Hi,
I've just realized that the env name in my previous post was opposite in
meaning.
ENABLE_INSECURE_MODE -> ENABLE_SECURE_MODE
Just for correction.
--
Masahide Yamamoto - Joe's Web Hosting
--
WhatsUp Gold - Downlo
Hi,
Here is my work-around for increasing security in LXC guest environment,
keeping some usability.
But, I had to modify some code both in kernel and LXC user-land tool to
fulfill this.
* Kernel patch(2.6.32.39)
diff -uwBr linux-2.6.32.39/fs/namespace.c linux-2.6.32.39-jwh/fs/namespace.c
--- l
To disable the ability to trigger a reboot of the host system by sending
"b" to /proc/sysrq-trigger inside a container, I've dropped
CAP_SYS_ADMIN and set readonly for the /proc mount-point.
I'm interested what else capabilities are recommended to drop when using
LXC as a system container?
Thanks
On Tue, Mar 22, 2011 at 10:20 AM, Nathan McSween wrote:
> Can I get a quick rundown of what is implemented w.r.t UID/GID
> containerization, is it safe yet to give containerized root to an
> everyday user without huge security issues?
Drop all dangerous capabilities and mount /proc read-only.
H
On Wed, 2011-04-06 at 08:08 -0500, Rob Landley wrote:
> On 04/06/2011 05:43 AM, Daniel Lezcano wrote:
> > On 03/22/2011 10:20 AM, Nathan McSween wrote:
> >> Can I get a quick rundown of what is implemented w.r.t UID/GID
> >> containerization, is it safe yet to give containerized root to an
> >> ev
On Wednesday 06 April 2011 16:08:18 Rob Landley wrote:
> On 04/06/2011 05:43 AM, Daniel Lezcano wrote:
> > On 03/22/2011 10:20 AM, Nathan McSween wrote:
> >> Can I get a quick rundown of what is implemented w.r.t UID/GID
> >> containerization, is it safe yet to give containerized root to an
> >> e
On 04/06/2011 05:43 AM, Daniel Lezcano wrote:
> On 03/22/2011 10:20 AM, Nathan McSween wrote:
>> Can I get a quick rundown of what is implemented w.r.t UID/GID
>> containerization, is it safe yet to give containerized root to an
>> everyday user without huge security issues?
>
> Nope, it is not s
On 03/22/2011 10:20 AM, Nathan McSween wrote:
> Can I get a quick rundown of what is implemented w.r.t UID/GID
> containerization, is it safe yet to give containerized root to an
> everyday user without huge security issues?
Nope, it is not secure at all for a root user inside the container.
---
Can I get a quick rundown of what is implemented w.r.t UID/GID
containerization, is it safe yet to give containerized root to an
everyday user without huge security issues?
--
Xperia(TM) PLAY
It's a major breakthrough.
