From 158d119f90ab10ba0b2e38f72254658cc4c90f00 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Wed, 20 May 2020 12:14:21 +0200 Subject: [PATCH] lxc-usernsexec: don't fail on setgroups() We can fail to setgroups() when "deny" has been set which we need to set when we are a fully unprivileged user. Closes: 3420. Signed-off-by: Christian Brauner --- src/lxc/cmd/lxc_usernsexec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lxc/cmd/lxc_usernsexec.c b/src/lxc/cmd/lxc_usernsexec.c index 79dfe42c9..3c22482f4 100644 --- a/src/lxc/cmd/lxc_usernsexec.c +++ b/src/lxc/cmd/lxc_usernsexec.c @@ -87,11 +87,11 @@ static int do_child(void *vargv) int ret; char **argv = (char **)vargv; - /* Assume we want to become root */ - if (!lxc_switch_uid_gid(0, 0)) + if (!lxc_setgroups(0, NULL)) return -1; - if (!lxc_setgroups(0, NULL)) + /* Assume we want to become root */ + if (!lxc_switch_uid_gid(0, 0)) return -1; ret = unshare(CLONE_NEWNS); -- 2.47.2