1316dc9e2d
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael) Upstream-commit: d31ae5aed80eeb40a461930776ad2b507804bf4e Component: engine
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
// +build amd64
|
|
|
|
package lxc
|
|
|
|
import (
|
|
"fmt"
|
|
"syscall"
|
|
|
|
"github.com/docker/libcontainer/namespaces"
|
|
"github.com/docker/libcontainer/security/capabilities"
|
|
"github.com/dotcloud/docker/daemon/execdriver"
|
|
"github.com/dotcloud/docker/daemon/execdriver/native/template"
|
|
"github.com/dotcloud/docker/pkg/system"
|
|
)
|
|
|
|
func setHostname(hostname string) error {
|
|
return syscall.Sethostname([]byte(hostname))
|
|
}
|
|
|
|
func finalizeNamespace(args *execdriver.InitArgs) error {
|
|
// We use the native drivers default template so that things like caps are consistent
|
|
// across both drivers
|
|
container := template.New()
|
|
|
|
if !args.Privileged {
|
|
// drop capabilities in bounding set before changing user
|
|
if err := capabilities.DropBoundingSet(container); err != nil {
|
|
return fmt.Errorf("drop bounding set %s", err)
|
|
}
|
|
|
|
// preserve existing capabilities while we change users
|
|
if err := system.SetKeepCaps(); err != nil {
|
|
return fmt.Errorf("set keep caps %s", err)
|
|
}
|
|
}
|
|
|
|
if err := namespaces.SetupUser(args.User); err != nil {
|
|
return fmt.Errorf("setup user %s", err)
|
|
}
|
|
|
|
if !args.Privileged {
|
|
if err := system.ClearKeepCaps(); err != nil {
|
|
return fmt.Errorf("clear keep caps %s", err)
|
|
}
|
|
|
|
// drop all other capabilities
|
|
if err := capabilities.DropCapabilities(container); err != nil {
|
|
return fmt.Errorf("drop capabilities %s", err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|