From: i.Dark_Templar Date: Sat, 2 Dec 2017 07:33:51 +0000 (+0300) Subject: Update gentoo.moresecure.conf. X-Git-Tag: lxc-2.0.10~535 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aad14f731319e9eaa73582c094d29d2bc98eebc5;p=thirdparty%2Flxc.git Update gentoo.moresecure.conf. Closes https://github.com/lxc/lxc/issues/1928 Signed-off-by: i.Dark_Templar --- diff --git a/config/templates/gentoo.moresecure.conf.in b/config/templates/gentoo.moresecure.conf.in index c08b91c1a..aa7c625cc 100644 --- a/config/templates/gentoo.moresecure.conf.in +++ b/config/templates/gentoo.moresecure.conf.in @@ -30,7 +30,8 @@ lxc.mount.entry=run run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0 # lxc.cap.drop = audit_write # lxc.cap.drop = setpcap # breaks journald # lxc.cap.drop = sys_resource # breaks systemd -lxc.cap.drop = audit_control audit_write dac_read_search fsetid ipc_owner linux_immutable mknod setfcap setpcap sys_admin sys_boot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_tty_config syslog +# lxc.cap.drop = sys_boot # breaks sysvinit +lxc.cap.drop = audit_control audit_write dac_read_search fsetid ipc_owner linux_immutable mknod setfcap setpcap sys_admin sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_tty_config syslog # WARNING: the security vulnerability reported for 'cap_net_admin' at # http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html