Re: [libvirt] [PATCH] lxc: drop sys_admin caps by default

To make sure the container user doesn't play with mounts, like changing them from ro to rw, drop the sys_admin capability by default. If user really needs to play with those, it can be enabled in the configuration. --- Note: it seems that patch 3/3 or my last series never reached the list. Here it is. src/lxc/lxc_container.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c5a70a1..d6d6fba 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -2083,6 +2083,7 @@ static int lxcContainerDropCapabilities(virDomainDefPtr def, case VIR_DOMAIN_CAPS_FEATURE_MKNOD: /* No creating device nodes */ case VIR_DOMAIN_CAPS_FEATURE_AUDIT_CONTROL: /* No messing with auditing status */ case VIR_DOMAIN_CAPS_FEATURE_MAC_ADMIN: /* No messing with LSM config */ + case VIR_DOMAIN_CAPS_FEATURE_SYS_ADMIN: /* No messing with mounts */ toDrop = (state != VIR_TRISTATE_SWITCH_ON); break; default: /* User specified capabilities to drop */