From 4c7304db85bd4e8ae641ab946a5b3832f24b6eca Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Tue, 25 Jan 2022 20:08:00 +0100 Subject: conf, pasta: Explicitly pass CLONE_{NEWUSER,NEWNET} to setns() Only allow the intended types of namespaces to be joined via setns() as a defensive measure. Signed-off-by: Stefano Brivio --- pasta.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'pasta.c') diff --git a/pasta.c b/pasta.c index a2b842b..bcc1261 100644 --- a/pasta.c +++ b/pasta.c @@ -148,13 +148,15 @@ static int pasta_wait_for_ns(void *arg) snprintf(ns, PATH_MAX, "/proc/%i/ns/user", pasta_child_pid); do while ((c->pasta_userns_fd = open(ns, O_RDONLY)) < 0); - while (setns(c->pasta_userns_fd, 0) && !close(c->pasta_userns_fd)); + while (setns(c->pasta_userns_fd, CLONE_NEWUSER) && + !close(c->pasta_userns_fd)); netns: snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid); do while ((c->pasta_netns_fd = open(ns, O_RDONLY)) < 0); - while (setns(c->pasta_netns_fd, 0) && !close(c->pasta_netns_fd)); + while (setns(c->pasta_netns_fd, CLONE_NEWNET) && + !close(c->pasta_netns_fd)); return 0; } -- cgit v1.2.3