Hi John,
2016-05-30 9:33 GMT+02:00 John Crispin <j...@phrozen.org>:
>
>
> Hi Etienne,
>
> why dont we want to do that ?
If you modify the hostname of the router you might want to propagate
it into the jail, it depends
Please don't merge this patch, i will improve it a bit:
no -h => no CLONE_NEWUTS
-h => CLONE_NEWUTS
-h <newhostname> => CLONE_NEWUTS + sethostname()
CLONE_NEWUTS is not a security feature,
sethostname() require CAP_SYS_ADMIN which allow you to escape jail
(mknod + mount for exemple)
Etienne
>
> John
>
>
> On 30/05/2016 01:39, Etienne CHAMPETIER wrote:
>> Signed-off-by: Etienne CHAMPETIER <champetier.etie...@gmail.com>
>> ---
>> jail/jail.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/jail/jail.c b/jail/jail.c
>> index e425254..926e42c 100644
>> --- a/jail/jail.c
>> +++ b/jail/jail.c
>> @@ -386,9 +386,10 @@ int main(int argc, char **argv)
>>
>> uloop_init();
>> if (opts.namespace) {
>> - jail_process.pid = clone(exec_jail,
>> - child_stack + STACK_SIZE,
>> - CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS |
>> CLONE_NEWIPC | SIGCHLD, NULL);
>> + int flags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC |
>> SIGCHLD;
>> + if (opts.hostname)
>> + flags |= CLONE_NEWUTS;
>> + jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE,
>> flags, NULL);
>> } else {
>> jail_process.pid = fork();
>> }
>>
_______________________________________________
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev
