PATCH: add missing header include

[elogind.git] / src / nspawn.c

diff --git a/src/nspawn.c b/src/nspawn.c
index f4d63ea26536fe28553678e78cb9fa0e1ac7777f..19d95b214f2aad3f3bfe77d4da0a0f2ce95b0f7d 100644 (file)
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -37,6 +37,7 @@
 #include <termios.h>
 #include <sys/signalfd.h>
 #include <grp.h>
 #include <termios.h>
 #include <sys/signalfd.h>
 #include <grp.h>

+#include <linux/fs.h>

 
 #include "log.h"
 #include "util.h"
 
 #include "log.h"
 #include "util.h"


@@ -44,9 +45,11 @@
 #include "cgroup-util.h"
 #include "sd-daemon.h"
 #include "strv.h"
 #include "cgroup-util.h"
 #include "sd-daemon.h"
 #include "strv.h"

+#include "loopback-setup.h"

 
 static char *arg_directory = NULL;
 static char *arg_user = NULL;
 
 static char *arg_directory = NULL;
 static char *arg_user = NULL;

+static bool arg_private_network = false;

 
 static int help(void) {
 
 
 static int help(void) {
 


@@ -54,7 +57,8 @@ static int help(void) {
                "Spawn a minimal namespace container for debugging, testing and building.\n\n"
                "  -h --help            Show this help\n"
                "  -D --directory=NAME  Root directory for the container\n"
                "Spawn a minimal namespace container for debugging, testing and building.\n\n"
                "  -h --help            Show this help\n"
                "  -D --directory=NAME  Root directory for the container\n"

-               "  -u --user=USER       Run the command under specified user or uid\n",
+               "  -u --user=USER       Run the command under specified user or uid\n"
+               "     --private-network Disable network in container\n",

                program_invocation_short_name);
 
         return 0;
                program_invocation_short_name);
 
         return 0;


@@ -62,11 +66,16 @@ static int help(void) {
 
 static int parse_argv(int argc, char *argv[]) {
 
 
 static int parse_argv(int argc, char *argv[]) {
 

+        enum {
+                ARG_PRIVATE_NETWORK = 0x100
+        };
+

         static const struct option options[] = {
         static const struct option options[] = {

-                { "help",      no_argument,       NULL, 'h' },
-                { "directory", required_argument, NULL, 'D' },
-                { "user",      optional_argument, NULL, 'u' },
-                { NULL,        0,                 NULL, 0   }
+                { "help",            no_argument,       NULL, 'h'                 },
+                { "directory",       required_argument, NULL, 'D'                 },
+                { "user",            required_argument, NULL, 'u'                 },
+                { "private-network", no_argument,       NULL, ARG_PRIVATE_NETWORK },
+                { NULL,              0,                 NULL, 0                   }

         };
 
         int c;
         };
 
         int c;


@@ -100,6 +109,10 @@ static int parse_argv(int argc, char *argv[]) {
 
                         break;
 
 
                         break;
 

+                case ARG_PRIVATE_NETWORK:
+                        arg_private_network = true;
+                        break;
+

                 case '?':
                         return -EINVAL;
 
                 case '?':
                         return -EINVAL;
 


@@ -698,7 +711,7 @@ int main(int argc, char *argv[]) {
         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
 
         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
 

-        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) {
+        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL)) < 0) {

                 log_error("clone() failed: %m");
                 goto finish;
         }
                 log_error("clone() failed: %m");
                 goto finish;
         }


@@ -777,6 +790,8 @@ int main(int argc, char *argv[]) {
 
                 umask(0022);
 
 
                 umask(0022);
 

+                loopback_setup();
+

                 if (drop_capabilities() < 0)
                         goto child_fail;
 
                 if (drop_capabilities() < 0)
                         goto child_fail;