config: start with a full capability set

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

config: start with a full capability set
5c0d54cd · Christian Brauner · 4cb53844 · 5c0d54cd
Unverified Commit 5c0d54cd authored Mar 01, 2018 by Christian Brauner
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

userns.conf.in config/templates/userns.conf.in +4 -0

No files found.
--- a/config/templates/userns.conf.in
+++ b/config/templates/userns.conf.in
@@ -2,5 +2,9 @@
 lxc.cgroup.devices.deny =
 lxc.cgroup.devices.allow =

+# Start with a full set of capabilities in user namespaces.
+lxc.cap.drop =
+lxc.cap.keep =
+
 # We can't move bind-mounts, so don't use /dev/lxc/
 lxc.tty.dir =