On Mon, 2014-06-09 at 16:01 +0000, Serge Hallyn wrote: > Quoting Christian Evans ([email protected]): > > Hi folks! > > > > I am looking for a way to improve [security of] Linux Containers. > > > > Where I can find any ToDo/features list, so I could help the project?
> Hm, there isn't one right now that is uptodate, especially pertaining > to security. If security is what you are particularly interested in, > then some areas where you could help are > 1. implement lxc support for Smack > 2. work on some usable seccomp policies - with the new personality and > blacklist policy support we should be able to get some policies for > standard workloads that are actually useful, i.e. refusing compat calls > in x86-64 containers, etc. Oh! Hey! Yeah! That reminds me. We were having that whole discussion over on the -users list about Fedora containers and appropriate apparmour policy and whether it should be a relaxed policy (currently unconfined) or if some appropriate mounts should be substituted to keep systemd satisfied. That's a big one. > 3. work on selinux container policies > 4. test out mountlo and other of the fuse filesystems that Eric > mentioned should allow mounting from an unprivileged user namespace. > (I gave it a 0% effort attempt, got an EPERM, and moved on to higher > prio things; it should be fun to figure out) +1 Loopback stuff is a significant PITA with security implications. > -serge Regards, Mike -- Michael H. Warfield (AI4NB) | (770) 978-7061 | [email protected] /\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!
signature.asc
Description: This is a digitally signed message part
_______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
