From d5f9a0185a5a2d2b2184f7d1d954fd6e8ccf9397 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Thu, 1 Mar 2018 17:09:44 +0100 Subject: [PATCH] config: start with a full capability set Signed-off-by: Christian Brauner --- config/templates/userns.conf.in | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/templates/userns.conf.in b/config/templates/userns.conf.in index bde6f1db2..63d018964 100644 --- a/config/templates/userns.conf.in +++ b/config/templates/userns.conf.in @@ -2,5 +2,9 @@ lxc.cgroup.devices.deny = lxc.cgroup.devices.allow = +# Start with a full set of capabilities in user namespaces. +lxc.cap.drop = +lxc.cap.keep = + # We can't move bind-mounts, so don't use /dev/lxc/ lxc.devttydir = -- 2.47.2