From: Daniel Hokka Zakrisson Date: Tue, 12 Sep 2006 12:21:19 +0000 (+0000) Subject: Apply Bastian Blank's userspace namespace cleanup patch. X-Git-Tag: release-0.30.211~54 X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4cc6746ff2ab2c7e32e7bc20111cec287a4fb113;p=util-vserver.git Apply Bastian Blank's userspace namespace cleanup patch. git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@2301 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- diff --git a/doc/configuration.xml b/doc/configuration.xml index 3b728b6..323aaee 100644 --- a/doc/configuration.xml +++ b/doc/configuration.xml @@ -37,6 +37,14 @@ the 'barrier' attribute. Else, common chroot(2) exploits are possible. + + +Enable namespace cleanup globally. It can be overridden for a single vserver +by setting the nonamespace-cleanup flag +there. + + + Path of the vserver run reverse directory. This directory contains @@ -344,6 +352,19 @@ the 'barrier' attribute. Else, common chroot(2) exploits are possible. + + +Overrides the global namespace-cleanup flag and disables +namespace cleanup for the current vserver. + + + + + +Enable namespace cleanup for the current vserver. + + + [experimental; name is subject of possible change] Contains the diff --git a/scripts/functions b/scripts/functions index 69e57f0..f3bb242 100644 --- a/scripts/functions +++ b/scripts/functions @@ -480,6 +480,18 @@ function isAvoidNamespace -e "$cfgdir"/nonamespace } +function isNamespaceCleanup +{ + local cfgdir + + $_VSERVER_INFO - FEATURE namespace || return 1 + cfgdir=$($_VSERVER_INFO "$1" CFGDIR) || return 1 + test -e "$cfgdir"/nonamespace-cleanup && return 1 + test -e "$__CONFDIR"/.defaults/namespace-cleanup -o \ + -e "$cfgdir"/namespace-cleanup && return 0 + return 1 +} + ## Usage: getAllVservers [*] function getAllVservers { diff --git a/scripts/vserver.functions b/scripts/vserver.functions index c6fa4b5..dfddc6b 100644 --- a/scripts/vserver.functions +++ b/scripts/vserver.functions @@ -790,13 +790,13 @@ function mountVserver test -n "$_HAVE_CHBIND_OPTIONS" || _generateChbindOptions "$cfgdir" - test -z "$NAMESPACE_CLEANUP" || isAvoidNamespace "$cfgdir" || \ - $_VNAMESPACE --cleanup - _mountVserverInternal "$cfgdir"/fstab _mountVserverInternal "$cfgdir"/fstab.local _mountVserverInternal "$cfgdir"/fstab.remote $_CHBIND "${CHBIND_OPTS[@]}" + isNamespaceCleanup "$cfgdir" && \ + _namespaceCleanup + isAvoidNamespace "$cfgdir" || \ $_SECURE_MOUNT --rbind -n "$vdir" "/" } @@ -1148,3 +1148,29 @@ function saveDiskLimits _saveSingleDiskLimit "$vdir" "$dlimit" done } + +function _namespaceCleanup +{ + local root=$(readlink -f "$vdir") + local tmp="$root" + local -a list + while [ "$tmp" ]; do + list=( "${list[@]}" "$tmp" ) + tmp="${tmp%/*}" + done + local -a list_umount + while read dev path opts; do + [ "$path" ] || continue + for i in "$root" /dev /proc; do + [ "${path#$i}" != "$path" ] && continue 2 + done + for i in "${list[@]}" /; do + [ "$path" = "$i" ] && continue 2 + done + list_umount=( "${list_umount[@]}" "$path" ) + done < /proc/mounts + for i in "${list_umount[@]}"; do + umount -l -n "$i" + done +} +