Skip to content

L
lxc
Commit 33662399 by Dwight Engen Committed by Stéphane Graber
Options

oracle template: restrict writeability in /proc and /sys

Note that since we don't drop CAP_SYS_ADMIN, root in the container can remount proc or sys however they want to, however this at least improves the default situation. Signed-off-by: 's avatarDwight Engen <dwight.engen@oracle.com> Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
parent 8f47bc3f
Showing with 1 addition and 6 deletions
templates/lxc-oracle.in
...@@ -350,7 +350,7 @@ lxc.utsname = $name ...@@ -350,7 +350,7 @@ lxc.utsname = $name
lxc.devttydir = lxc lxc.devttydir = lxc
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.mount = $cfg_dir/fstab lxc.mount.auto = proc:mixed sys:ro
lxc.hook.clone = @DATADIR@/lxc/hooks/clonehostname lxc.hook.clone = @DATADIR@/lxc/hooks/clonehostname
# Uncomment these if you don't run anything that needs the capability, and # Uncomment these if you don't run anything that needs the capability, and
# would like the container to run with less privilege. # would like the container to run with less privilege.
...@@ -404,11 +404,6 @@ lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom ...@@ -404,11 +404,6 @@ lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
EOF EOF
cat <<EOF > $cfg_dir/fstab || die "unable to create $cfg_dir/fstab"
proc proc proc nodev,noexec,nosuid 0 0
sysfs sys sysfs defaults 0 0
EOF
} }
container_rootfs_clone() container_rootfs_clone()
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment