On 07/10/2010 04:52 AM, Sukadev Bhattiprolu wrote:
[ ... ]
> + if (!answer.ret) {
> + ret = lxc_unfreeze(handler->name);
> + if (!ret)
> + return 0;
>
[ ... ]
gcc -DHAVE_CONFIG_H -I. -I../../src -fPIC -DPIC -I../../src -g -O2 -Wall
-MT liblxc_
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "lxc".
The branch, master has been updated
via d1c383f39064969b647fd632f8e6614b49fd6cf2 (commit)
via 371828c4a0a23b61d57889b7
Signed-off-by: Daniel Lezcano
---
src/lxc/lxc_execute.c |5 -
src/lxc/lxc_start.c |4
2 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/src/lxc/lxc_execute.c b/src/lxc/lxc_execute.c
index c3a0cd7..f480859 100644
--- a/src/lxc/lxc_execute.c
+++ b/src/lxc/lxc_execute
With the capabilities, the open of the log file can be done on any
file, making possible to modifify the content of the file.
Let's drop the privilege when opening the file, so we ensure that is
no longer possible.
Signed-off-by: Daniel Lezcano
---
src/lxc/log.c |6 --
1 files changed,
This patch adds the functions to drop the 'effective' capabilities and
restore them from the 'permitted' capabilities.
When the command is run as 'root' we do nothing.
When the command is run as 'lambda' user, we drop the effective capabilities
When the command is run as 'root' but real uid is not
This function is no longer used.
Signed-off-by: Daniel Lezcano
---
src/lxc/state.c |8
1 files changed, 0 insertions(+), 8 deletions(-)
diff --git a/src/lxc/state.c b/src/lxc/state.c
index b29ae09..6720011 100644
--- a/src/lxc/state.c
+++ b/src/lxc/state.c
@@ -63,14 +63,6 @@ lxc_st
Prevent to specify a file not belonging to us as the output for the console
Signed-off-by: Daniel Lezcano
---
src/lxc/console.c | 11 ++-
1 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/src/lxc/console.c b/src/lxc/console.c
index 1ab2b29..edefc41 100644
--- a/src/lxc/con
Thanks all for the feedbacks.
The following patchset provides an intermediate solution between
all the remarks about the security aspects when running lxc with
the capabilities.
It has the advantage to be compatible with the setuid bit root set
on the lxc-start and lxc-execute.
More work has to
This macro is a helper to call a function into a [un]privilegied section.
Signed-off-by: Daniel Lezcano
---
src/lxc/caps.h | 33 ++---
1 files changed, 30 insertions(+), 3 deletions(-)
diff --git a/src/lxc/caps.h b/src/lxc/caps.h
index bdc248b..6b27648 100644
--- a
On 06/09/2010 07:56 PM, Ferenc Wagner wrote:
> Hi,
>
> here are basically the same patches, with some obvious errors corrected
> and some unrelated documentation added. It actually survived some
> targeted testing in the past days and seems to behave as expected, ie.
>
> # lxc-start -n s -- sh -c
10 matches
Mail list logo
