Hi Fajar,
Thanks again for taking the time to reply :)
I'm using Debian testing with lxc version 0.8.0~rc1-4. It's possible
I'm using an outdated version of lxc.
> In Ubuntu host at least, AFAIK using lxc templates will include
> network configuration from /etc/lxc/lxc.conf, which includes these
> lines
I just verified and on my system I don't have a lxc.conf file. I'm not
sure if I have to manually create this.
The default config template I have when I run a lxc-create -n test1 -t
debian is as follows:
lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = /var/lib/lxc/test1/rootfs
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
# mounts point
lxc.mount.entry=proc /var/lib/lxc/test1/rootfs/proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry=devpts /var/lib/lxc/test1/rootfs/dev/pts devpts defaults 0 0
lxc.mount.entry=sysfs /var/lib/lxc/test1/rootfs/sys sysfs defaults 0 0
I'm not sure of the specifics in the config file however my first
reaction to lxc.cgroup.devices.deny = a was to assume that this would
deny all devices just as you have mentioned. However this hasn't
isolated the network instance in my case.
Anything in the above config seems out of ordinary? Or is it just that
I'm using an outdated lxc? Of course it's entirely possible that I
haven't rtfm ;) ;) - sorry if that's the case :)
Thanks again for everything guys :)
Bye for now
On Tue, May 15, 2012 at 10:13 AM, Fajar A. Nugraha <l...@fajar.net> wrote:
> On Tue, May 15, 2012 at 10:22 AM, jeetu.gol...@gmail.com
> <jeetu.gol...@gmail.com> wrote:
>> Hi Fajar,
>>
>> Thanks for your response.
>>
>> I used the debian template and the config file does not (as far as I
>> can tell) have any network related stanzas. Unfortunately this default
>> behaviour lead to the network stack being shared between the host and
>> the container as pointed out by Matthijs.
>
> In Ubuntu host at least, AFAIK using lxc templates will include
> network configuration from /etc/lxc/lxc.conf, which includes these
> lines
>
> lxc.network.type=veth
> lxc.network.link=lxcbr0
> lxc.network.flags=up
>
>>
>> Therefore, I was wondering if there are any other namespaces I should
>> explicitly isolate so as to prevent them being inadvertently shared
>> between host and container.
>
> Again, the resulting config file provides a good starting point. On
> ubuntu precise host, using ubuntu template denies ALL devices (which
> should include host's eth) from the guest container except from ones
> specifically allowed
>
> #==========
> lxc.cgroup.devices.deny = a
> # Allow any mknod (but not using the node)
> lxc.cgroup.devices.allow = c *:* m
> lxc.cgroup.devices.allow = b *:* m
> # /dev/null and zero
> lxc.cgroup.devices.allow = c 1:3 rwm
> lxc.cgroup.devices.allow = c 1:5 rwm
> # consoles
> lxc.cgroup.devices.allow = c 5:1 rwm
> lxc.cgroup.devices.allow = c 5:0 rwm
> #lxc.cgroup.devices.allow = c 4:0 rwm
> #lxc.cgroup.devices.allow = c 4:1 rwm
> # /dev/{,u}random
> lxc.cgroup.devices.allow = c 1:9 rwm
> lxc.cgroup.devices.allow = c 1:8 rwm
> lxc.cgroup.devices.allow = c 136:* rwm
> lxc.cgroup.devices.allow = c 5:2 rwm
> # rtc
> lxc.cgroup.devices.allow = c 254:0 rwm
> #fuse
> lxc.cgroup.devices.allow = c 10:229 rwm
> #tun
> lxc.cgroup.devices.allow = c 10:200 rwm
> #full
> lxc.cgroup.devices.allow = c 1:7 rwm
> #hpet
> lxc.cgroup.devices.allow = c 10:228 rwm
> #kvm
> lxc.cgroup.devices.allow = c 10:232 rwm
> #==================
>
> --
> Fajar
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Lxc-users mailing list
Lxc-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users
