
+ return set_ctxlimit (res,limit);
+ }else{
+ fprintf (stderr,"set_ctxlimit: kernel support version %d, application expects version 0\n"
+ ,rev_set_ctxlimit);
+ }
+ errno = EINVAL;
+ return -1;
+}
+
+
+#endif
-// $Id$
+// $Id$ --*- c++ -*--
// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
-// based on syscall.cc by Jacques Gelinas
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation; either version 2, or (at your option)
-// any later version.
+// the Free Software Foundation; version 2 of the License.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-/*
- This tells the system call number for new_s_context and set_ipv4root
- using /proc/self/status. This helps until the vserver project is
- included officially in the kernel (and has its own syscall).
- We rely on /proc/self/status to find the syscall number.
-
- If it is not there, we rely on adm/unistd.h.
-
- If this file does not have those system calls (not a patched kernel source)
- we rely on static values in this file.
-*/
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <syscall.h>
-#include <asm/unistd.h>
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
#include "compat.h"
#include "vserver.h"
+#include "vserver-internal.h"
+#include "linuxvirtual.h"
-// Here is the trick. We keep a copy of the define, then undef it
-// and then later, we try to locate the value reading /proc/self/status
-// If this fails, we have the old preserved copy.
-static int def_NR_set_ipv4root = 227;
-#undef __NR_set_ipv4root
-
-static int __NR_set_ipv4root_rev0;
-static int __NR_set_ipv4root_rev1;
-static int __NR_set_ipv4root_rev2;
-static int __NR_set_ipv4root_rev3;
-static int rev_ipv4root=0;
-
-
-static _syscall1(int, set_ipv4root_rev0, unsigned long, ip)
-static _syscall2(int, set_ipv4root_rev1, unsigned long, ip, unsigned long, bcast)
-static _syscall3(int, set_ipv4root_rev2, unsigned long *, ip, int, nb, unsigned long, bcast)
-static _syscall4(int, set_ipv4root_rev3, unsigned long *, ip, int, nb, unsigned long, bcast, unsigned long *, mask)
-
-static int def_NR_new_s_context = 226;
-#undef __NR_new_s_context
-static int __NR_new_s_context_rev0;
-static int __NR_new_s_context_rev1;
-static int rev_s_context=0;
-
-static _syscall3(int, new_s_context_rev0, int, newctx, int, remove_cap, int, flags)
-static _syscall4(int, new_s_context_rev1, int, nbctx, int *, ctxs, int, remove_cap, int, flags)
-
-#undef __NR_set_ctxlimit
-static int __NR_set_ctxlimit=-1;
-static int rev_set_ctxlimit=-1;
-
-static _syscall2 (int, set_ctxlimit, int, resource, long, limit)
-
-#undef __NR_chrootsafe
-static int __NR_chrootsafe=-1;
-static int rev_chrootsafe=-1;
+#ifdef VC_ENABLE_API_COMPAT
+# include "syscall-compat.hc"
+#endif
-static _syscall1 (int, chrootsafe, const char *, dir)
+#ifdef VC_ENABLE_API_LEGACY
+# include "syscall-legacy.hc"
+#endif
-static void init()
-{
- static int is_init = 0;
- if (!is_init){
- FILE *fin = fopen ("/proc/self/status","r");
- __NR_set_ipv4root_rev0 = def_NR_set_ipv4root;
- __NR_set_ipv4root_rev1 = def_NR_set_ipv4root;
- __NR_set_ipv4root_rev2 = def_NR_set_ipv4root;
- __NR_set_ipv4root_rev3 = def_NR_set_ipv4root;
- __NR_new_s_context_rev1 = def_NR_new_s_context;
- if (fin != NULL){
- char line[100];
