From 8c5c30d17541749b3d271ee06fbe08c5d32b07ed Mon Sep 17 00:00:00 2001 From: Maximilian Blenk Date: Tue, 24 Aug 2021 09:55:14 +0200 Subject: [PATCH] tools: fix elevated privilege handler in lxc-attach Make sure to return an error when the user requests an LSM profile to be set while also requesting that elevated LSM privileges are to be used. Signed-off-by: Maximilian Blenk Signed-off-by: Christian Brauner --- src/lxc/tools/lxc_attach.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/lxc/tools/lxc_attach.c b/src/lxc/tools/lxc_attach.c index e06500884..0374d980b 100644 --- a/src/lxc/tools/lxc_attach.c +++ b/src/lxc/tools/lxc_attach.c @@ -334,8 +334,23 @@ int main(int argc, char *argv[]) if (remount_sys_proc) attach_options.attach_flags |= LXC_ATTACH_REMOUNT_PROC_SYS; - if (elevated_privileges) + if (elevated_privileges) { + if ((elevated_privileges & LXC_ATTACH_LSM_EXEC)) { + if (selinux_context) { + ERROR("Cannot combine elevated LSM privileges while requesting LSM profile"); + goto out; + } + + /* + * While most LSM flags are off by default let's still + * make sure they are stripped when elevated LSM + * privileges are requested. + */ + elevated_privileges |= LXC_ATTACH_LSM; + } + attach_options.attach_flags &= ~(elevated_privileges); + } if (stdfd_is_pty()) attach_options.attach_flags |= LXC_ATTACH_TERMINAL; -- 2.47.2