Skip to content

L
lxc
Commit eee3ba81 by Serge Hallyn
Options

templates: deny writes to host's clock (v2)

Don't allow write to /dev/rtc0, and remove sys_time. Thanks, Christoph. v2: drop sys_time, sys_module, mac_admin and mac_override in all templates. Reported-by: 's avatarChristoph Mitasch <cmitasch@thomas-krenn.com> Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
parent ee25a44f
Showing with 16 additions and 10 deletions
templates/lxc-alpine.in
...@@ -109,6 +109,7 @@ EOF ...@@ -109,6 +109,7 @@ EOF
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.utsname = $hostname lxc.utsname = $hostname
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -129,7 +130,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -129,7 +130,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
# mounts point # mounts point
lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0 lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
......
templates/lxc-altlinux.in
...@@ -243,6 +243,7 @@ lxc.utsname = $name ...@@ -243,6 +243,7 @@ lxc.utsname = $name
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.mount = $config_path/fstab lxc.mount = $config_path/fstab
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
......
templates/lxc-archlinux.in
...@@ -127,7 +127,7 @@ lxc.tty=1 ...@@ -127,7 +127,7 @@ lxc.tty=1
lxc.pts=1024 lxc.pts=1024
lxc.rootfs=${rootfs_path} lxc.rootfs=${rootfs_path}
lxc.mount=${config_path}/fstab lxc.mount=${config_path}/fstab
lxc.cap.drop=mknod sys_module mac_admin mac_override lxc.cap.drop=mknod sys_module mac_admin mac_override sys_time
lxc.kmsg=0 lxc.kmsg=0
lxc.stopsignal=SIGRTMIN+4 lxc.stopsignal=SIGRTMIN+4
#networking #networking
......
templates/lxc-busybox.in
...@@ -261,6 +261,7 @@ cat <<EOF >> $path/config ...@@ -261,6 +261,7 @@ cat <<EOF >> $path/config
lxc.utsname = $name lxc.utsname = $name
lxc.tty = 1 lxc.tty = 1
lxc.pts = 1 lxc.pts = 1
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
......
templates/lxc-debian.in
...@@ -218,6 +218,7 @@ copy_configuration() ...@@ -218,6 +218,7 @@ copy_configuration()
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.utsname = $hostname lxc.utsname = $hostname
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -237,7 +238,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -237,7 +238,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
# mounts point # mounts point
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0 lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
......
templates/lxc-fedora.in
...@@ -252,6 +252,7 @@ lxc.utsname = $name ...@@ -252,6 +252,7 @@ lxc.utsname = $name
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.mount = $config_path/fstab lxc.mount = $config_path/fstab
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -272,7 +273,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -272,7 +273,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
EOF EOF
cat <<EOF > $config_path/fstab cat <<EOF > $config_path/fstab
......
templates/lxc-opensuse.in
...@@ -275,7 +275,7 @@ lxc.autodev=1 ...@@ -275,7 +275,7 @@ lxc.autodev=1
lxc.tty = 4 lxc.tty = 4
lxc.pts = 1024 lxc.pts = 1024
lxc.mount = $path/fstab lxc.mount = $path/fstab
lxc.cap.drop = sys_module mac_admin mac_override mknod lxc.cap.drop = sys_module mac_admin mac_override mknod sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -295,7 +295,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -295,7 +295,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
EOF EOF
cat <<EOF > $path/fstab cat <<EOF > $path/fstab
......
templates/lxc-sshd.in
...@@ -112,6 +112,7 @@ copy_configuration() ...@@ -112,6 +112,7 @@ copy_configuration()
cat <<EOF >> $path/config cat <<EOF >> $path/config
lxc.utsname = $name lxc.utsname = $name
lxc.pts = 1024 lxc.pts = 1024
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
......
templates/lxc-ubuntu-cloud.in
...@@ -55,7 +55,7 @@ lxc.pts = 1024 ...@@ -55,7 +55,7 @@ lxc.pts = 1024
lxc.utsname = $name lxc.utsname = $name
lxc.arch = $arch lxc.arch = $arch
lxc.cap.drop = sys_module mac_admin mac_override lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -76,7 +76,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -76,7 +76,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
# fuse # fuse
lxc.cgroup.devices.allow = c 10:229 rwm lxc.cgroup.devices.allow = c 10:229 rwm
# tun # tun
......
templates/lxc-ubuntu.in
...@@ -378,7 +378,7 @@ lxc.pts = 1024 ...@@ -378,7 +378,7 @@ lxc.pts = 1024
lxc.utsname = $name lxc.utsname = $name
lxc.arch = $arch lxc.arch = $arch
lxc.cap.drop = sys_module mac_admin mac_override lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined: # When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined #lxc.aa_profile = unconfined
...@@ -399,7 +399,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -399,7 +399,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 5:2 rwm
# rtc # rtc
lxc.cgroup.devices.allow = c 254:0 rwm lxc.cgroup.devices.allow = c 254:0 rm
# fuse # fuse
lxc.cgroup.devices.allow = c 10:229 rwm lxc.cgroup.devices.allow = c 10:229 rwm
# tun # tun
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment