detect-virt: install with fs caps by default to allow unprivileged access

[elogind.git] / src / shared / virt.c

diff --git a/src/shared/virt.c b/src/shared/virt.c
index 4c526ff45471620616237ac3176ca594e7921bc5..fc62c72328e381341850d021dbd076fb6d5e73ee 100644 (file)
--- a/src/shared/virt.c
+++ b/src/shared/virt.c
@@ -6,16 +6,16 @@
   Copyright 2011 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  General Public License for more details.
+  Lesser General Public License for more details.
 
-  You should have received a copy of the GNU General Public License
+  You should have received a copy of the GNU Lesser General Public License
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
@@ -153,15 +153,16 @@ int detect_vm(const char **id) {
 }
 
 int detect_container(const char **id) {
-        FILE *f;
+        char *e = NULL;
+        int r;
 
         /* Unfortunately many of these operations require root access
          * in one way or another */
 
-        if (geteuid() != 0)
-                return -EPERM;
-
-        if (running_in_chroot() > 0) {
+        r = running_in_chroot();
+        if (r < 0)
+                return r;
+        if (r > 0) {
 
                 if (id)
                         *id = "chroot";
@@ -180,63 +181,29 @@ int detect_container(const char **id) {
                 return 1;
         }
 
-        f = fopen("/proc/1/environ", "re");
-        if (f) {
-                bool done = false;
-
-                do {
-                        char line[LINE_MAX];
-                        unsigned i;
-
-                        for (i = 0; i < sizeof(line)-1; i++) {
-                                int c;
-
-                                c = getc(f);
-                                if (_unlikely_(c == EOF)) {
-                                        done = true;
-                                        break;
-                                } else if (c == 0)
-                                        break;
-
-                                line[i] = c;
-                        }
-                        line[i] = 0;
-
-                        if (streq(line, "container=lxc")) {
-                                fclose(f);
-
-                                if (id)
-                                        *id = "lxc";
-                                return 1;
-
-                        } else if (streq(line, "container=lxc-libvirt")) {
-                                fclose(f);
-
-                                if (id)
-                                        *id = "lxc-libvirt";
-                                return 1;
-
-                        } else if (streq(line, "container=systemd-nspawn")) {
-                                fclose(f);
+        r = getenv_for_pid(1, "container", &e);
+        if (r <= 0)
+                return r;
 
-                                if (id)
-                                        *id = "systemd-nspawn";
-                                return 1;
-
-                        } else if (startswith(line, "container=")) {
-                                fclose(f);
-
-                                if (id)
-                                        *id = "other";
-                                return 1;
-                        }
-
-                } while (!done);
-
-                fclose(f);
+        /* We only recognize a selected few here, since we want to
+         * enforce a redacted namespace */
+        if (streq(e, "lxc")) {
+                if (id)
+                        *id = "lxc";
+        } else if (streq(e, "lxc-libvirt")) {
+                if (id)
+                        *id = "lxc-libvirt";
+        } else if (streq(e, "systemd-nspawn")) {
+                if (id)
+                        *id = "systemd-nspawn";
+        } else {
+                if (id)
+                        *id = "other";
         }
 
-        return 0;
+        free(e);
+
+        return r;
 }
 
 /* Returns a short identifier for the various VM/container implementations */