[Bug 850687] Re: Should disable cap_module by default
This is fixed as of 0.7.5-3ubuntu2. ** Changed in: lxc (Ubuntu) Status: Triaged = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/850687 Title: Should disable cap_module by default To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/850687/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 850687] Re: Should disable cap_module by default
Well, or use libvirt which already does this. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/850687 Title: Should disable cap_module by default To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/850687/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 850687] Re: Should disable cap_module by default
** Changed in: lxc (Ubuntu) Importance: Undecided = Wishlist -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/850687 Title: Should disable cap_module by default To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/850687/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 850687] Re: Should disable cap_module by default
Thanks for the suggestion, Soren. This was just mentioned in irc as well. As there is no pretense of security against root in the container right now, this isn't particularly important, so I'll send a patch upstream, but we may just wait for upstream to take the patch. If we are able to start using user namespaces for p, then it'll be moot since module insertion checks are targeted at the initial user namespace. Libvirt does it by default, but as with devices cgroup entries, offers no flexibility about it. ** Changed in: lxc (Ubuntu) Status: New = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/850687 Title: Should disable cap_module by default To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/850687/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 850687] Re: Should disable cap_module by default
Patch sent upstream. It also disables mac_admin and mac_override. ** Changed in: lxc (Ubuntu) Status: Confirmed = Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/850687 Title: Should disable cap_module by default To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/850687/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
