From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 22 Jan 2015 17:19:58 +0000 (+0100)
Subject: import: lock tar into its own private network namespace
X-Git-Tag: v219~347
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=7315edd36a144e746dbcc43cef2206441969ca34

import: lock tar into its own private network namespace

That way it cannot get access to the network
---

diff --git a/src/import/import-common.c b/src/import/import-common.c
index b490c435d..f4643133e 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -507,11 +507,12 @@ int import_fork_tar(const char *path, pid_t *ret) {
                 fd_cloexec(STDOUT_FILENO, false);
                 fd_cloexec(STDERR_FILENO, false);
 
+                if (unshare(CLONE_NEWNET) < 0)
+                        log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
+
                 r = capability_bounding_set_drop(~retain, true);
-                if (r < 0) {
-                        log_error_errno(errno, "Failed to drop capabilities, ignoring: %m");
-                        _exit(EXIT_FAILURE);
-                }
+                if (r < 0)
+                        log_error_errno(r, "Failed to drop capabilities, ignoring: %m");
 
                 execlp("tar", "tar", "--numeric-owner", "-C", path, "-px", NULL);
                 log_error_errno(errno, "Failed to execute tar: %m");