aboutgitcodebugslistschat
path: root/pasta.c
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2022-01-25 20:08:00 +0100
committerStefano Brivio <sbrivio@redhat.com>2022-01-26 16:30:59 +0100
commit4c7304db85bd4e8ae641ab946a5b3832f24b6eca (patch)
tree4fb82c8162bd56183aa3bdd3410df7ee12021259 /pasta.c
parent1776de0140fb663777d4590fbb849c1d0a0c7885 (diff)
downloadpasst-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.gz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.bz2
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.lz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.xz
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.tar.zst
passt-4c7304db85bd4e8ae641ab946a5b3832f24b6eca.zip
conf, pasta: Explicitly pass CLONE_{NEWUSER,NEWNET} to setns()
Only allow the intended types of namespaces to be joined via setns() as a defensive measure. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'pasta.c')
-rw-r--r--pasta.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/pasta.c b/pasta.c
index a2b842b..bcc1261 100644
--- a/pasta.c
+++ b/pasta.c
@@ -148,13 +148,15 @@ static int pasta_wait_for_ns(void *arg)
snprintf(ns, PATH_MAX, "/proc/%i/ns/user", pasta_child_pid);
do
while ((c->pasta_userns_fd = open(ns, O_RDONLY)) < 0);
- while (setns(c->pasta_userns_fd, 0) && !close(c->pasta_userns_fd));
+ while (setns(c->pasta_userns_fd, CLONE_NEWUSER) &&
+ !close(c->pasta_userns_fd));
netns:
snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid);
do
while ((c->pasta_netns_fd = open(ns, O_RDONLY)) < 0);
- while (setns(c->pasta_netns_fd, 0) && !close(c->pasta_netns_fd));
+ while (setns(c->pasta_netns_fd, CLONE_NEWNET) &&
+ !close(c->pasta_netns_fd));
return 0;
}