proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-08 15:04:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

oracle template: drop additional capabilities

Browse Source 
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Dwight Engen 2013-01-07 14:02:31 -05:00 committed by Stéphane Graber
parent 768487891f
commit d378aebe3d
1 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
templates/lxc-oracle.in
View File

@ -292,10 +292,32 @@ lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.rootfs = $container_rootfs lxc.rootfs = $container_rootfs
lxc.mount = $cfg_dir/fstab lxc.mount = $cfg_dir/fstab
lxc.cap.drop = sys_rawio # Uncomment these if you don't run anything that needs the capability, and
# Networking # would like the container to run with less privilege.
#
# Dropping sys_admin disables container root from doing a lot of things
# that could be bad like re-mounting lxc fstab entries rw for example,
# but also disables some useful things like being able to nfs mount, and
# things that are already namespaced with ns_capable() kernel checks, like
# hostname(1).
# lxc.cap.drop = sys_admin
# lxc.cap.drop = net_raw # breaks dhcp/ping
# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
# lxc.cap.drop = setuid # breaks sshd,nfs statd
# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
# lxc.cap.drop = audit_write
#
lxc.cap.drop = mac_admin mac_override setfcap setpcap
lxc.cap.drop = sys_module sys_nice sys_pacct
lxc.cap.drop = sys_rawio sys_time
EOF EOF
if [ $container_release_major != "4" ]; then
echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
fi
echo "# Networking" >>$cfg_dir/config
# see if the network settings were already specified # see if the network settings were already specified
lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'` lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
if [ -z "$lxc_network_type" -a \ if [ -z "$lxc_network_type" -a \