- while (fgets(line,sizeof(line)-1,fin)!=NULL){
- int num;
- char title[100],rev[100];
- rev[0] = '\0';
- if (sscanf(line,"%s %d %s",title,&num,rev)>=2){
- if (strcmp(title,"__NR_set_ipv4root:")==0){
- __NR_set_ipv4root_rev0 = num;
- __NR_set_ipv4root_rev1 = num;
- __NR_set_ipv4root_rev2 = num;
- __NR_set_ipv4root_rev3 = num;
- if (strncmp(rev,"rev",3)==0){
- rev_ipv4root = atoi(rev+3);
- }
- }else if (strcmp(title,"__NR_set_ctxlimit:")==0){
- __NR_set_ctxlimit = num;
- if (strncmp(rev,"rev",3)==0){
- rev_set_ctxlimit = atoi(rev+3);
- }
- }else if (strcmp(title,"__NR_chrootsafe:")==0){
- __NR_chrootsafe = num;
- if (strncmp(rev,"rev",3)==0){
- rev_chrootsafe = atoi(rev+3);
- }
- }else if (strcmp(title,"__NR_new_s_context:")==0){
- __NR_new_s_context_rev0 = num;
- __NR_new_s_context_rev1 = num;
- if (strncmp(rev,"rev",3)==0){
- rev_s_context = atoi(rev+3);
- }
- }
- }
- }
- fclose (fin);
- }
- is_init = 1;
- }
-}
-
-void vserver_init()
-{
- init();
-}
-
-int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags)
-{
- int ret = -1;
- init();
- if (rev_s_context == 0){
- if (nbctx > 1){
- errno = EINVAL;
- fprintf (stderr,"The current kernel does not support new_s_context revision 1\n");
- }else if (nbctx == 0){
- ret = new_s_context_rev0(-2,remove_cap,flags);
- }else if (nbctx == 1){
- ret = new_s_context_rev0(ctxs[0],remove_cap,flags);
- }
- }else{
-fprintf (stderr,"new_s_context rev1 %d %d\n",nbctx,ctxs[0]);
- ret = new_s_context_rev1(nbctx,ctxs,remove_cap,flags);
- }
- return ret;
-}
+#include <stdbool.h>
+#include <errno.h>
-int call_set_ipv4root (
- unsigned long ip[],
- int nb,
- unsigned long bcast,
- unsigned long mask[])
-{
- init();
- if (rev_ipv4root == 0){
- if (nb > 1){
- fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n");
- }
- return set_ipv4root_rev0 (ip[0]);
- }else if (rev_ipv4root == 1){
- if (nb > 1){
- fprintf (stderr,"set_ipv4root: Several IP number specified, but this kernel only supports one. Ignored\n");
- }
- return set_ipv4root_rev1 (ip[0],bcast);
- }else if (rev_ipv4root == 2){
- return set_ipv4root_rev2 (ip,nb,bcast);
- }else if (rev_ipv4root == 3){
- return set_ipv4root_rev3 (ip,nb,bcast,mask);
- }
- errno = EINVAL;
- return -1;
-}
+#if defined(VC_ENABLE_API_COMPAT) || defined(VC_ENABLE_API_LEGACY)
-int call_chrootsafe (const char *dir)
+int
+vc_new_s_context(ctx_t ctx, unsigned int remove_cap, unsigned int flags)
{
- init();
- if (rev_chrootsafe == -1){
- fprintf (stderr,"chrootsafe: Unsupported system call, update kernel\n");
- }else if (rev_chrootsafe == 0){
- return chrootsafe (dir);
- }else{
- fprintf (stderr,"chrootsafe: kernel support version %d, application expects version 0\n"
- ,rev_chrootsafe);
- }
- errno = EINVAL;
- return -1;
+ CALL_VC(CALL_VC_COMPAT(vc_new_s_context, ctx, remove_cap, flags),
+ CALL_VC_LEGACY(vc_new_s_context, ctx, remove_cap, flags));
}
-/*
- Return != 0 if chrootsafe is available
-*/
-int has_chrootsafe()
+int
+vc_set_ipv4root(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips)
{
- init();
- return rev_chrootsafe != -1;
+ CALL_VC(CALL_VC_COMPAT(vc_set_ipv4root, bcast, nb, ips),
+ CALL_VC_LEGACY(vc_set_ipv4root, bcast, nb, ips));
}
-int call_set_ctxlimit (int res, long limit)
+int
+vc_chrootsafe(char const *dir)
{
- init();
