<html><head></head><body>Yes I started using smack after digging trough this article :)<br>
As for capabilities I usually start from the most restrictive, removing one by one until I want the container to work as expected.<br>
<br>
Regards,<br>
Olivier<br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.<br><br><div class="gmail_quote">"Michael H. Warfield" <mhw@WittsEnd.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif">On Sun, 2011-07-31 at 23:02 +0200, Olivier Mauras wrote: <br />> That's where MAC system comes handy.<br /><br />Was just reading up on that from your earlier post. Very nice. I see I<br />have some reading a research to do. I posted a URL to an IBM paper in a<br />reply to your earlier post.<br /><br />> -- <br />> Sent from my Android phone with K-9 Mail. Please excuse my brevity.<br />> <br />> "Michael H. Warfield" <mhw@WittsEnd.com> wrote:<br />> <br />> On Sun, 2011-07-31 at 17:59 +0200, Robert Kawecki wrote: <br />> > Dnia 2011-07-30, sob o godzinie 21:10 -0400, Matthew Franz pisze:<br />> > > Had seen some previous discussions before, but are there any ways to<br />> > > mitigate this design vulnerability?<br />> > > <br />> > > <a href="http://blog.bofh.it/debian/id_413">http://blog.bofh.it/debian/id_413</a><br />> >
> <br />> > > Are there any workarounds?<br />> > > <br />> > > Thanks,<br />> > > <br />> > > - mdf<br />> > > <br />> > <br />> > The blog post explicitly mounts /sys... Why would you want your<br />> > container to even have the capability to mount anything?<br />> <br />> Let's see... Where shall we start. If you're containerizing a<br />> "machine" or full system there's a laundry list of reasons you would<br />> want to. Maybe you want to mount an image, like a CD image or maybe an<br />> encrypted file system? Then, there's a variety of fuse file systems you<br />> might want access to for a variety of reasons.<br />> <br />> Maybe you want to run a service, like bind's named in a bind mounted<br />> chrooted environment (default for running name servers on Fedora for<br />> some time now:<br />> <br />> /var/named on /var/named/chroot/var/named type none
(rw,bind)<br />> /var/named/etc/named.conf on /var/named/chroot/etc/named.conf type none (rw,bind)<br />> /etc/named.rfc1912.zones on /var/named/chroot/etc/named.rfc1912.zones type none (rw,bind)<br />> /etc/rndc.conf on /var/named/chroot/etc/rndc.conf type none (rw,bind)<br />> /etc/rndc.key on /var/named/chroot/etc/rndc.key type none (rw,bind)<br />> /usr/lib/bind on /var/named/chroot/usr/lib/bind type none (rw,bind)<br />> /etc/named.iscdlv.key on /var/named/chroot/etc/named.iscdlv.key type none (rw,bind)<br />> /etc/named.root.key on /var/named/chroot/etc/named.root.key type none (rw,bind)<br />> <br />> That gets done by "service named start".<br />> <br />> > If possible, drop CAP_SYS_ADMIN.<br />> <br />> That's been proposed as a workaround for some of the remount problems we<br />> have to where a partition is suppose to be mounted ro but the container<br />> can remount it rw. I've actually tried that trick. Yeah, that was
an<br />> epic failure.<br />> <br />> Generally not possible in a generalized system container. Way too many<br />> things are impacted by CAP_SYS_ADMIN. Disabling that, you can't even<br />> set your own hostname in the container. You can't set crypto keys<br />> either. That's a sledge hammer approach that won't work in many if not<br />> most system containers. A simply application container? It might work<br />> in, depending on the application.<br />> <br />> Check out "man capabilities" and scroll down to CAP_SYS_ADMIN and look<br />> at that laundry list under it (and I'm not totally sure that list is<br />> comprehensive in the man page either) and honestly say there are not<br />> reasons for a container wanting to do at least one or two of them (even<br />> given that every container I have sets its own hostname).<br />> <br />> Gotta be a better answer than that.<br />> <br />> Regards,<br />> Mike<br />> -- <br
/>> Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw@WittsEnd.com<br />> /\/\|=mhw=|\/\/ | (678) 463-0932 | <a href="http://www.wittsend.com/mhw">http://www.wittsend.com/mhw</a>/<br />> NIC whois: MHW9 | An optimist believes we live in the best of all<br />> PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!<br />><hr /><br />> <br />> Got Input? Slashdot Needs You.<br />> Take our quick survey online. Come on, we don't ask for help often.<br />> Plus, you'll get a chance to win $100 to spend on ThinkGeek.<br />> <a href="http://p.sf.net/sfu/slashdot-survey">http://p.sf.net/sfu/slashdot-survey</a><hr /><br />> <br />> Lxc-users mailing list<br />> Lxc-users@lists.sourceforge.net<br />> <a href="https://lists.sourceforge.net/lists/listinfo/lxc-users">https://lists.sourceforge.net/lists/listinfo/lxc-users</a><br />> <br />> <br />><hr /><br />> Got Input? Slashdot Needs You.<br />> Take our quick survey
online. Come on, we don't ask for help often.<br />> Plus, you'll get a chance to win $100 to spend on ThinkGeek.<br />> <a href="http://p.sf.net/sfu/slashdot-survey">http://p.sf.net/sfu/slashdot-survey</a><br />><hr />Lxc-users mailing list Lxc-users@lists.sourceforge.net <a href="https://lists.sourceforge.net/lists/listinfo/lxc-users">https://lists.sourceforge.net/lists/listinfo/lxc-users</a><br /><br />-- <br />Michael H. Warfield (AI4NB) | (770) 985-6132 | mhw@WittsEnd.com<br /> /\/\|=mhw=|\/\/ | (678) 463-0932 | <a href="http://www.wittsend.com/mhw">http://www.wittsend.com/mhw</a>/<br /> NIC whois: MHW9 | An optimist believes we live in the best of all<br /> PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!<br /></pre></blockquote></div></body></html>