From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Thu, 23 Aug 2018 13:46:12 +0000 (+0200)
Subject: execute: skip lxc-init logging when unprivileged
X-Git-Tag: lxc-3.1.0~131^2
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2569%2Fhead;p=thirdparty%2Flxc.git

execute: skip lxc-init logging when unprivileged

Unprivileged app containers will not be able to open the passed in
/proc/1/fd/<idx> log path and will thus currently fail completely as soon as
any log level or log file is passed.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Reported-by: Mrinal Dhillon <mdhillon@juniper.net>
---

diff --git a/src/lxc/execute.c b/src/lxc/execute.c
index d01df6b2e..26b8fa864 100644
--- a/src/lxc/execute.c
+++ b/src/lxc/execute.c
@@ -43,6 +43,7 @@ static int execute_start(struct lxc_handler *handler, void* data)
 	int argc = 0, i = 0, logfd = -1;
 	struct execute_args *my_args = data;
 	char logfile[LXC_PROC_PID_FD_LEN];
+	bool is_privileged = lxc_list_empty(&handler->conf->id_map);
 
 	while (my_args->argv[argc++]);
 
@@ -54,11 +55,13 @@ static int execute_start(struct lxc_handler *handler, void* data)
 	if (!handler->conf->rootfs.path)
 		argc_add += 2;
 
-	if (lxc_log_has_valid_level())
-		argc_add += 2;
+	if (is_privileged) {
+		if (lxc_log_has_valid_level())
+			argc_add += 2;
 
-	if (current_config->logfd != -1 || lxc_log_fd != -1)
-		argc_add += 2;
+		if (current_config->logfd != -1 || lxc_log_fd != -1)
+			argc_add += 2;
+	}
 
 	argv = malloc((argc + argc_add) * sizeof(*argv));
 	if (!argv) {
@@ -79,7 +82,7 @@ static int execute_start(struct lxc_handler *handler, void* data)
 		argv[i++] = (char *)lxc_log_priority_to_string(lxc_log_get_level());
 	}
 
-	if (current_config->logfd != -1 || lxc_log_fd != -1) {
+	if (is_privileged && (current_config->logfd != -1 || lxc_log_fd != -1)) {
 		int ret;
 		int to_dup = current_config->logfd;