vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Factor out finalize namespace

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-03-03 12:15:47 -08:00
parent ab952e2502
commit 7dc071dca5
2 changed files with 21 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
libcontainer/nsinit/execin.go
View file

@ -5,7 +5,6 @@ package nsinit
import ( import (
"fmt" "fmt"
"github.com/dotcloud/docker/pkg/libcontainer" "github.com/dotcloud/docker/pkg/libcontainer"
"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
"github.com/dotcloud/docker/pkg/system" "github.com/dotcloud/docker/pkg/system"
"os" "os"
"path/filepath" "path/filepath"
@ -73,8 +72,8 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus()) os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
} }
dropAndExec: dropAndExec:
if err := capabilities.DropCapabilities(container); err != nil { if err := finalizeNamespace(container); err != nil {
return -1, fmt.Errorf("drop capabilities %s", err) return -1, err
} }
if err := system.Execv(args[0], args[0:], container.Env); err != nil { if err := system.Execv(args[0], args[0:], container.Env); err != nil {
return -1, err return -1, err

29
libcontainer/nsinit/init.go
View file

@ -64,16 +64,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
if err := system.Sethostname(container.Hostname); err != nil { if err := system.Sethostname(container.Hostname); err != nil {
return fmt.Errorf("sethostname %s", err) return fmt.Errorf("sethostname %s", err)
} }
if err := capabilities.DropCapabilities(container); err != nil { if err := finalizeNamespace(container); err != nil {
return fmt.Errorf("drop capabilities %s", err) return fmt.Errorf("finalize namespace %s", err)
}
if err := setupUser(container); err != nil {
return fmt.Errorf("setup user %s", err)
}
if container.WorkingDir != "" {
if err := system.Chdir(container.WorkingDir); err != nil {
return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
}
} }
return system.Execv(args[0], args[0:], container.Env) return system.Execv(args[0], args[0:], container.Env)
} }
@ -142,3 +134,20 @@ func setupNetwork(container *libcontainer.Container, context libcontainer.Contex
} }
return nil return nil
} }
// finalizeNamespace drops the caps and sets the correct user
// and working dir before execing the command inside the namespace
func finalizeNamespace(container *libcontainer.Container) error {
if err := capabilities.DropCapabilities(container); err != nil {
return fmt.Errorf("drop capabilities %s", err)
}
if err := setupUser(container); err != nil {
return fmt.Errorf("setup user %s", err)
}
if container.WorkingDir != "" {
if err := system.Chdir(container.WorkingDir); err != nil {
return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
}
}
return nil
}