[systemd-commits] 2 commits - configure.ac man/systemd-nspawn.xml src/core src/nspawn

[Lennart Poettering]

 configure.ac           |    2 +-
 man/systemd-nspawn.xml |   10 ++++++++++
 src/core/main.c        |   13 +++++++++++++
 src/nspawn/nspawn.c    |   12 ++++++++++--
 4 files changed, 34 insertions(+), 3 deletions(-)

New commits:
commit 54b434b1b5055f934230fe04fad35b01642b8488
Author: Lennart Poettering <lennart at poettering.net>
Date:   Wed Nov 20 22:11:10 2013 +0100

    valgrind: make running PID 1 in valgrind useful
    
    Since valgrind only generates useful output on exit() (rather than
    exec()) we need to explicitly exit when valgrind is detected.

diff --git a/configure.ac b/configure.ac
index bb196f5..7794541 100644
--- a/configure.ac
+++ b/configure.ac
@@ -838,7 +838,7 @@ AC_DEFINE_UNQUOTED(TELINIT, ["$TELINIT"], [Path to telinit])
 
 AC_SUBST(TELINIT)
 
-AC_CHECK_HEADERS_ONCE([valgrind/memcheck.h])
+AC_CHECK_HEADERS_ONCE([valgrind/memcheck.h valgrind/valgrind.h])
 
 # ------------------------------------------------------------------------------
 have_myhostname=no
diff --git a/src/core/main.c b/src/core/main.c
index f342cdd..4d4f6e8 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -32,6 +32,10 @@
 #include <sys/prctl.h>
 #include <sys/mount.h>
 
+#ifdef HAVE_VALGRIND_VALGRIND_H
+#include <valgrind/valgrind.h>
+#endif
+
 #include "sd-daemon.h"
 #include "sd-messages.h"
 #include "sd-bus.h"
@@ -1830,6 +1834,15 @@ finish:
         if (fds)
                 fdset_free(fds);
 
+#ifdef HAVE_VALGRIND_VALGRIND_H
+        /* If we are PID 1 and running under valgrind, then let's exit
+         * here explicitly. valgrind will only generate nice output on
+         * exit(), not on exec(), hence let's do the former not the
+         * latter here. */
+        if (getpid() == 1 && RUNNING_ON_VALGRIND)
+                return 0;
+#endif
+
         if (shutdown_verb) {
                 const char * command_line[] = {
                         SYSTEMD_SHUTDOWN_BINARY_PATH,

commit 420c7379fb96a188459690a634d0fede55721183
Author: Lennart Poettering <lennart at poettering.net>
Date:   Wed Nov 20 22:10:42 2013 +0100

    nspawn: add new --drop-capability= switch

diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 3707a5e..75d2e6d 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -304,6 +304,16 @@
                         </varlistentry>
 
                         <varlistentry>
+                                <term><option>--drop-capability=</option></term>
+
+                                <listitem><para>Specify one or more
+                                additional capabilities to drop for
+                                the container. This allows running the
+                                container with fewer capabilities than
+                                the default (see above).</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
                                 <term><option>--link-journal=</option></term>
 
                                 <listitem><para>Control whether the
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 2778cd8..81d1748 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -127,6 +127,7 @@ static int help(void) {
                "     --read-only           Mount the root directory read-only\n"
                "     --capability=CAP      In addition to the default, retain specified\n"
                "                           capability\n"
+               "     --drop-capability=CAP Drop the specified capability from the default set\n"
                "     --link-journal=MODE   Link up guest journal, one of no, auto, guest, host\n"
                "  -j                       Equivalent to --link-journal=host\n"
                "     --bind=PATH[:PATH]    Bind mount a file or directory from the host into\n"
@@ -145,6 +146,7 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_UUID,
                 ARG_READ_ONLY,
                 ARG_CAPABILITY,
+                ARG_DROP_CAPABILITY,
                 ARG_LINK_JOURNAL,
                 ARG_BIND,
                 ARG_BIND_RO
@@ -160,6 +162,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "uuid",            required_argument, NULL, ARG_UUID            },
                 { "read-only",       no_argument,       NULL, ARG_READ_ONLY       },
                 { "capability",      required_argument, NULL, ARG_CAPABILITY      },
+                { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
                 { "link-journal",    required_argument, NULL, ARG_LINK_JOURNAL    },
                 { "bind",            required_argument, NULL, ARG_BIND            },
                 { "bind-ro",         required_argument, NULL, ARG_BIND_RO         },
@@ -243,7 +246,8 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_read_only = true;
                         break;
 
-                case ARG_CAPABILITY: {
+                case ARG_CAPABILITY:
+                case ARG_DROP_CAPABILITY: {
                         char *state, *word;
                         size_t length;
 
@@ -262,7 +266,11 @@ static int parse_argv(int argc, char *argv[]) {
                                 }
 
                                 free(t);
-                                arg_retain |= 1ULL << (uint64_t) cap;
+
+                                if (c == ARG_CAPABILITY)
+                                        arg_retain |= 1ULL << (uint64_t) cap;
+                                else
+                                        arg_retain &= ~(1ULL << (uint64_t) cap);
                         }
 
                         break;