I'm experimenting with the libvirt lxc driver, and wondering if there is some way to control the capabilities assigned to the container processes. With lxc-tools, I can specify a configuration option, lxc.cap.drop, which causes the container processes to drop the specified privileges. My libvirt containers seem to run with cap_sys_module,cap_sys_boot,cap_sys_time,cap_audit_control,cap_mac_admin which is rather more permissive than I'd like. In particular, cap_sys_boot allows a container to reboot the host machine.

Am I misinterpreting the output of getpcaps then? (getpcaps is rather undocumented).

On Thu, Dec 08, 2011 at 07:14:41AM -0800, Chris Haumesser wrote: > Chris Haumesser wrote: > > Am I misinterpreting the output of getpcaps then? (getpcaps is rather > > undocumented). > > Answering my own question, I was misinterpreting the output of getpcaps. > I found the cap_from_text(3) man page, which explained the output format. > > I still don't understand why I was able to reboot the host from within a > container, however. Well I just confirmed (the hard way!) that you are correct. It is possible to reboot the host from inside the container, despire CAP_SYS_REBOOT being blocked. I'll try & figure out how that's happening/possible...