diff options
author | Lennart Poettering <lennart@poettering.net> | 2022-03-31 13:28:18 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2022-03-31 16:34:41 +0200 |
commit | 16fa47463ca549e4ab776026d0a4f7e37d4fd7f7 (patch) | |
tree | 27bbde61a9aff03222aeb1f280f0a072228e7dbe /src/basic/virt.c | |
parent | b2a331f2e0bfde290214c02e3c96f1599c715bfc (diff) | |
download | systemd-16fa47463ca549e4ab776026d0a4f7e37d4fd7f7.tar.gz |
virt: use read_virtual_file() for reading /proc/self/setgroups
Diffstat (limited to 'src/basic/virt.c')
-rw-r--r-- | src/basic/virt.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/src/basic/virt.c b/src/basic/virt.c index 3c210f6ab3..8cea4367a0 100644 --- a/src/basic/virt.c +++ b/src/basic/virt.c @@ -836,19 +836,18 @@ int running_in_userns(void) { if (r != 0) return r; - /* "setgroups" file was added in kernel v3.18-rc6-15-g9cc46516dd. It is also - * possible to compile a kernel without CONFIG_USER_NS, in which case "setgroups" - * also does not exist. We cannot distinguish those two cases, so assume that - * we're running on a stripped-down recent kernel, rather than on an old one, - * and if the file is not found, return false. - */ - r = read_one_line_file("/proc/self/setgroups", &line); + /* "setgroups" file was added in kernel v3.18-rc6-15-g9cc46516dd. It is also possible to compile a + * kernel without CONFIG_USER_NS, in which case "setgroups" also does not exist. We cannot + * distinguish those two cases, so assume that we're running on a stripped-down recent kernel, rather + * than on an old one, and if the file is not found, return false. */ + r = read_virtual_file("/proc/self/setgroups", SIZE_MAX, &line, NULL); if (r < 0) { log_debug_errno(r, "/proc/self/setgroups: %m"); return r == -ENOENT ? false : r; } - truncate_nl(line); + strstrip(line); /* remove trailing newline */ + r = streq(line, "deny"); /* See user_namespaces(7) for a description of this "setgroups" contents. */ log_debug("/proc/self/setgroups contains \"%s\", %s user namespace", line, r ? "in" : "not in"); |