On 07/16/2013 04:23 AM, Eric Blake wrote:
> On 07/15/2013 03:59 AM, Daniel P. Berrange wrote:
>> On Mon, Jul 15, 2013 at 03:40:53PM +0800, Gao feng wrote:
>>> On 07/13/2013 01:35 AM, Eric Blake wrote:
>>>> Commit 75c1256 states that virGetGroupList must not be called
>>>> between fork and exec, then commit ee777e99 promptly violated
>>>> that for lxc. Hoist the group detection to occur before clone.
>>>>
>>>> * src/lxc/lxc_container.c (__lxc_child_argv): Add members.
>>>> (lxcContainerSetID): Adjust signature.
>>>> (lxcContainerChild, lxcContainerStart): Adjust callers.
>>>>
>>>> Signed-off-by: Eric Blake <eblake@xxxxxxxxxx>
>>>> ---
>
>>>> -
>>>> /* Only call virSetUIDGID when user namespace is enabled
>>>> * for this container. And user namespace is only enabled
>>>> * when nuidmap&ngidmap is not zero */
>>>>
>>>> VIR_DEBUG("Set UID/GID to 0/0");
>>>> - if (def->idmap.nuidmap &&
>>>> - ((ngroups = virGetGroupList(0, 0, &groups) < 0) ||
>>>
>
>> 'initgroups' will continually call setgroups() removing the last GID
>> from the list each time until it succeeds. This is somewhat dubious
>> behaviour IMHO, which again makes me think we should just not set any
>> supplementary groups in LXC
>
> Then it sounds like I need a v2 that calls virSetUIDGID(0, 0, NULL, 0),
> which forces the implementation to not set any supplementary groups.
>
Yeah, Please :)
Thanks
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list