attach, start: declare PR_{S,G}PR_GET_NO_NEW_PRIVS

Signed-off-by: Christian Brauner <christian.brauner@canonical.com>

diff --git a/configure.ac b/configure.ac
index 39e313addbb30f47a0ec2227ba12a8f37ae62442..dd2ad681c89482950f58ec4795613e5ad49eaeea 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -593,6 +593,10 @@ AM_CONDITIONAL([IS_BIONIC], [test "x$is_bionic" = "xyes"])
 # Some systems lack PR_CAPBSET_DROP definition => HAVE_DECL_PR_CAPBSET_DROP
 AC_CHECK_DECLS([PR_CAPBSET_DROP], [], [], [#include <sys/prctl.h>])
 
+# Some systems lack PR_{G,S}ET_NO_NEW_PRIVS definition => HAVE_DECL_PR_{G,S}ET_NO_NEW_PRIVS
+AC_CHECK_DECLS([PR_SET_NO_NEW_PRIVS], [], [], [#include <sys/prctl.h>])
+AC_CHECK_DECLS([PR_GET_NO_NEW_PRIVS], [], [], [#include <sys/prctl.h>])
+
 # Check for some headers
 AC_CHECK_HEADERS([sys/signalfd.h pty.h ifaddrs.h sys/capability.h sys/personality.h utmpx.h sys/timerfd.h])
 

diff --git a/src/lxc/attach.c b/src/lxc/attach.c
index ac39fa2239f440c4f98af250345c865bceba6cbd..c7414105044d981904a2a2f3812c7335d304faba 100644 (file)
--- a/src/lxc/attach.c
+++ b/src/lxc/attach.c
@@ -39,10 +39,18 @@
 #include <linux/unistd.h>
 #include <pwd.h>
 
-#if !HAVE_DECL_PR_CAPBSET_DROP
+#ifndef HAVE_DECL_PR_CAPBSET_DROP
 #define PR_CAPBSET_DROP 24
 #endif
 
+#ifndef HAVE_DECL_PR_SET_NO_NEW_PRIVS
+#define PR_SET_NO_NEW_PRIVS 38
+#endif
+
+#ifndef HAVE_DECL_PR_GET_NO_NEW_PRIVS
+#define PR_GET_NO_NEW_PRIVS 39
+#endif
+
 #include "namespace.h"
 #include "log.h"
 #include "attach.h"

diff --git a/src/lxc/start.c b/src/lxc/start.c
index bcc2e5ee99b91f7399348d40faf52a7410251aa4..ecc7b08f69d9a8357ce11a49304af6d8d06762ce 100644 (file)
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -50,10 +50,18 @@
 #include <sys/capability.h>
 #endif
 
-#if !HAVE_DECL_PR_CAPBSET_DROP
+#ifndef HAVE_DECL_PR_CAPBSET_DROP
 #define PR_CAPBSET_DROP 24
 #endif
 
+#ifndef HAVE_DECL_PR_SET_NO_NEW_PRIVS
+#define PR_SET_NO_NEW_PRIVS 38
+#endif
+
+#ifndef HAVE_DECL_PR_GET_NO_NEW_PRIVS
+#define PR_GET_NO_NEW_PRIVS 39
+#endif
+
 #include "af_unix.h"
 #include "bdev.h"
 #include "caps.h"