- if (rev_set_ctxlimit == -1){
- fprintf (stderr,"set_ctxlimit: Unsupported system call, update kernel\n");
- }else if (rev_set_ctxlimit == 0){
- return set_ctxlimit (res,limit);
- }else{
- fprintf (stderr,"set_ctxlimit: kernel support version %d, application expects version 0\n"
- ,rev_set_ctxlimit);
- }
- errno = EINVAL;
- return -1;
+ CALL_VC(CALL_VC_COMPAT(vc_chrootsafe, dir),
+ CALL_VC_LEGACY(vc_chrootsafe, dir));
}
-
+#endif
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include <assert.h>
+#include <stdbool.h>
+#include <string.h>
+
+size_t
+utilvserver_uint2str(char *buf, size_t len, unsigned int val, unsigned char base)
+{
+ char *ptr = buf+len-1;
+ register size_t res;
+ if (base>=36 || len==0) return 0;
+
+ *ptr = '\0';
+ while (ptr>buf) {
+ unsigned char digit = val%base;
+
+ --ptr;
+ *ptr = (digit<10 ? '0'+digit :
+ digit<36 ? 'a'+digit-10 :
+ (assert(false),'?'));
+
+ val /= base;
+ if (val==0) break;
+ }
+
+ assert(ptr>=buf && ptr<=buf+len-1);
+
+ res = buf+len-ptr;
+ memmove(buf, ptr, res);
+
+ return res-1;
+}
--- /dev/null
+#ifndef _LINUX_VIRTUAL_H
+#define _LINUX_VIRTUAL_H
+
+#include <linux/types.h>
+
+#define VC_CATEGORY(c) (((c) >> 24) & 0x3F)
+#define VC_COMMAND(c) (((c) >> 16) & 0xFF)
+#define VC_VERSION(c) ((c) & 0xFFF)
+
+#define VC_CMD(c,i,v) ((((VC_CAT_ ## c) & 0x3F) << 24) \
+ | (((i) & 0xFF) << 16) | ((v) & 0xFFF))
+
+#define VC_CAT_VERSION 0
+#define VC_CAT_PROCESS 1
+#define VC_CAT_MEMORY 2
+#define VC_CAT_NETWORK 3
+
+#define VC_CAT_LIMITS 8
+#define VC_CAT_QUOTA 9
+
+#define VC_CAT_OTHER 62
+#define VC_CAT_COMPAT 63
+
+/* interface version */
+
+ //#define VC_VERSION 0x00010000
+
+
+
+/* query version */
+
+#define VCMD_get_version VC_CMD(VERSION, 0, 0)
+
+
+/* compatibiliy vserver commands */
+
+#define VCMD_new_s_context VC_CMD(COMPAT, 1, 1)
+#define VCMD_set_ipv4root VC_CMD(COMPAT, 2, 3)
+
+/* compatibiliy vserver arguments */
+
+struct vcmd_new_s_context_v1 {
+ uint32_t remove_cap;
+ uint32_t flags;
+};
+
+#define NB_IPV4ROOT 16
+
+struct vcmd_set_ipv4root_v3 {
+ /* number of pairs in id */
+ uint32_t broadcast;
+ struct {
+ uint32_t ip;
+ uint32_t mask;
+ } ip_mask_pair[NB_IPV4ROOT];
+};
+
+
+#endif /* _LINUX_VIRTUAL_H */
--- /dev/null
+// $Id$ --*- c++ -*--
+
+// Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifndef H_VSERVER_SYSCALL_INTERNAL_H
+#define H_VSERVER_SYSCALL_INTERNAL_H
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <syscall.h>
+#include <unistd.h>
+#include <asm/unistd.h>
+#include <errno.h>
+
+#ifndef __NR_sys_virtual_context
+# define __NR_sys_virtual_context 273
+#endif
+
+#define VC_PREFIX 0)
+#define VC_SUFFIX else (void)((void)0
+#define CALL_VC_NOOP (void)0
+#define CALL_VC_GENERAL(ID, SUFFIX, FUNC, ...) \
+ VC_PREFIX; VC_SELECT(ID) return FUNC ## _ ## SUFFIX(__VA_ARGS__); VC_SUFFIX
+
+#if 1
+# define VC_SELECT(ID) case ID: if(1)
+# define CALL_VC(...) \
+ switch (utilvserver_checkCompatVersion()) { \
+ case -1 : if (1) break; \
+ VC_SUFFIX, __VA_ARGS__ , VC_PREFIX; \
+ default : errno = EINVAL; \
+ } \
+ return -1
+#else
+# define VC_SELECT(ID) if (1)
+# define CALL_VC(...) \
+ if (1) {} VC_SUFFIX, __VA_ARGS__, VC_PREFIX; \
+ errno = ENOSYS; return -1
+#endif
+
+#ifdef VC_ENABLE_API_COMPAT
