Re: [libvirt] [virt-devel] This patch removes the mknod capability from Linux Containers.

0001-Linux-Containers-are-not-allowed-to-create-device-no.patch >From 3913ef4148728430cc9df79b84d5ec44130f4ac8 Mon Sep 17 00:00:00 2001 From: rhatdan <dwalsh(a)redhat.com&gt;

Date: Thu, 1 Nov 2012 14:54:39 -0400 Subject: [PATCH] Linux Containers are not allowed to create device nodes. This needs to be done before the container starts. Turning off the mknod capabilty is noticed by systemd, which will

no longer attempt to create device nodes.

This eliminates SELinux AVC messages and ugly failure messages in the journal. --- src/lxc/lxc_container.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 2789c17..8faa664 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1717,6 +1717,7 @@ static int lxcContainerDropCapabilities(bool keepReboot ATTRIBUTE_UNUSED) CAPNG_INHERITABLE | CAPNG_BOUNDING_SET, CAP_SYS_MODULE, /* No kernel module loading */ CAP_SYS_TIME, /* No changing the clock */ + CAP_MKNOD, /* No creating device nodes */ CAP_AUDIT_CONTROL, /* No messing with auditing status */ CAP_MAC_ADMIN, /* No messing with LSM config */ keepReboot ? -1 : CAP_SYS_BOOT, /* No use of reboot */