system call is executed, it (option) remove the CAP_SYS_CHROOT
capability. Then it executes its argument
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <string.h>
#include <pwd.h>
#include "linuxcaps.h"
#include "vserver.h"
-static int my_chroot(const char *dir)
-{
- int ret = -1;
- if (has_chrootsafe()){
- ret = call_chrootsafe(dir);
- }else{
- //fprintf (stderr,"Kernel do not support chrootsafe(), using chroot()\n");
- ret = chroot (dir);
- }
- return ret;
-}
-
int main (int argc, char *argv[])
{
if (argc < 3){
// and also a security flaw. The shared objects in the vserver
// may be tweaked to get control of the root server ...
getpwnam ("root");
- if (my_chroot (argv[dir]) == -1){
+ if (vc_chrootsafe (argv[dir]) == -1){
fprintf (stderr,"Can't chroot to directory %s (%s)\n",argv[dir]
,strerror(errno));
}else{
int cmd = dir + 1;
if (nochroot){
- call_new_s_context (0,NULL,1<<CAP_SYS_CHROOT,0);
+ vc_new_s_context (-2,1<<CAP_SYS_CHROOT,0);
}
if (uid != NULL && strcmp(uid,"root")!=0){
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int ret = -1;
int silent = 0;
int i;
- unsigned long addrs[16],masks[16];
+ struct vc_ip_mask_pair ips[16];
int nbaddrs = 0;
unsigned long bcast = 0xffffffff;
for (i=1; i<argc; i++){
usage();
}else{
memcpy (&addr,h->h_addr,sizeof(addr));
- masks[nbaddrs] = mask;
- addrs[nbaddrs++] = addr;
+ ips[nbaddrs].ip = addr;
+ ips[nbaddrs].mask = mask;
+ ++nbaddrs;
}
}else{
- masks[nbaddrs] = mask;
- addrs[nbaddrs++] = addr;
+ ips[nbaddrs].ip = addr;
+ ips[nbaddrs].mask = mask;
+ ++nbaddrs;
}
i++;
}else if (strcmp(arg,"--bcast")==0){
}else if (argv[i][0] == '-'){
usage();
}else{
- if (call_set_ipv4root(addrs,nbaddrs,bcast,masks)==0){
+ if (vc_set_ipv4root(bcast,nbaddrs,ips)==0){
if (!silent){
int i;
printf ("ipv4root is now");
for (i=0; i<nbaddrs; i++){
- unsigned long hostaddr = ntohl(addrs[i]);
+ unsigned long hostaddr = ntohl(ips[i].ip);
printf (" %ld.%ld.%ld.%ld"
,hostaddr>>24
,(hostaddr>>16)&0xff
does little more than mapping command line option to the system call
arguments.
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <unistd.h>
#include <string.h>
if (disconnect == 0 || fork()==0){
int newctx;
if (nbctx == 0) ctxs[nbctx++] = -1;
- newctx = call_new_s_context(nbctx,ctxs,0,flags);
+ newctx = vc_new_s_context(ctxs[0],0,flags);
if (newctx != -1){
if (hostname != NULL){
if (sethostname (hostname,strlen(hostname))==-1){
}
}
remove_cap &= (~add_cap);
- if (remove_cap != 0) call_new_s_context (0,NULL,remove_cap,0);
+ if (remove_cap != 0) vc_new_s_context (-2,remove_cap,0);
if (!silent){
printf ("New security context is %d\n"
,ctxs[0] == -1 ? newctx : ctxs[0]);
The vreboot utility is used to send the signal from the vserver
environment.
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <errno.h>
#include <unistd.h>
if (show){
reducecap_print (&user);
}
- if (call_new_s_context(0,NULL,remove,flags)==-1){
+ if (vc_new_s_context(-2,remove,flags)==-1){
perror ("new_s_context -2");
}else{
fprintf (stderr,"Executing\n");
2001-11-20 added vmsize, rss, stime and utime stat
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
+#include "vserver.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#define CTX_DIR_NAME "/var/run/vservers/"
#define CTX_NAME_MAX_LEN 50
-int call_new_s_context(int nbctx, int ctxs[], int remove_cap, int flags);
-
-
struct ctx_list
{
int ctx;
DIR *proc_dir;
struct dirent *dir_entry;
pid_t my_pid;
- static int ctx1[]={1};
// for error msg
process_name = argv[0];
my_pid = getpid();
// try to switch in context 1
- if (call_new_s_context(1,ctx1, 0, 0) < 0)
+ if (vc_new_s_context(1,0, 0) < 0)
{
fprintf(stderr, "%s: unable to switch in context security #1\n", process_name);
return -1;
chrootsafe /vservers/test
*/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include "compat.h"
+
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
// This test must fail
int fd = open ("/",O_RDONLY);
if (fd != -1){
- if (call_chrootsafe(argv[1])==-1){
+ if (vc_chrootsafe(argv[1])==-1){
fprintf (stderr,"Ok, chrootsafe failed with one open directory errno=%s\n",strerror(errno));
}else{
fprintf (stderr,"Hum, chrootsafe succeed with one open directory\n");
close (fd);
}
// Now it should work
- if (call_chrootsafe(argv[1])!=-1){
+ if (vc_chrootsafe(argv[1])!=-1){
fprintf (stderr,"Ok, chrootsafe worked\n");
system ("/bin/sh");
}else{