mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-08-05 11:44:48 +00:00
0769b82a42
If the user specifies cgroup or cgroup-full without a specifier (:ro, :rw or :mixed), this changes the behavior. Previously, these were simple aliases for the :mixed variants; now they depend on whether the container also has CAP_SYS_ADMIN; if it does they resolve to the :rw variants, if it doesn't to the :mixed variants (as before). If a container has CAP_SYS_ADMIN privileges, any filesystem can be remounted read-write from within, so initially mounting the cgroup filesystems partially read-only as a default creates a false sense of security. It is better to default to full read-write mounts to show the administrator what keeping CAP_SYS_ADMIN entails. If an administrator really wants both CAP_SYS_ADMIN and the :mixed variant of cgroup or cgroup-full automatic mounts, they can still specify that explicitly; this commit just changes the default without specifier. Signed-off-by: Christian Seiler <christian@iwakd.de> Cc: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> |
||
|---|---|---|
| .. | ||
| api | ||
| examples | ||
| ja | ||
| legacy | ||
| rootfs | ||
| common_options.sgml.in | ||
| FAQ.txt | ||
| lxc-attach.sgml.in | ||
| lxc-autostart.sgml.in | ||
| lxc-cgroup.sgml.in | ||
| lxc-checkconfig.sgml.in | ||
| lxc-clone.sgml.in | ||
| lxc-config.sgml.in | ||
| lxc-console.sgml.in | ||
| lxc-create.sgml.in | ||
| lxc-destroy.sgml.in | ||
| lxc-device.sgml.in | ||
| lxc-execute.sgml.in | ||
| lxc-freeze.sgml.in | ||
| lxc-info.sgml.in | ||
| lxc-ls.sgml.in | ||
| lxc-monitor.sgml.in | ||
| lxc-snapshot.sgml.in | ||
| lxc-start-ephemeral.sgml.in | ||
| lxc-start.sgml.in | ||
| lxc-stop.sgml.in | ||
| lxc-top.sgml.in | ||
| lxc-unfreeze.sgml.in | ||
| lxc-unshare.sgml.in | ||
| lxc-user-nic.sgml.in | ||
| lxc-usernet.sgml.in | ||
| lxc-usernsexec.sgml.in | ||
| lxc-wait.sgml.in | ||
| lxc.conf.sgml.in | ||
| lxc.container.conf | ||
| lxc.container.conf.sgml.in | ||
| lxc.sgml.in | ||
| lxc.system.conf | ||
| lxc.system.conf.sgml.in | ||
| Makefile.am | ||
| see_also.sgml.in | ||