From ea0a7f53ecf971a1040a3edf24427f5074ab0a28 Mon Sep 17 00:00:00 2001 From: Enrico Scholz Date: Wed, 5 May 2004 19:37:54 +0000 Subject: [PATCH] added code to preserve capabilities and flags git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@1534 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- util-vserver/scripts/vrpm-preload | 28 +++++++++++++++++++++++++++- util-vserver/src/rpm-fake-resolver.c | 20 +++++++++++++------- util-vserver/src/rpm-fake.c | 9 ++++++++- 3 files changed, 48 insertions(+), 9 deletions(-) diff --git a/util-vserver/scripts/vrpm-preload b/util-vserver/scripts/vrpm-preload index e6cbc70..c82978c 100755 --- a/util-vserver/scripts/vrpm-preload +++ b/util-vserver/scripts/vrpm-preload @@ -25,6 +25,28 @@ test -e "$UTIL_VSERVER_VARS" || { } . "$UTIL_VSERVER_VARS" +function getCapFlags +{ + local ctx=$1 + + if test "$ctx" && ! $_VSERVER_INFO - FEATURE migrate; then + set -- $($_CHCONTEXT_COMPAT --xid 1 \ + sh -c "cat /proc/[0-9]*/status | egrep '^(CapBset|s_context|ctxflags)'" | \ + grep -B 1 -A 1 "^s_context: $ctx " | \ + sed -e '1,3p;d' | awk '{ print $2 }') + else + set -- + fi + + if test "$3"; then + RPM_FAKE_CAP=$[ ~0x$1 ] + RPM_FAKE_FLAGS=$3 + else + RPM_FAKE_CAP=$[ ~0xd40c04ff ] + RPM_FAKE_FLAGS=4 + fi +} + lib=$_RPM_FAKE_SO #scall_nr=$($_VSERVER_INFO x SYSCALL_NEW_S_CONTEXT_NR 2>/dev/null) @@ -45,10 +67,14 @@ test "$bin" || { exit 1 } + +getCapFlags "$ctx" + +export RPM_FAKE_CAP RPM_FAKE_FLAGS + #RPM_FAKE_S_CONTEXT_REV=$scall_rev \ #RPM_FAKE_S_CONTEXT_NR=$scall_nr \ RPM_FAKE_CHROOT=$vdir \ RPM_FAKE_CTX=$ctx \ -RPM_FAKE_CAP=$[ ~0xd40c04ff ] \ LD_PRELOAD=$lib${LD_PRELOAD:+:$LD_PRELOAD} \ exec $bin "$@" diff --git a/util-vserver/src/rpm-fake-resolver.c b/util-vserver/src/rpm-fake-resolver.c index 81e3295..85e1f57 100644 --- a/util-vserver/src/rpm-fake-resolver.c +++ b/util-vserver/src/rpm-fake-resolver.c @@ -59,6 +59,8 @@ struct ArgInfo { bool in_ctx; char const * pid_file; char const * chroot; + uint32_t caps; + int flags; }; static struct option const @@ -95,16 +97,18 @@ inline static void parseArgs(struct ArgInfo *args, int argc, char *argv[]) { while (1) { - int c = getopt_long(argc, argv, "c:u:g:r:ns", CMDLINE_OPTIONS, 0); + int c = getopt_long(argc, argv, "F:C:c:u:g:r:ns", CMDLINE_OPTIONS, 0); if (c==-1) break; switch (c) { case 'h' : showHelp(1, argv[0], 0); case 'v' : showVersion(); - case 'c' : args->ctx = atoi(optarg); break; - case 'u' : args->uid = atoi(optarg); break; - case 'g' : args->gid = atoi(optarg); break; + case 'c' : args->ctx = atoi(optarg); break; + case 'u' : args->uid = atoi(optarg); break; + case 'g' : args->gid = atoi(optarg); break; + case 'F' : args->flags = atoi(optarg); break; + case 'C' : args->caps = atoi(optarg); break; case 'r' : args->chroot = optarg; break; case 'n' : args->do_fork = false; break; case 's' : args->in_ctx = true; break; @@ -239,7 +243,8 @@ daemonize(struct ArgInfo const UNUSED * args, int pid_fd) } static void -activateContext(xid_t xid, bool in_ctx) +activateContext(xid_t xid, bool in_ctx, + uint32_t xid_caps, int xid_flags) { if (in_ctx) { struct vc_ctx_flags flags = { @@ -253,7 +258,7 @@ activateContext(xid_t xid, bool in_ctx) Evc_ctx_migrate(xid); else { #ifdef VC_ENABLE_API_COMPAT - Evc_new_s_context(xid, 0, S_CTX_INFO_LOCK); + Evc_new_s_context(xid, xid_caps, xid_flags); #else WRITE_MSG(2, ENSC_WRAPPERS_PREFIX "can not change context: migrate kernel feature missing and 'compat' API disabled\n"); exit(wrapper_exit_code); @@ -271,6 +276,7 @@ int main(int argc, char * argv[]) .pid_file = 0, .chroot = 0, .in_ctx = false, + .flags = S_CTX_INFO_LOCK, }; int pid_fd = -1; @@ -288,7 +294,7 @@ int main(int argc, char * argv[]) if (args.chroot) Echroot(args.chroot); Echdir("/"); - activateContext(args.ctx, args.in_ctx); + activateContext(args.ctx, args.in_ctx, args.caps, args.flags); Esetgroups(0, &args.gid); Esetgid(args.gid); Esetuid(args.uid); diff --git a/util-vserver/src/rpm-fake.c b/util-vserver/src/rpm-fake.c index 3f9d051..f81718b 100644 --- a/util-vserver/src/rpm-fake.c +++ b/util-vserver/src/rpm-fake.c @@ -278,10 +278,12 @@ initPwSocket() } if (pid==0) { - char const *args[15]; + char const *args[20]; char const **ptr = args; char const *env[] = { "HOME=/", "PATH=/bin:/usr/bin", 0 }; char const *xid_str; + char flag_str[ sizeof(flags)*3 + 2]; + char caps_str[ sizeof(caps)*3 + 2]; setsid(); dup2(res_sock[1], 0); @@ -294,7 +296,12 @@ initPwSocket() close(res_sock[1]); /* ... *socket[0] are marked as close-on-exec ...*/ + flag_str[utilvserver_fmt_uint(flag_str, flags)] = '\0'; + caps_str[utilvserver_fmt_uint(caps_str, caps)] = '\0'; + *ptr++ = resolver; + *ptr++ = "-F"; *ptr++ = flag_str; + *ptr++ = "-C"; *ptr++ = caps_str; if (root) { *ptr++ = "-r"; *ptr++ = root; } if (uid) { *ptr++ = "-u"; *ptr++ = uid; } if (gid) { *ptr++ = "-g"; *ptr++ = gid; } -- 1.8.1.5