proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-25 07:41:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

don't leak the rootfs.pin fd into the container

Browse Source 
Only the container parent needs to keep that fd open.  Close it
as soon as the container's first task is spawned.  Else it can
show up in /proc/$$/fd in the container.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn 2013-01-17 09:53:33 -06:00 committed by Stéphane Graber
parent 2008796233
commit 2b0e17e48f
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/lxc/start.c
View File

@ -575,6 +575,9 @@ static int do_start(void *data)
lxc_sync_fini_parent(handler);
/* don't leak the pinfd to the container */
close(handler->pinfd);
/* Tell the parent task it can begin to configure the
* container and wait for it to finish
*/
@ -691,7 +694,6 @@ int lxc_spawn(struct lxc_handler *handler)
{
int failed_before_rename = 0;
const char *name = handler->name;
int pinfd;
if (lxc_sync_init(handler))
return -1;
@ -735,8 +737,8 @@ int lxc_spawn(struct lxc_handler *handler)
* marking it readonly.
*/
pinfd = pin_rootfs(handler->conf->rootfs.path);
if (pinfd == -1) {
handler->pinfd = pin_rootfs(handler->conf->rootfs.path);
if (handler->pinfd == -1) {
ERROR("failed to pin the container's rootfs");
goto out_abort;
}
@ -818,8 +820,8 @@ int lxc_spawn(struct lxc_handler *handler)
lxc_sync_fini(handler);
if (pinfd >= 0)
close(pinfd);
if (handler->pinfd >= 0)
close(handler->pinfd);
return 0;

1
src/lxc/start.h
View File

@ -49,6 +49,7 @@ struct lxc_handler {
#if HAVE_APPARMOR
int aa_enabled;
#endif
int pinfd;
};
extern struct lxc_handler *lxc_init(const char *name, struct lxc_conf *);