Update the openvswitch bridge attach code

1. don't determine ovs-vsctl path at configure time, do it at runtime

2. lxc-user-nic: set a sane path to protect from unpriv users

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

diff --git a/configure.ac b/configure.ac
index a67a8506c4b5fe21e6265383e79e4a1961388be0..1a55521cec426c4c7f3dc09346ba8b3ed1338780 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -204,16 +204,6 @@ fi
 
 AM_CONDITIONAL([ENABLE_API_DOCS], [test "x$HAVE_DOXYGEN" != "x"])
 
-# Openvswitch
-AC_PATH_PROG([OVS_CTL_PATH],[ovs-vsctl])
-if test "x$OVS_CTL_PATH" != "x"; then
-       enable_ovs="yes"
-       AS_AC_EXPAND(OVS_CTL_PATH, "$OVS_CTL_PATH")
-else
-       enable_ovs="no"
-fi
-AM_CONDITIONAL([HAVE_OVS], [test "x$enable_ovs" = "xyes"])
-
 # Apparmor
 AC_ARG_ENABLE([apparmor],
        [AC_HELP_STRING([--enable-apparmor], [enable apparmor support [default=auto]])],
@@ -782,7 +772,6 @@ Environment:
  - rpath: $enable_rpath
  - GnuTLS: $enable_gnutls
  - Bash integration: $enable_bash
- - Openvswitch: $enable_ovs
 
 Security features:
  - Apparmor: $enable_apparmor

diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index f7bc31a9044a089e2b5322edc0037b912ed6184f..c1a67d64da1bf8b1e7dcb8508c20b6237a3ec37f 100644 (file)
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -129,10 +129,6 @@ if ENABLE_APPARMOR
 AM_CFLAGS += -DHAVE_APPARMOR
 endif
 
-if HAVE_OVS
-AM_CFLAGS += -DHAVE_OVS -DOVS_CTL_PATH=\"$(OVS_CTL_PATH)\"
-endif
-
 if ENABLE_CGMANAGER
 AM_CFLAGS += -DHAVE_CGMANAGER
 endif

diff --git a/src/lxc/lxc_user_nic.c b/src/lxc/lxc_user_nic.c
index 5a1f6dbd999059a6e919fb4a2095ad6f0d2b7fce..145a35df666ad058ab783dd06aa598e2625d705d 100644 (file)
--- a/src/lxc/lxc_user_nic.c
+++ b/src/lxc/lxc_user_nic.c
@@ -590,6 +590,11 @@ int main(int argc, char *argv[])
        char *vethname = NULL;
        int pid;
 
+       /* set a sane path, because we are setuid-root */
+       if (setenv("PATH", "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", 1) < 0) {
+               fprintf(stderr, "Failed to set PATH, exiting\n");
+               exit(1);
+       }
        if ((me = get_username()) == NULL) {
                fprintf(stderr, "Failed to get username\n");
                exit(1);

diff --git a/src/lxc/network.c b/src/lxc/network.c
index dfab1590f774fd4aa2eebc2ddc6e719546650d5c..32edfc49b5026bf13d0c09b5d6bad9a087daa766 100644 (file)
--- a/src/lxc/network.c
+++ b/src/lxc/network.c
@@ -1171,7 +1171,6 @@ int lxc_ipv6_dest_add(int ifindex, struct in6_addr *dest)
        return ip_route_dest_add(AF_INET6, ifindex, dest);
 }
 
-#ifdef HAVE_OVS
 static bool is_ovs_bridge(const char *bridge)
 {
        char brdirname[22 + IFNAMSIZ + 1] = {0};
@@ -1186,7 +1185,12 @@ static bool is_ovs_bridge(const char *bridge)
 static int attach_to_ovs_bridge(const char *bridge, const char *nic)
 {
        pid_t pid;
-       const char *progname;
+       char *cmd;
+
+       cmd = on_path("ovs-vsctl", NULL);
+       if (!cmd)
+               return -1;
+       free(cmd);
 
        pid = fork();
        if (pid < 0)
@@ -1194,21 +1198,11 @@ static int attach_to_ovs_bridge(const char *bridge, const char *nic)
        if (pid > 0)
                return wait_for_pid(pid);
 
-       progname = strrchr(OVS_CTL_PATH, '/');
-       if (!progname) // not sane, should we just fail?
-               progname = OVS_CTL_PATH;
-       if (execl(OVS_CTL_PATH, progname, "add-port", bridge, nic, NULL))
+       if (execlp("ovs-vsctl", "ovs-vsctl", "add-port", bridge, nic, NULL))
                exit(1);
        // not reached
        exit(1);
 }
-#else
-static inline bool is_ovs_bridge(const char *bridge) { return false; }
-static inline int attach_to_ovs_bridge(const char *bridge, const char *nic)
-{
-       return -1;
-}
-#endif
 
 /*
  * There is a lxc_bridge_attach, but no need of a bridge detach