X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Flibsystemd-bus%2Fbus-container.c;h=d330363b6f89dad199be3103ee36991e113dfcd2;hp=9ad6e65c735801d44eef0f064645f0bcdb6a049c;hb=f98a58fe894d34e4d9675757180f34a8523c936e;hpb=a4475f577bd0daf762d6c3b4e58bc484e0cb74af

diff --git a/src/libsystemd-bus/bus-container.c b/src/libsystemd-bus/bus-container.c
index 9ad6e65c7..d330363b6 100644
--- a/src/libsystemd-bus/bus-container.c
+++ b/src/libsystemd-bus/bus-container.c
@@ -52,29 +52,51 @@ int bus_container_connect_socket(sd_bus *b) {
 
         b->output_fd = b->input_fd;
 
-        r = bus_socket_setup(b);
-        if (r < 0)
-                return r;
+        bus_socket_setup(b);
 
         child = fork();
         if (child < 0)
                 return -errno;
 
         if (child == 0) {
+                pid_t grandchild;
 
                 r = namespace_enter(pidnsfd, mntnsfd, rootfd);
                 if (r < 0)
                         _exit(255);
 
-                r = connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size);
-                if (r < 0) {
-                        if (errno == EINPROGRESS)
-                                _exit(1);
+                /* We just changed PID namespace, however it will only
+                 * take effect on the children we now fork. Hence,
+                 * let's fork another time, and connect from this
+                 * grandchild, so that SO_PEERCRED of our connection
+                 * comes from a process from within the container, and
+                 * not outside of it */
 
+                grandchild = fork();
+                if (grandchild < 0)
                         _exit(255);
+
+                if (grandchild == 0) {
+
+                        r = connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size);
+                        if (r < 0) {
+                                if (errno == EINPROGRESS)
+                                        _exit(1);
+
+                                _exit(255);
+                        }
+
+                        _exit(EXIT_SUCCESS);
                 }
 
-                _exit(EXIT_SUCCESS);
+                r = wait_for_terminate(grandchild, &si);
+                if (r < 0)
+                        _exit(255);
+
+                if (si.si_code != CLD_EXITED)
+                        _exit(255);
+
+                _exit(si.si_status);
         }
 
         r = wait_for_terminate(child, &si);
@@ -130,6 +152,8 @@ int bus_container_connect_kernel(sd_bus *b) {
                 return -errno;
 
         if (child == 0) {
+                pid_t grandchild;
+
                 close_nointr_nofail(pair[0]);
                 pair[0] = -1;
 
@@ -137,27 +161,60 @@ int bus_container_connect_kernel(sd_bus *b) {
                 if (r < 0)
                         _exit(EXIT_FAILURE);
 
-                fd = open(b->kernel, O_RDWR|O_NOCTTY|O_CLOEXEC);
-                if (fd < 0)
+                /* We just changed PID namespace, however it will only
+                 * take effect on the children we now fork. Hence,
+                 * let's fork another time, and connect from this
+                 * grandchild, so that kdbus only sees the credentials
+                 * of this process which comes from within the
+                 * container, and not outside of it */
+
+                grandchild = fork();
+                if (grandchild < 0)
                         _exit(EXIT_FAILURE);
 
-                cmsg = CMSG_FIRSTHDR(&mh);
-                cmsg->cmsg_level = SOL_SOCKET;
-                cmsg->cmsg_type = SCM_RIGHTS;
-                cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-                memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
+                if (grandchild == 0) {
+
+                        fd = open(b->kernel, O_RDWR|O_NOCTTY|O_CLOEXEC);
+                        if (fd < 0)
+                                _exit(EXIT_FAILURE);
+
+                        cmsg = CMSG_FIRSTHDR(&mh);
+                        cmsg->cmsg_level = SOL_SOCKET;
+                        cmsg->cmsg_type = SCM_RIGHTS;
+                        cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+                        memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
 
-                mh.msg_controllen = cmsg->cmsg_len;
+                        mh.msg_controllen = cmsg->cmsg_len;
+
+                        if (sendmsg(pair[1], &mh, MSG_NOSIGNAL) < 0)
+                                _exit(EXIT_FAILURE);
+
+                        _exit(EXIT_SUCCESS);
+                }
+
+                r = wait_for_terminate(grandchild, &si);
+                if (r < 0)
+                        _exit(EXIT_FAILURE);
 
-                if (sendmsg(pair[1], &mh, MSG_NOSIGNAL) < 0)
+                if (si.si_code != CLD_EXITED)
                         _exit(EXIT_FAILURE);
 
-                _exit(EXIT_SUCCESS);
+                _exit(si.si_status);
         }
 
         close_nointr_nofail(pair[1]);
         pair[1] = -1;
 
+        r = wait_for_terminate(child, &si);
+        if (r < 0)
+                return r;
+
+        if (si.si_code != CLD_EXITED)
+                return -EIO;
+
+        if (si.si_status != EXIT_SUCCESS)
+                return -EIO;
+
         if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
                 return -errno;
 
@@ -177,16 +234,6 @@ int bus_container_connect_kernel(sd_bus *b) {
                         fd = fds[0];
                 }
 
-        r = wait_for_terminate(child, &si);
-        if (r < 0)
-                return r;
-
-        if (si.si_code != CLD_EXITED)
-                return -EIO;
-
-        if (si.si_status != EXIT_SUCCESS)
-                return -EIO;
-
         b->input_fd = b->output_fd = fd;
         fd = -1;