public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
From: David Gibson <david@gibson.dropbear.id.au>
To: Stefano Brivio <sbrivio@redhat.com>
Cc: passt-dev@passt.top
Subject: Re: [PATCH 10/14] nstool: Add --keep-caps option to nstool exec
Date: Thu, 6 Apr 2023 11:11:02 +1000	[thread overview]
Message-ID: <ZC4cJniTtkF8BpZ/@yekko> (raw)
In-Reply-To: <20230405135903.24139711@elisabeth>

[-- Attachment #1: Type: text/plain, Size: 2882 bytes --]

On Wed, Apr 05, 2023 at 01:59:02PM +0200, Stefano Brivio wrote:
> On Tue,  4 Apr 2023 11:46:34 +1000
> David Gibson <david@gibson.dropbear.id.au> wrote:
> 
> > This allows you to run commands within a user namespace with the
> > privilege that comes from owning that userns.
> > 
> > Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> > ---
> >  test/nstool.c | 89 +++++++++++++++++++++++++++++++++++++++++++++------
> >  1 file changed, 79 insertions(+), 10 deletions(-)
> > 
> > diff --git a/test/nstool.c b/test/nstool.c
> > index 25079aa..3ecc456 100644
> > --- a/test/nstool.c
> > +++ b/test/nstool.c
> > @@ -18,11 +18,15 @@
> >  #include <getopt.h>
> >  #include <stdarg.h>
> >  #include <fcntl.h>
> > +#include <limits.h>
> > +#include <unistd.h>
> >  #include <sys/socket.h>
> >  #include <sys/wait.h>
> > +#include <sys/syscall.h>
> > +#include <sys/prctl.h>
> >  #include <linux/un.h>
> > -#include <linux/limits.h>
> >  #include <sched.h>
> > +#include <linux/capability.h>
> >  
> >  #define	ARRAY_SIZE(a)	((int)(sizeof(a) / sizeof((a)[0])))
> >  
> > @@ -75,11 +79,13 @@ static void usage(void)
> >  	    "  nstool info [-pw] pid SOCK\n"
> >  	    "    Print information about the nstool hold process with control\n"
> >  	    "    socket at SOCK\n"
> > -	    "      -p    Print just the holder's PID as seen by the caller\n"
> > -	    "      -w    Retry connecting to SOCK until it is ready\n"
> > -	    "  nstool exec SOCK [COMMAND [ARGS...]]\n"
> > +	    "      -p          Print just the holder's PID as seen by the caller\n"
> > +	    "      -w          Retry connecting to SOCK until it is ready\n"
> > +	    "  nstool exec [--keep-caps] SOCK [COMMAND [ARGS...]]\n"
> >  	    "    Execute command or shell in the namespaces of the nstool hold\n"
> >  	    "    with control socket at SOCK\n"
> > +	    "      --keep-caps Give all possible capabilities to COMMAND via\n"
> > +	    "                  the ambient capability mask\n"
> >  	    "  nstool stop SOCK\n"
> >  	    "    Instruct the nstool hold with control socket at SOCK to\n"
> >  	    "    terminate.\n");
> > @@ -275,7 +281,6 @@ static void cmd_info(int argc, char *argv[])
> >  	} while (opt != -1);
> >  
> >  	if (optind != argc - 1) {
> > -		fprintf(stderr, "B\n");
> >  		usage();
> >  	}
> >  
> > @@ -356,21 +361,82 @@ static void wait_for_child(pid_t pid)
> >  	die("Unexpected status for child %d\n", pid);
> >  }
> >  
> > +static void caps_to_ambient(void)
> > +{
> > +        /* Use raw system calls to avoid the overly complex caps
> > +	 * libraries. */
> 
> Bad indentation here.

More pasted spaces.  Fixing.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

  reply	other threads:[~2023-04-06  2:50 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-04-04  1:46 [PATCH 00/14] Improved tool for testing across multiple namespaces David Gibson
2023-04-04  1:46 ` [PATCH 01/14] nstool: Rename nsholder to nstool David Gibson
2023-04-04  1:46 ` [PATCH 02/14] nstool: Reverse parameters " David Gibson
2023-04-04  1:46 ` [PATCH 03/14] nstool: Move description of its operation modes from comment to usage David Gibson
2023-04-05 11:56   ` Stefano Brivio
2023-04-06  0:10     ` David Gibson
2023-04-04  1:46 ` [PATCH 04/14] nstool: Split some command line parsing and socket setup to subcommands David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  2:31     ` David Gibson
2023-04-06  6:47       ` Stefano Brivio
2023-04-06 10:35         ` David Gibson
2023-04-04  1:46 ` [PATCH 05/14] nstool: Replace "pid" subcommand with "info" subcommand David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  0:13     ` David Gibson
2023-04-04  1:46 ` [PATCH 06/14] nstool: Detect what namespaces target is in David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  0:15     ` David Gibson
2023-04-04  1:46 ` [PATCH 07/14] nstool: Add magic number to advertized information David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  0:18     ` David Gibson
2023-04-04  1:46 ` [PATCH 08/14] nstool: Helpers to iterate through namespace types David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  0:55     ` David Gibson
2023-04-04  1:46 ` [PATCH 09/14] nstool: Add nstool exec command to execute commands in an nstool namespace David Gibson
2023-04-05 11:58   ` Stefano Brivio
2023-04-06  0:59     ` David Gibson
2023-04-04  1:46 ` [PATCH 10/14] nstool: Add --keep-caps option to nstool exec David Gibson
2023-04-05 11:59   ` Stefano Brivio
2023-04-06  1:11     ` David Gibson [this message]
2023-04-04  1:46 ` [PATCH 11/14] test: Initialise ${TRACE} properly David Gibson
2023-04-04  1:46 ` [PATCH 12/14] test: Use "nstool exec" to slightly simplify tests David Gibson
2023-04-05 11:59   ` Stefano Brivio
2023-04-06  1:14     ` David Gibson
2023-04-04  1:46 ` [PATCH 13/14] nstool: Advertise the holder's cwd (in its mountns) across the socket David Gibson
2023-04-04  1:46 ` [PATCH 14/14] nstool: Enter holder's cwd when changing mount ns with nstool exec David Gibson
2023-04-05 12:01 ` [PATCH 00/14] Improved tool for testing across multiple namespaces Stefano Brivio

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZC4cJniTtkF8BpZ/@yekko \
    --to=david@gibson.dropbear.id.au \
    --cc=passt-dev@passt.top \
    --cc=sbrivio@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).