diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2016-10-18 23:22:03 +0200 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2016-10-19 15:54:10 +0200 |
| commit | 7fee5b53973fb4fe049aa0bc5db58093727bdf30 (patch) | |
| tree | b392d7b204098a4dfa3113c7d7fa7f801de11546 /gnu/build/linux-container.scm | |
| parent | 99df12cd1921dd497bb4fcdd96ee40e358d71e6d (diff) | |
container: Allow 'container-excursion' to the same namespaces.
Before that, 'container-excursion' would call 'setns' even when the
target namespace is the one the caller is already in, which would fail.
* gnu/build/linux-container.scm (container-excursion): Introduce
'source' and 'target'. Compare the result of 'readlink' on these
instead of comparing file descriptors to decide whether to call
'setns'.
* tests/containers.scm ("container-excursion, same namespace"): New test.
Diffstat (limited to 'gnu/build/linux-container.scm')
| -rw-r--r-- | gnu/build/linux-container.scm | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 91996d06caf..3fccc9addbf 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm | |||
| @@ -291,15 +291,17 @@ return the exit status." | |||
| 291 | (call-with-clean-exit | 291 | (call-with-clean-exit |
| 292 | (lambda () | 292 | (lambda () |
| 293 | (for-each (lambda (ns) | 293 | (for-each (lambda (ns) |
| 294 | (call-with-input-file (namespace-file (getpid) ns) | 294 | (let ((source (namespace-file (getpid) ns)) |
| 295 | (lambda (current-ns-port) | 295 | (target (namespace-file pid ns))) |
| 296 | (call-with-input-file (namespace-file pid ns) | 296 | ;; Joining the namespace that the process already |
| 297 | (lambda (new-ns-port) | 297 | ;; belongs to would throw an error so avoid that. |
| 298 | ;; Joining the namespace that the process | 298 | ;; XXX: This /proc interface leads to TOCTTOU. |
| 299 | ;; already belongs to would throw an error. | 299 | (unless (string=? (readlink source) (readlink target)) |
| 300 | (unless (= (port->fdes current-ns-port) | 300 | (call-with-input-file source |
| 301 | (port->fdes new-ns-port)) | 301 | (lambda (current-ns-port) |
| 302 | (setns (port->fdes new-ns-port) 0))))))) | 302 | (call-with-input-file target |
| 303 | (lambda (new-ns-port) | ||
| 304 | (setns (fileno new-ns-port) 0)))))))) | ||
| 303 | ;; It's important that the user namespace is joined first, | 305 | ;; It's important that the user namespace is joined first, |
| 304 | ;; so that the user will have the privileges to join the | 306 | ;; so that the user will have the privileges to join the |
| 305 | ;; other namespaces. Furthermore, it's important that the | 307 | ;; other namespaces. Furthermore, it's important that the |