[libvirt] [PATCH 3/3] lxc: update doc to mention features/capabilities/* domain configuration

--- docs/drvlxc.html.in | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/drvlxc.html.in b/docs/drvlxc.html.in index fc4bc20..4a634c5 100644 --- a/docs/drvlxc.html.in +++ b/docs/drvlxc.html.in @@ -540,6 +540,33 @@ debootstrap, whatever) under /opt/vm-1-root: &lt;/domain&gt; </pre> +<h2><a name="capabilities">Altering the available capabilities</a></h2> + +<p> +By default the libvirt LXC driver drops some capabilities among which CAP_MKNOD. +However <span class="since">since 1.2.6</span> libvirt can be told to keep or +drop some capabilities using a domain configuration like the following: +</p> +<pre> +... +&lt;features&gt; + &lt;capabilities&gt; + &lt;mknod state='on'/&gt; + &lt;sys_chroot state='off'/&gt; + &lt;/capabilities&gt; +&lt;/features&gt; +... +</pre> +<p> +The capabilities children elements are named after the capabilities as defined in +<code>man 7 capabilities</code>. An <code>off</code> state tells libvirt to drop the +capability, while an <code>on</code> state will force to keep the capability even though +this one is dropped by default. +</p> +<p> +Note that allowing capabilities that are normally dropped by default can seriously +affect the security of the container and the host. +</p> <h2><a name="usage">Container usage / management</a></h2> -- 1.8.4.5