From c86da6a3ac517b78e6f710df7efe2f51d153b73c Mon Sep 17 00:00:00 2001
From: Serge Hallyn <serge.hallyn@ubuntu.com>
Date: Thu, 14 Aug 2014 18:29:55 +0000
Subject: [PATCH] chmod container dir to 0770

This prevents u2 from going into /home/u1/.local/share/lxc/u1/rootfs
and running setuid-root applications to get write access to u1's
container rootfs.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>
---
 src/lxc/lxccontainer.c | 39 ++++++++++++++++++++++++++-------------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index 0cf21ce8a..223f455c5 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -733,6 +733,27 @@ static bool lxcapi_stop(struct lxc_container *c)
 	return ret == 0;
 }
 
+static int do_create_container_dir(const char *path, struct lxc_conf *conf)
+{
+	int ret = -1;
+	char *p = alloca(strlen(path)+1);
+	ret = mkdir(path, 0770);
+	if (ret) {
+		if (errno == EEXIST)
+			ret = 0;
+		else {
+			SYSERROR("failed to create container path %s", path);
+			return -1;
+		}
+	}
+	strcpy(p, path);
+	if (!lxc_list_empty(&conf->id_map) && chown_mapped_root(p, conf) != 0) {
+		ERROR("Failed to chown container dir");
+		ret = -1;
+	}
+	return ret;
+}
+
 /*
  * create the standard expected container dir
  */
@@ -750,13 +771,7 @@ static bool create_container_dir(struct lxc_container *c)
 		free(s);
 		return false;
 	}
-	ret = mkdir(s, 0755);
-	if (ret) {
-		if (errno == EEXIST)
-			ret = 0;
-		else
-			SYSERROR("failed to create container path for %s", c->name);
-	}
+	ret = do_create_container_dir(s, c->lxc_conf);
 	free(s);
 	return ret == 0;
 }
@@ -2703,17 +2718,15 @@ sudo lxc-clone -o o1 -n n1 -s -L|-fssize fssize -v|--vgname vgname \
 only rootfs gets converted (copied/snapshotted) on clone.
 */
 
-static int create_file_dirname(char *path)
+static int create_file_dirname(char *path, struct lxc_conf *conf)
 {
 	char *p = strrchr(path, '/');
-	int ret;
+	int ret = -1;
 
 	if (!p)
 		return -1;
 	*p = '\0';
-	ret = mkdir(path, 0755);
-	if (ret && errno != EEXIST)
-		SYSERROR("creating container path %s", path);
+        ret = do_create_container_dir(path, conf);
 	*p = '/';
 	return ret;
 }
@@ -2757,7 +2770,7 @@ static struct lxc_container *lxcapi_clone(struct lxc_container *c, const char *n
 		goto out;
 	}
 
-	ret = create_file_dirname(newpath);
+	ret = create_file_dirname(newpath, c->lxc_conf);
 	if (ret < 0 && errno != EEXIST) {
 		ERROR("Error creating container dir for %s", newpath);
 		goto out;