+# define CALL_VC_COMPAT(F,...) CALL_VC_GENERAL(0x00010000, compat, F, __VA_ARGS__)
+#else
+# define CALL_VC_COMPAT(F,...) CALL_VC_NOOP
+#endif
+
+#ifdef VC_ENABLE_API_LEGACY
+# define CALL_VC_LEGACY(F,...) CALL_VC_GENERAL(0x00000000, legacy, F, __VA_ARGS__)
+#else
+# define CALL_VC_LEGACY(F,...) CALL_VC_NOOP
+#endif
+
+
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef HAVE_SYS_VIRTUAL_CONTEXT
+static UNUSED
+_syscall3(int, sys_virtual_context,
+ uint32_t, cmd, uint32_t, id, void *, data)
+#endif
+
+size_t utilvserver_uint2str(char *buf, size_t len,
+ unsigned int val, unsigned char base);
+int utilvserver_checkCompatVersion();
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif // H_VSERVER_SYSCALL_INTERNAL_H
#ifndef H_VSERVER_SYSCALL_H
#define H_VSERVER_SYSCALL_H
+#include <stdint.h>
+#include <stdlib.h>
#include <sys/types.h>
-#include <unistd.h>
-#define CTX_NOCTX ((ctx_t)(-1))
+#define VC_NOCTX ((ctx_t)(-1))
#ifdef __cplusplus
extern "C" {
#endif
-int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags);
-int call_set_ipv4root (unsigned long ip[], int nb,
- unsigned long bcast, unsigned long mask[]);
-int call_chrootsafe (const char *dir);
-int has_chrootsafe();
-int call_set_ctxlimit (int res, long limit);
+ struct vc_ip_mask_pair {
+ uint32_t ip;
+ uint32_t mask;
+ };
-void vserver_init();
+ /** Returns version of the given API-category */
+ int vc_get_version(int category);
+
+ /** Puts current process into context <ctx>, removes the given caps and
+ * sets flags.
+ * Special values for ctx are
+ * - -2 which means the current context (just for changing caps and flags)
+ * - -1 which means the next free context; this value can be used by
+ * ordinary users also */
+ int vc_new_s_context(ctx_t ctx, unsigned int remove_cap, unsigned int flags);
- ctx_t getctx(pid_t pid);
+ /** Sets the ipv4root information.
+ * \precondition: nb<16 */
+ int vc_set_ipv4root(uint32_t bcast, size_t nb, struct vc_ip_mask_pair const *ips);
+
+ int vc_chrootsafe(char const *dir);
-#define getcctx() (getctx(getpid()))
+ /** Returns the context of the given process. */
+ ctx_t vc_X_getctx(pid_t pid);
+
+ /** Returns the context of the current process. */
+#define vc_X_getcctx (getctx(getpid()))
+
#ifdef __cplusplus
}
#endif
src/chcontext \
src/rebootmgr \
src/reducecap \
- src/setctxlimit \
src/vdu \
src/vfiles \
src/new-namespace \
src_save_ctxinfo_SOURCES = src/save_ctxinfo.c
src_save_ctxinfo_LDADD = lib/libvserver.a
-src_setctxlimit_SOURCES = src/setctxlimit.c
-src_setctxlimit_LDADD = lib/libvserver.a
-
src_showattr_SOURCES = src/showattr.c
src_showperm_SOURCES = src/showperm.c
src_vbuild_SOURCES = src/vbuild.cc src/vutil.cc
#ifdef HAVE_CONFIG_H
# include <config.h>
#endif
+#include "compat.h"
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "linuxcaps.h"
-#include "compat.h"
#include "vserver.h"
-static int my_chroot(const char *dir)
-{
- int ret = -1;
- if (has_chrootsafe()){
- ret = call_chrootsafe(dir);
- }else{
- //fprintf (stderr,"Kernel do not support chrootsafe(), using chroot()\n");
- ret = chroot (dir);
- }
- return ret;
-}
-
int main (int argc, char *argv[])
{
if (argc < 3){
// and also a security flaw. The shared objects in the vserver
// may be tweaked to get control of the root server ...
