aboutgitcodebugslistschat
path: root/conf.c
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2022-01-25 20:08:00 +0100
committerStefano Brivio <sbrivio@redhat.com>2022-01-26 16:30:59 +0100
commit4c7304db85bd4e8ae641ab946a5b3832f24b6eca (patch)
tree4fb82c8162bd56183aa3bdd3410df7ee12021259 /conf.c
parent1776de0140fb663777d4590fbb849c1d0a0c7885 (diff)
downloadpasst-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.gz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.bz2
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.lz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.xz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.zst
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.zip
conf, pasta: Explicitly pass CLONE_{NEWUSER,NEWNET} to setns()
Only allow the intended types of namespaces to be joined via setns() as a defensive measure. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'conf.c')
-rw-r--r--conf.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/conf.c b/conf.c
index ab91b7f..6810144 100644
--- a/conf.c
+++ b/conf.c
@@ -347,8 +347,8 @@ static int conf_ns_check(void *arg)
{
struct ctx *c = (struct ctx *)arg;
- if ((!c->netns_only && setns(c->pasta_userns_fd, 0)) ||
- setns(c->pasta_netns_fd, 0))
+ if ((!c->netns_only && setns(c->pasta_userns_fd, CLONE_NEWUSER)) ||
+ setns(c->pasta_netns_fd, CLONE_NEWNET))
c->pasta_userns_fd = c->pasta_netns_fd = -1;
return 0;