[lxc-devel] [lxc/master] Change sys_resources to sys_resource.

creideiki on Github lxc-bot at linuxcontainers.org
Sun May 8 08:54:41 UTC 2016


A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 639 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20160508/e760a7ff/attachment.bin>
-------------- next part --------------
From 19624ecae16a06256cc1e97a3472ad2fb53e63a6 Mon Sep 17 00:00:00 2001
From: Karl-Johan Karlsson <creideiki at ferretporn.se>
Date: Sun, 8 May 2016 10:38:31 +0200
Subject: [PATCH] Change sys_resources to sys_resource.

gentoo.moresecure.conf tries to drop the capability CAP_SYS_RESOURCES.
However, that capability doesn't exist, so the container doesn't start.
Change it to CAP_SYS_RESOURCE, according to capabilities(7).

Also correct the same typo in a comment in slackware.common.conf.

Signed-off-by: Karl-Johan Karlsson <creideiki at ferretporn.se>
---
 config/templates/gentoo.moresecure.conf.in | 4 ++--
 config/templates/slackware.common.conf.in  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in
index 6e9aa0d..c08b91c 100644
--- a/config/templates/gentoo.moresecure.conf.in
+++ b/config/templates/gentoo.moresecure.conf.in
@@ -29,8 +29,8 @@ lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
 # lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
 # lxc.cap.drop = audit_write
 # lxc.cap.drop = setpcap          # breaks journald
-# lxc.cap.drop = sys_resources    # breaks systemd
-lxc.cap.drop = audit_control audit_write dac_read_search fsetid ipc_owner linux_immutable mknod setfcap setpcap sys_admin sys_boot sys_nice sys_pacct sys_ptrace sys_rawio sys_resources sys_tty_config syslog
+# lxc.cap.drop = sys_resource     # breaks systemd
+lxc.cap.drop = audit_control audit_write dac_read_search fsetid ipc_owner linux_immutable mknod setfcap setpcap sys_admin sys_boot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_tty_config syslog
 
 # WARNING: the security vulnerability reported for 'cap_net_admin' at
 # http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html
diff --git a/config/templates/slackware.common.conf.in b/config/templates/slackware.common.conf.in
index 191099f..c932e6d 100644
--- a/config/templates/slackware.common.conf.in
+++ b/config/templates/slackware.common.conf.in
@@ -41,6 +41,6 @@ lxc.mount.entry = none dev/shm tmpfs rw,nosuid,nodev,create=dir
 # lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
 # lxc.cap.drop = audit_write
 # lxc.cap.drop = setpcap          # breaks journald
-# lxc.cap.drop = sys_resources    # breaks systemd
+# lxc.cap.drop = sys_resource     # breaks systemd
 #
 lxc.cap.drop = mknod setfcap setpcap


More information about the lxc-devel mailing list