getpwnam ("root");
- if (my_chroot (argv[dir]) == -1){
+ if (vc_chrootsafe (argv[dir]) == -1){
fprintf (stderr,"Can't chroot to directory %s (%s)\n",argv[dir]
,strerror(errno));
}else{
int cmd = dir + 1;
if (nochroot){
- call_new_s_context (0,NULL,1<<CAP_SYS_CHROOT,0);
+ vc_new_s_context (-2,1<<CAP_SYS_CHROOT,0);
}
if (uid != NULL && strcmp(uid,"root")!=0){
int ret = -1;
int silent = 0;
int i;
- unsigned long addrs[16],masks[16];
+ struct vc_ip_mask_pair ips[16];
int nbaddrs = 0;
unsigned long bcast = 0xffffffff;
for (i=1; i<argc; i++){
usage();
}else{
memcpy (&addr,h->h_addr,sizeof(addr));
- masks[nbaddrs] = mask;
- addrs[nbaddrs++] = addr;
+ ips[nbaddrs].ip = addr;
+ ips[nbaddrs].mask = mask;
+ ++nbaddrs;
}
}else{
- masks[nbaddrs] = mask;
- addrs[nbaddrs++] = addr;
+ ips[nbaddrs].ip = addr;
+ ips[nbaddrs].mask = mask;
+ ++nbaddrs;
}
i++;
}else if (strcmp(arg,"--bcast")==0){
}else if (argv[i][0] == '-'){
usage();
}else{
- if (call_set_ipv4root(addrs,nbaddrs,bcast,masks)==0){
+ if (vc_set_ipv4root(bcast,nbaddrs,ips)==0){
if (!silent){
int i;
printf ("ipv4root is now");
for (i=0; i<nbaddrs; i++){
- unsigned long hostaddr = ntohl(addrs[i]);
+ unsigned long hostaddr = ntohl(ips[i].ip);
printf (" %ld.%ld.%ld.%ld"
,hostaddr>>24
,(hostaddr>>16)&0xff
if (disconnect == 0 || fork()==0){
int newctx;
if (nbctx == 0) ctxs[nbctx++] = -1;
- newctx = call_new_s_context(nbctx,ctxs,0,flags);
+ newctx = vc_new_s_context(ctxs[0],0,flags);
if (newctx != -1){
if (hostname != NULL){
if (sethostname (hostname,strlen(hostname))==-1){
}
}
remove_cap &= (~add_cap);
- if (remove_cap != 0) call_new_s_context (0,NULL,remove_cap,0);
+ if (remove_cap != 0) vc_new_s_context (-2,remove_cap,0);
if (!silent){
printf ("New security context is %d\n"
,ctxs[0] == -1 ? newctx : ctxs[0]);
#ifdef HAVE_CONFIG_H
# include <config.h>
#endif
+#include "compat.h"
#include <stdio.h>
#include <unistd.h>
if (show){
reducecap_print (&user);
}
- if (call_new_s_context(0,NULL,remove,flags)==-1){
+ if (vc_new_s_context(-2,remove,flags)==-1){
perror ("new_s_context -2");
}else{
fprintf (stderr,"Executing\n");
#ifdef HAVE_CONFIG_H
# include <config.h>
#endif
+#include "compat.h"
+
+#include "vserver.h"
#include <stdio.h>
#include <stdlib.h>
#define CTX_DIR_NAME "/var/run/vservers/"
#define CTX_NAME_MAX_LEN 50
-int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags);
-
-
struct ctx_list
{
int ctx;
DIR *proc_dir;
struct dirent *dir_entry;
pid_t my_pid;
- static int ctx1[]={1};
// for error msg
process_name = argv[0];
my_pid = getpid();
// try to switch in context 1
- if (call_new_s_context(1,ctx1, 0, 0) < 0)
+ if (vc_new_s_context(1,0, 0) < 0)
{
fprintf(stderr, "%s: unable to switch in context security #1\n", process_name);
return -1;
sysv/%: sysv/%.subst
