From 4019833d46154abb1b99f0b716b40dc80e7b6b25 Mon Sep 17 00:00:00 2001 From: Tobias Klauser Date: Thu, 13 Jul 2017 15:29:10 +0200 Subject: [PATCH] libcontainer: use PR_SET_NO_NEW_PRIVS from x/sys/unix Use PR_SET_NO_NEW_PRIVS defined in golang.org/x/sys/unix instead of manually defining it. Signed-off-by: Tobias Klauser --- libcontainer/setns_init_linux.go | 2 +- libcontainer/standard_init_linux.go | 6 +----- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go index 7ceed2bc..35b84219 100644 --- a/libcontainer/setns_init_linux.go +++ b/libcontainer/setns_init_linux.go @@ -43,7 +43,7 @@ func (l *linuxSetnsInit) Init() error { } } if l.config.NoNewPrivileges { - if err := unix.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { + if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { return err } } diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go index a0376035..580b3fe4 100644 --- a/libcontainer/standard_init_linux.go +++ b/libcontainer/standard_init_linux.go @@ -42,10 +42,6 @@ func (l *linuxStandardInit) getSessionRingParams() (string, uint32, uint32) { return fmt.Sprintf("_ses.%s", l.config.ContainerId), 0xffffffff, newperms } -// PR_SET_NO_NEW_PRIVS isn't exposed in Golang so we define it ourselves copying the value -// the kernel -const PR_SET_NO_NEW_PRIVS = 0x26 - func (l *linuxStandardInit) Init() error { if !l.config.Config.NoNewKeyring { ringname, keepperms, newperms := l.getSessionRingParams() @@ -128,7 +124,7 @@ func (l *linuxStandardInit) Init() error { return err } if l.config.NoNewPrivileges { - if err := unix.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { + if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { return err } }