83 lines
3.8 KiB
Diff
83 lines
3.8 KiB
Diff
|
From c3f82c64d86432c7d4b0c3abf61b70fd88f1d9dd Mon Sep 17 00:00:00 2001
|
||
|
|
From: Lennart Poettering <lennart@poettering.net>
|
||
|
|
Date: Wed, 20 Nov 2013 22:10:42 +0100
|
||
|
|
Subject: [PATCH] nspawn: add new --drop-capability= switch
|
||
|
|
|
||
|
|
---
|
||
|
|
man/systemd-nspawn.xml | 10 ++++++++++
|
||
|
|
src/nspawn/nspawn.c | 12 ++++++++++--
|
||
|
|
2 files changed, 20 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
|
||
|
|
index ba9e516..c1a5cad 100644
|
||
|
|
--- a/man/systemd-nspawn.xml
|
||
|
|
+++ b/man/systemd-nspawn.xml
|
||
|
|
@@ -304,6 +304,16 @@
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
+ <term><option>--drop-capability=</option></term>
|
||
|
|
+
|
||
|
|
+ <listitem><para>Specify one or more
|
||
|
|
+ additional capabilities to drop for
|
||
|
|
+ the container. This allows running the
|
||
|
|
+ container with fewer capabilities than
|
||
|
|
+ the default (see above).</para></listitem>
|
||
|
|
+ </varlistentry>
|
||
|
|
+
|
||
|
|
+ <varlistentry>
|
||
|
|
<term><option>--link-journal=</option></term>
|
||
|
|
|
||
|
|
<listitem><para>Control whether the
|
||
|
|
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
|
||
|
|
index 85bbadf..7346253 100644
|
||
|
|
--- a/src/nspawn/nspawn.c
|
||
|
|
+++ b/src/nspawn/nspawn.c
|
||
|
|
@@ -130,6 +130,7 @@ static int help(void) {
|
||
|
|
" --read-only Mount the root directory read-only\n"
|
||
|
|
" --capability=CAP In addition to the default, retain specified\n"
|
||
|
|
" capability\n"
|
||
|
|
+ " --drop-capability=CAP Drop the specified capability from the default set\n"
|
||
|
|
" --link-journal=MODE Link up guest journal, one of no, auto, guest, host\n"
|
||
|
|
" -j Equivalent to --link-journal=host\n"
|
||
|
|
" --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
|
||
|
|
@@ -148,6 +149,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||
|
|
ARG_UUID,
|
||
|
|
ARG_READ_ONLY,
|
||
|
|
ARG_CAPABILITY,
|
||
|
|
+ ARG_DROP_CAPABILITY,
|
||
|
|
ARG_LINK_JOURNAL,
|
||
|
|
ARG_BIND,
|
||
|
|
ARG_BIND_RO
|
||
|
|
@@ -163,6 +165,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||
|
|
{ "uuid", required_argument, NULL, ARG_UUID },
|
||
|
|
{ "read-only", no_argument, NULL, ARG_READ_ONLY },
|
||
|
|
{ "capability", required_argument, NULL, ARG_CAPABILITY },
|
||
|
|
+ { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
|
||
|
|
{ "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
|
||
|
|
{ "bind", required_argument, NULL, ARG_BIND },
|
||
|
|
{ "bind-ro", required_argument, NULL, ARG_BIND_RO },
|
||
|
|
@@ -247,7 +250,8 @@ static int parse_argv(int argc, char *argv[]) {
|
||
|
|
arg_read_only = true;
|
||
|
|
break;
|
||
|
|
|
||
|
|
- case ARG_CAPABILITY: {
|
||
|
|
+ case ARG_CAPABILITY:
|
||
|
|
+ case ARG_DROP_CAPABILITY: {
|
||
|
|
char *state, *word;
|
||
|
|
size_t length;
|
||
|
|
|
||
|
|
@@ -266,7 +270,11 @@ static int parse_argv(int argc, char *argv[]) {
|
||
|
|
}
|
||
|
|
|
||
|
|
free(t);
|
||
|
|
- arg_retain |= 1ULL << (uint64_t) cap;
|
||
|
|
+
|
||
|
|
+ if (c == ARG_CAPABILITY)
|
||
|
|
+ arg_retain |= 1ULL << (uint64_t) cap;
|
||
|
|
+ else
|
||
|
|
+ arg_retain &= ~(1ULL << (uint64_t) cap);
|
||
|
|
}
|
||
|
|
|
||
|
|
break;
|