From d378aebe3da108502ea5ff8fc134491214135057 Mon Sep 17 00:00:00 2001 From: Dwight Engen Date: Mon, 7 Jan 2013 14:02:31 -0500 Subject: [PATCH] oracle template: drop additional capabilities Signed-off-by: Dwight Engen Acked-by: Serge E. Hallyn --- templates/lxc-oracle.in | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in index 3242dc412..6a64a338f 100644 --- a/templates/lxc-oracle.in +++ b/templates/lxc-oracle.in @@ -292,10 +292,32 @@ lxc.tty = 4 lxc.pts = 1024 lxc.rootfs = $container_rootfs lxc.mount = $cfg_dir/fstab -lxc.cap.drop = sys_rawio -# Networking +# Uncomment these if you don't run anything that needs the capability, and +# would like the container to run with less privilege. +# +# Dropping sys_admin disables container root from doing a lot of things +# that could be bad like re-mounting lxc fstab entries rw for example, +# but also disables some useful things like being able to nfs mount, and +# things that are already namespaced with ns_capable() kernel checks, like +# hostname(1). +# lxc.cap.drop = sys_admin +# lxc.cap.drop = net_raw # breaks dhcp/ping +# lxc.cap.drop = setgid # breaks login (initgroups/setgroups) +# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd) +# lxc.cap.drop = setuid # breaks sshd,nfs statd +# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed) +# lxc.cap.drop = audit_write +# +lxc.cap.drop = mac_admin mac_override setfcap setpcap +lxc.cap.drop = sys_module sys_nice sys_pacct +lxc.cap.drop = sys_rawio sys_time EOF + if [ $container_release_major != "4" ]; then + echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config + fi + + echo "# Networking" >>$cfg_dir/config # see if the network settings were already specified lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'` if [ -z "$lxc_network_type" -a \ -- 2.47.2