}
. "$UTIL_VSERVER_VARS"
+function getCapFlags
+{
+ local ctx=$1
+
+ if test "$ctx" && ! $_VSERVER_INFO - FEATURE migrate; then
+ set -- $($_CHCONTEXT_COMPAT --xid 1 \
+ sh -c "cat /proc/[0-9]*/status | egrep '^(CapBset|s_context|ctxflags)'" | \
+ grep -B 1 -A 1 "^s_context: $ctx " | \
+ sed -e '1,3p;d' | awk '{ print $2 }')
+ else
+ set --
+ fi
+
+ if test "$3"; then
+ RPM_FAKE_CAP=$[ ~0x$1 ]
+ RPM_FAKE_FLAGS=$3
+ else
+ RPM_FAKE_CAP=$[ ~0xd40c04ff ]
+ RPM_FAKE_FLAGS=4
+ fi
+}
+
lib=$_RPM_FAKE_SO
#scall_nr=$($_VSERVER_INFO x SYSCALL_NEW_S_CONTEXT_NR 2>/dev/null)
exit 1
}
+
+getCapFlags "$ctx"
+
+export RPM_FAKE_CAP RPM_FAKE_FLAGS
+
#RPM_FAKE_S_CONTEXT_REV=$scall_rev \
#RPM_FAKE_S_CONTEXT_NR=$scall_nr \
RPM_FAKE_CHROOT=$vdir \
RPM_FAKE_CTX=$ctx \
-RPM_FAKE_CAP=$[ ~0xd40c04ff ] \
LD_PRELOAD=$lib${LD_PRELOAD:+:$LD_PRELOAD} \
exec $bin "$@"
bool in_ctx;
char const * pid_file;
char const * chroot;
+ uint32_t caps;
+ int flags;
};
static struct option const
parseArgs(struct ArgInfo *args, int argc, char *argv[])
{
while (1) {
- int c = getopt_long(argc, argv, "c:u:g:r:ns", CMDLINE_OPTIONS, 0);
+ int c = getopt_long(argc, argv, "F:C:c:u:g:r:ns", CMDLINE_OPTIONS, 0);
if (c==-1) break;
switch (c) {
case 'h' : showHelp(1, argv[0], 0);
case 'v' : showVersion();
- case 'c' : args->ctx = atoi(optarg); break;
- case 'u' : args->uid = atoi(optarg); break;
- case 'g' : args->gid = atoi(optarg); break;
+ case 'c' : args->ctx = atoi(optarg); break;
+ case 'u' : args->uid = atoi(optarg); break;
+ case 'g' : args->gid = atoi(optarg); break;
+ case 'F' : args->flags = atoi(optarg); break;
+ case 'C' : args->caps = atoi(optarg); break;
case 'r' : args->chroot = optarg; break;
case 'n' : args->do_fork = false; break;
case 's' : args->in_ctx = true; break;
}
static void
-activateContext(xid_t xid, bool in_ctx)
+activateContext(xid_t xid, bool in_ctx,
+ uint32_t xid_caps, int xid_flags)
{
if (in_ctx) {
struct vc_ctx_flags flags = {
Evc_ctx_migrate(xid);
else {
#ifdef VC_ENABLE_API_COMPAT
- Evc_new_s_context(xid, 0, S_CTX_INFO_LOCK);
+ Evc_new_s_context(xid, xid_caps, xid_flags);
#else
WRITE_MSG(2, ENSC_WRAPPERS_PREFIX "can not change context: migrate kernel feature missing and 'compat' API disabled\n");
exit(wrapper_exit_code);
.pid_file = 0,
.chroot = 0,
.in_ctx = false,
+ .flags = S_CTX_INFO_LOCK,
};
int pid_fd = -1;
if (args.chroot) Echroot(args.chroot);
Echdir("/");
- activateContext(args.ctx, args.in_ctx);
+ activateContext(args.ctx, args.in_ctx, args.caps, args.flags);
Esetgroups(0, &args.gid);
Esetgid(args.gid);
Esetuid(args.uid);
}
if (pid==0) {
- char const *args[15];
+ char const *args[20];
char const **ptr = args;
char const *env[] = { "HOME=/", "PATH=/bin:/usr/bin", 0 };
char const *xid_str;
+ char flag_str[ sizeof(flags)*3 + 2];
+ char caps_str[ sizeof(caps)*3 + 2];
setsid();
dup2(res_sock[1], 0);
close(res_sock[1]);
/* ... *socket[0] are marked as close-on-exec ...*/
+ flag_str[utilvserver_fmt_uint(flag_str, flags)] = '\0';
+ caps_str[utilvserver_fmt_uint(caps_str, caps)] = '\0';
+
*ptr++ = resolver;
+ *ptr++ = "-F"; *ptr++ = flag_str;
+ *ptr++ = "-C"; *ptr++ = caps_str;
if (root) { *ptr++ = "-r"; *ptr++ = root; }
if (uid) { *ptr++ = "-u"; *ptr++ = uid; }
if (gid) { *ptr++ = "-g"; *ptr++ = gid; }