From 28f602ff477f5e5e924f2b931c6034b7df9e9851 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 20 Jul 2010 13:45:44 +0200 Subject: [PATCH] fix log appending to any file With the capabilities, the open of the log file can be done on any file, making possible to modifify the content of the file. Let's drop the privilege when opening the file, so we ensure that is no longer possible. Signed-off-by: Daniel Lezcano --- src/lxc/log.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/lxc/log.c b/src/lxc/log.c index 596ed9900..0661360a4 100644 --- a/src/lxc/log.c +++ b/src/lxc/log.c @@ -33,7 +33,8 @@ #include #include -#include +#include "log.h" +#include "caps.h" #define LXC_LOG_PREFIX_SIZE 32 #define LXC_LOG_BUFFER_SIZE 512 @@ -127,7 +128,8 @@ static int log_open(const char *name) int fd; int newfd; - fd = open(name, O_CREAT | O_WRONLY | O_APPEND | O_CLOEXEC, 0666); + fd = lxc_unpriv(open(name, O_CREAT | O_WRONLY | + O_APPEND | O_CLOEXEC, 0666)); if (fd == -1) { ERROR("failed to open log file \"%s\" : %s", name, strerror(errno));