From: Serge Hallyn Date: Fri, 19 Dec 2014 18:23:52 +0000 (+0000) Subject: Enable seccomp by default for unprivileged users. X-Git-Tag: lxc-1.1.0.rc1~50 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=218f99322c78b7788c0eff1997f95d135741e480;p=thirdparty%2Flxc.git Enable seccomp by default for unprivileged users. In contrast to what the comment above the line disabling it said, it seems to work just fine. It also is needed on current kernels (until Eric's patch hits upstream) to prevent unprivileged containers from hosing fuse filesystems they inherit. Signed-off-by: Serge Hallyn Acked-by: Stéphane Graber --- diff --git a/config/templates/userns.conf.in b/config/templates/userns.conf.in index 2d9d7d501..5dc19c72c 100644 --- a/config/templates/userns.conf.in +++ b/config/templates/userns.conf.in @@ -13,7 +13,3 @@ lxc.mount.entry = /dev/random dev/random none bind,create=file 0 0 lxc.mount.entry = /dev/tty dev/tty none bind,create=file 0 0 lxc.mount.entry = /dev/urandom dev/urandom none bind,create=file 0 0 lxc.mount.entry = /dev/zero dev/zero none bind,create=file 0 0 - -# Default seccomp policy is not needed for unprivileged containers, and -# non-root users cannot use seccmp without NNP anyway. -lxc.seccomp =