[lxc-devel] [PATCH] oracle template: drop additional capabilities

[Serge Hallyn]

Quoting Dwight Engen (dwight.engen at oracle.com):
> Signed-off-by: Dwight Engen <dwight.engen at oracle.com>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

You might want to add a pointer to the capabilities(7) manpage for
more details.

> ---
>  templates/lxc-oracle.in | 26 ++++++++++++++++++++++++--
>  1 file changed, 24 insertions(+), 2 deletions(-)
> 
> diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
> index 3242dc4..6a64a33 100644
> --- a/templates/lxc-oracle.in
> +++ b/templates/lxc-oracle.in
> @@ -292,10 +292,32 @@ lxc.tty = 4
>  lxc.pts = 1024
>  lxc.rootfs = $container_rootfs
>  lxc.mount = $cfg_dir/fstab
> -lxc.cap.drop = sys_rawio
> -# Networking
> +# Uncomment these if you don't run anything that needs the capability, and   
> +# would like the container to run with less privilege.
> +#
> +# Dropping sys_admin disables container root from doing a lot of things   
> +# that could be bad like re-mounting lxc fstab entries rw for example,    
> +# but also disables some useful things like being able to nfs mount, and    
> +# things that are already namespaced with ns_capable() kernel checks, like  
> +# hostname(1).  
> +# lxc.cap.drop = sys_admin
> +# lxc.cap.drop = net_raw          # breaks dhcp/ping
> +# lxc.cap.drop = setgid           # breaks login (initgroups/setgroups)
> +# lxc.cap.drop = dac_read_search  # breaks login (pam unix_chkpwd)
> +# lxc.cap.drop = setuid           # breaks sshd,nfs statd
> +# lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
> +# lxc.cap.drop = audit_write
> +#
> +lxc.cap.drop = mac_admin mac_override setfcap setpcap
> +lxc.cap.drop = sys_module sys_nice sys_pacct  

I'm a little surprised you'd want sys_nice by default, as opposed to
pointing to some docs for using cgroups to limit resource use by
the containers, with a commented-out 'lxc.cap.drop = sys_nice' for
those who prefer to not bother setting up the cgroups.

> +lxc.cap.drop = sys_rawio sys_time
>  EOF
>  
> +    if [ $container_release_major != "4" ]; then
> +        echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
> +    fi
> +
> +    echo "# Networking" >>$cfg_dir/config
>      # see if the network settings were already specified
>      lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
>      if [ -z "$lxc_network_type" -a			\
> -- 
> 1.7.11.7
> 
> 
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122412
> _______________________________________________
> Lxc-devel mailing list
> Lxc-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/lxc-devel