proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-27 09:48:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
c25c2970a6
mirror_lxc/doc
History
Serge Hallyn 1fb86a7cdc introduce lxc.cap.keep 
The lxc configuration file currently supports 'lxc.cap.drop', a list of
capabilities to be dropped (using the bounding set) from the container.
The problem with this is that over time new capabilities are added.  So
an older container configuration file may, over time, become insecure.

Walter has in the past suggested replacing lxc.cap.drop with
lxc.cap.preserve, which would have the inverse sense - any capabilities
in that set would be kept, any others would be dropped.

Realistically both have the same problem - the sendmail capabilities
bug proved that running code with unexpectedly dropped privilege can be
dangerous.  This patch gives the admin a choice:  You can use either
lxc.cap.keep or lxc.cap.drop, not both.

Both continue to be ignored if a user namespace is in use.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
2013-09-05 17:20:59 -05:00
..
examples EXTRA_DIST: Fix missing files with "make dist" 2013-03-26 13:12:29 -04:00
legacy licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
rootfs Reinstate README file in rootfs directory 2012-11-12 13:47:51 -05:00
common_options.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
FAQ.txt Remove all trailing whitespaces. 2012-11-26 12:08:13 -05:00
lxc-attach.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-cgroup.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-checkconfig.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-checkpoint.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-clone.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-console.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-create.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-destroy.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-device.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-execute.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-freeze.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-info.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-kill.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-ls.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-monitor.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-netstat.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-ps.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-restart.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-start-ephemeral.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-start.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-stop.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-top.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-unfreeze.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-unshare.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-version.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc-wait.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
lxc.conf Remove all trailing whitespaces. 2012-11-26 12:08:13 -05:00
lxc.conf.sgml.in introduce lxc.cap.keep 2013-09-05 17:20:59 -05:00
lxc.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00
Makefile.am lxc-stop: use api, remove lxc_shutdown, extend lxc-stop functionality 2013-05-24 23:31:28 -05:00
see_also.sgml.in licensing: Add missing headers and FSF address 2013-09-03 14:33:03 -04:00