lxc-alpine: disable sys_admin by default

It is normally not needed.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
index 40957ab786a56627ea1aaaa0993eb2457ac11189..ec6b802af64e1404a083425530d5827d369ffb69 100644 (file)
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
@@ -199,7 +199,7 @@ EOF
 lxc.tty = 4
 lxc.pts = 1024
 lxc.utsname = $hostname
-lxc.cap.drop = sys_module mac_admin mac_override sys_time
+lxc.cap.drop = sys_module mac_admin mac_override sys_time sys_admin
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
 #lxc.aa_profile = unconfined