Signed-off-by: Dwight Engen <dwight.en...@oracle.com>
---
templates/lxc-oracle.in | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index 3242dc4..6a64a33 100644
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -292,10 +292,32 @@ lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $container_rootfs
lxc.mount = $cfg_dir/fstab
-lxc.cap.drop = sys_rawio
-# Networking
+# Uncomment these if you don't run anything that needs the capability, and
+# would like the container to run with less privilege.
+#
+# Dropping sys_admin disables container root from doing a lot of things
+# that could be bad like re-mounting lxc fstab entries rw for example,
+# but also disables some useful things like being able to nfs mount, and
+# things that are already namespaced with ns_capable() kernel checks, like
+# hostname(1).
+# lxc.cap.drop = sys_admin
+# lxc.cap.drop = net_raw # breaks dhcp/ping
+# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
+# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
+# lxc.cap.drop = setuid # breaks sshd,nfs statd
+# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
+# lxc.cap.drop = audit_write
+#
+lxc.cap.drop = mac_admin mac_override setfcap setpcap
+lxc.cap.drop = sys_module sys_nice sys_pacct
+lxc.cap.drop = sys_rawio sys_time
EOF
+ if [ $container_release_major != "4" ]; then
+ echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
+ fi
+
+ echo "# Networking" >>$cfg_dir/config
# see if the network settings were already specified
lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[=
\t]+' '{ print $2 }'`
if [ -z "$lxc_network_type" -a \
--
1.7.11.7
------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. SALE $99.99 this month only -- learn more at:
http://p.sf.net/sfu/learnmore_122412
_______________________________________________
Lxc-devel mailing list
Lxc-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-devel
