nspawn: provide $container and $container_uuid in /run/host too

This has the major benefit that the entire payload of the container can
access these files there. Previously, we'd set them only as env vars,
but that meant only PID 1 could read them directly or other privileged
payload code with access to /run/1/environ.
This commit is contained in:
Lennart Poettering
2020-08-20 10:17:55 +02:00
parent 9fac502920
commit 0f48ba7b84
2 changed files with 18 additions and 0 deletions
+10
View File
@@ -491,6 +491,16 @@ int detect_container(void) {
}
}
/* The container manager might have placed this in the /run/host hierarchy for us, which is best
* because we can be consumed just like that, without special privileges. */
r = read_one_line_file("/run/host/container-manager", &m);
if (r > 0) {
e = m;
goto translate_name;
}
if (!IN_SET(r, -ENOENT, 0))
return log_debug_errno(r, "Failed to read /run/systemd/container: %m");
if (getpid_cached() == 1) {
/* If we are PID 1 we can just check our own environment variable, and that's authoritative.
* We distinguish three cases: