From c3f82c64d86432c7d4b0c3abf61b70fd88f1d9dd Mon Sep 17 00:00:00 2001

From: Lennart Poettering <lennart@poettering.net>

Date: Wed, 20 Nov 2013 22:10:42 +0100

Subject: [PATCH] nspawn: add new --drop-capability= switch

---

 man/systemd-nspawn.xml | 10 ++++++++++

 src/nspawn/nspawn.c    | 12 ++++++++++--

 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml

index ba9e516..c1a5cad 100644

--- a/man/systemd-nspawn.xml

+++ b/man/systemd-nspawn.xml

@@ -304,6 +304,16 @@

                         </varlistentry>

                         <varlistentry>

+                                <term><option>--drop-capability=</option></term>

+

+                                <listitem><para>Specify one or more

+                                additional capabilities to drop for

+                                the container. This allows running the

+                                container with fewer capabilities than

+                                the default (see above).</para></listitem>

+                        </varlistentry>

+

+                        <varlistentry>

                                 <term><option>--link-journal=</option></term>

                                 <listitem><para>Control whether the

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c

index 85bbadf..7346253 100644

--- a/src/nspawn/nspawn.c

+++ b/src/nspawn/nspawn.c

@@ -130,6 +130,7 @@ static int help(void) {

                "     --read-only           Mount the root directory read-only\n"

                "     --capability=CAP      In addition to the default, retain specified\n"

                "                           capability\n"

+               "     --drop-capability=CAP Drop the specified capability from the default set\n"

                "     --link-journal=MODE   Link up guest journal, one of no, auto, guest, host\n"

                "  -j                       Equivalent to --link-journal=host\n"

                "     --bind=PATH[:PATH]    Bind mount a file or directory from the host into\n"

@@ -148,6 +149,7 @@ static int parse_argv(int argc, char *argv[]) {

                 ARG_UUID,

                 ARG_READ_ONLY,

                 ARG_CAPABILITY,

+                ARG_DROP_CAPABILITY,

                 ARG_LINK_JOURNAL,

                 ARG_BIND,

                 ARG_BIND_RO

@@ -163,6 +165,7 @@ static int parse_argv(int argc, char *argv[]) {

                 { "uuid",            required_argument, NULL, ARG_UUID            },

                 { "read-only",       no_argument,       NULL, ARG_READ_ONLY       },

                 { "capability",      required_argument, NULL, ARG_CAPABILITY      },

+                { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },

                 { "link-journal",    required_argument, NULL, ARG_LINK_JOURNAL    },

                 { "bind",            required_argument, NULL, ARG_BIND            },

                 { "bind-ro",         required_argument, NULL, ARG_BIND_RO         },

@@ -247,7 +250,8 @@ static int parse_argv(int argc, char *argv[]) {

                         arg_read_only = true;

                         break;

-                case ARG_CAPABILITY: {

+                case ARG_CAPABILITY:

+                case ARG_DROP_CAPABILITY: {

                         char *state, *word;

                         size_t length;

@@ -266,7 +270,11 @@ static int parse_argv(int argc, char *argv[]) {

                                 }

                                 free(t);

-                                arg_retain |= 1ULL << (uint64_t) cap;

+

+                                if (c == ARG_CAPABILITY)

+                                        arg_retain |= 1ULL << (uint64_t) cap;

+                                else

+                                        arg_retain &= ~(1ULL << (uint64_t) cap);

                         }

                         break;