[lxc-devel] [PATCH] oracle template: drop additional capabilities

[Dwight Engen]

Signed-off-by: Dwight Engen <dwight.engen at oracle.com>
---
 templates/lxc-oracle.in | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index 3242dc4..6a64a33 100644
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -292,10 +292,32 @@ lxc.tty = 4
 lxc.pts = 1024
 lxc.rootfs = $container_rootfs
 lxc.mount = $cfg_dir/fstab
-lxc.cap.drop = sys_rawio
-# Networking
+# Uncomment these if you don't run anything that needs the capability, and   
+# would like the container to run with less privilege.
+#
+# Dropping sys_admin disables container root from doing a lot of things   
+# that could be bad like re-mounting lxc fstab entries rw for example,    
+# but also disables some useful things like being able to nfs mount, and    
+# things that are already namespaced with ns_capable() kernel checks, like  
+# hostname(1).  
+# lxc.cap.drop = sys_admin
+# lxc.cap.drop = net_raw          # breaks dhcp/ping
+# lxc.cap.drop = setgid           # breaks login (initgroups/setgroups)
+# lxc.cap.drop = dac_read_search  # breaks login (pam unix_chkpwd)
+# lxc.cap.drop = setuid           # breaks sshd,nfs statd
+# lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
+# lxc.cap.drop = audit_write
+#
+lxc.cap.drop = mac_admin mac_override setfcap setpcap
+lxc.cap.drop = sys_module sys_nice sys_pacct  
+lxc.cap.drop = sys_rawio sys_time
 EOF
 
+    if [ $container_release_major != "4" ]; then
+        echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
+    fi
+
+    echo "# Networking" >>$cfg_dir/config
     # see if the network settings were already specified
     lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
     if [ -z "$lxc_network_type" -a			\
-- 
1.7.11.7