HI all,
I have an Ubuntu 14.04 host with lxc 1.0.3-0ubuntu3. I created an
unprivileged container with the following capabilities dropped from
/usr/share/lxc/config/ubuntu.common.conf template:
lxc.cap.drop = sys_module mac_admin mac_override sys_time
This is the configuration for the container:
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
lxc.include = /usr/share/lxc/config/ubuntu.userns.conf
lxc.arch = x86_64
lxc.id_map = u 0 123456 65536
lxc.id_map = g 0 123456 65536
lxc.rootfs = /mypath/
lxc.utsname = mycontainer
# Network configuration
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = mylink
lxc.network.name = eth0
lxc.network.hwaddr = my:ma:ca:dd:re:ss
A really basic config file
I installed a program inside this container which claims it fails when
calling function pthread_setschedparam. This function should be
permitted when CAP_SYS_NICE capability is not dropped (and this seems to
be the case). I also had same problem in the past when trying to let a
guest change system clock (that time I removed sys_time from dropped
capabilities).
My questions are: are capabilities taken in consideration when dealing
with unprivileged containers? Do I have something more to do so that I
can use this functions inside an unprivileged container?
Best Regards
Michele
_______________________________________________
lxc-users mailing list
[email protected]
http://lists.linuxcontainers.org/listinfo/lxc-users
