Skip to content

L
lxc
Commit e2268833 by Serge Hallyn Committed by Daniel Lezcano
Options

drop mac_admin and mac_override

mac_admin stops the container from loading LSM policy. Neither selinux nor apparmor currently will do well with automatic namespacing of policy (though it's coming in apparmor, after which we can re-enable this). Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@canonical.com> Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
parent fdcde5b6
Showing with 1 addition and 1 deletion
templates/lxc-ubuntu.in
...@@ -206,7 +206,7 @@ lxc.pts = 1024 ...@@ -206,7 +206,7 @@ lxc.pts = 1024
lxc.rootfs = $rootfs lxc.rootfs = $rootfs
lxc.mount = $path/fstab lxc.mount = $path/fstab
lxc.arch = $arch lxc.arch = $arch
lxc.cap.drop = sys_module lxc.cap.drop = sys_module mac_admin mac_override
lxc.cgroup.devices.deny = a lxc.cgroup.devices.deny = a
# Allow any mknod (but not using the node) # Allow any mknod (but not using the node)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment