proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-03 19:32:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

From: Daniel Lezcano <dlezcano@fr.ibm.com>

Browse Source 
Remove the CAP_SYS_BOOT capability from the bouding set, so we can poweroff,
halt, reboot the container safely without shutting down the real host.

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
This commit is contained in:
dlezcano 2008-11-04 22:18:23 +00:00
parent 96950ed0f4
commit 42ff343ddb
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/lxc/start.c
View File

@ -35,6 +35,7 @@
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <sys/capability.h>
#include <sys/wait.h>
#include <lxc/lxc.h>
@ -138,6 +139,11 @@ int lxc_start(const char *name, int argc, char *argv[],
goto out_child;
}
if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
lxc_log_syserror("failed to remove CAP_SYS_BOOT capability");
goto out_child;
}
execvp(argv[0], argv);
lxc_log_syserror("failed to exec %s", argv[0]);