virt: use read_virtual_file() for reading /proc/self/setgroups
This commit is contained in:
+7
-8
@@ -836,19 +836,18 @@ int running_in_userns(void) {
|
||||
if (r != 0)
|
||||
return r;
|
||||
|
||||
/* "setgroups" file was added in kernel v3.18-rc6-15-g9cc46516dd. It is also
|
||||
* possible to compile a kernel without CONFIG_USER_NS, in which case "setgroups"
|
||||
* also does not exist. We cannot distinguish those two cases, so assume that
|
||||
* we're running on a stripped-down recent kernel, rather than on an old one,
|
||||
* and if the file is not found, return false.
|
||||
*/
|
||||
r = read_one_line_file("/proc/self/setgroups", &line);
|
||||
/* "setgroups" file was added in kernel v3.18-rc6-15-g9cc46516dd. It is also possible to compile a
|
||||
* kernel without CONFIG_USER_NS, in which case "setgroups" also does not exist. We cannot
|
||||
* distinguish those two cases, so assume that we're running on a stripped-down recent kernel, rather
|
||||
* than on an old one, and if the file is not found, return false. */
|
||||
r = read_virtual_file("/proc/self/setgroups", SIZE_MAX, &line, NULL);
|
||||
if (r < 0) {
|
||||
log_debug_errno(r, "/proc/self/setgroups: %m");
|
||||
return r == -ENOENT ? false : r;
|
||||
}
|
||||
|
||||
truncate_nl(line);
|
||||
strstrip(line); /* remove trailing newline */
|
||||
|
||||
r = streq(line, "deny");
|
||||
/* See user_namespaces(7) for a description of this "setgroups" contents. */
|
||||
log_debug("/proc/self/setgroups contains \"%s\", %s user namespace", line, r ? "in" : "not in");
|
||||
|
||||
Reference in New Issue
Block a user