@mkdir -p $$(dirname '$@')
- sed -s 's!/usr/lib/util-vserver!$(pkglibdir)!g; \
+ sed -e 's!/usr/lib/util-vserver!$(pkglibdir)!g; \
s!^USR_SBIN=/usr/sbin$$!USR_SBIN=$(sbindir)!g' '$<' >'$@.tmp'
if cmp -s '$<' '$@.tmp'; then \
cp -p '$<' '$@'; \
chrootsafe /vservers/test
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
// This test must fail
int fd = open ("/",O_RDONLY);
if (fd != -1){
- if (call_chrootsafe(argv[1])==-1){
+ if (vc_chrootsafe(argv[1])==-1){
fprintf (stderr,"Ok, chrootsafe failed with one open directory errno=%s\n",strerror(errno));
}else{
fprintf (stderr,"Hum, chrootsafe succeed with one open directory\n");
close (fd);
}
// Now it should work
- if (call_chrootsafe(argv[1])!=-1){
+ if (vc_chrootsafe(argv[1])!=-1){
fprintf (stderr,"Ok, chrootsafe worked\n");
system ("/bin/sh");
}else{
# $Id$
-%define confdir %_sysconfdir/vservers
+%define confdir %_sysconfdir/vservers
+%define pkglibdir %_libdir/%name
Summary: Linux virtual server utilities
Name: @PACKAGE@
URL: http://savannah.nongnu.org/projects/util-vserver/
Source0: http://savannah.nongnu.org/download/util-vserver/stable.pkg/%version/%name-%version.tar.bz2
BuildRoot: %_tmppath/%name-%version-%release-root
+#Requires: util-vserver-core = %epoch:%version-%release
Provides: vserver = %epoch:%version-%release
Conflicts: vserver < %epoch:%version
+BuildRequires: mount vconfig gawk iproute
+BuildRequires: dietlibc gcc-c++
+
+%package core
+Summary: The core-utilities for util-vserver
+Group: Applications/System
%package sysv
Summary: SysV-initscripts for vserver
%package devel
Summary: Header-files and libraries which are needed to develop vserver based applications
Group: Development/Libraries
-
+Requires: pkgconfig
%description
This package provides the components and a framework to setup virtual
This requires a special kernel supporting the new new_s_context and
set_ipv4root system call.
+%description core
%description sysv
%description devel
%defattr(-,root,root,-)
%doc AUTHORS COPYING ChangeLog NEWS README THANKS
%doc doc/FAQ.txt
-%_libdir/%name
+%pkglibdir
%_sbindir/*
%_mandir/man8/*
%dir %confdir
%dir %confdir/.distributions/rh*
%dir %confdir/.distributions/*/apt
%config(noreplace) %confdir/.distributions/*/apt/sources.list
+%dir /var/run/vservers
+
+%if 0
+%files core
+%defattr(-,root,root,-)
+%dir %pkglibdir
+%pkglibdir/filetime
+%pkglibdir/
+filetime ifspec listdevip mask2prefix readlink save_ctxinfo save_s_context secure-mount showattr showperm util-vserver-vars
+
+chbind chcontext new-namespace reducecap setctxlimit util-vserver-vars
+%endif
%files sysv
%defattr(-,root,root,-)
%defattr(-,root,root,-)
%_includedir/*.h
%_libdir/*.a
+%_libdir/pkgconfig/*
%changelog
* Wed Oct 1 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 0:0.23.5-0