From b6f1f5a3be5b2643b255882effdca2e903d9d738 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= Date: Wed, 11 Jun 2014 17:01:11 +0200 Subject: [PATCH 3/3] lxc: update doc to mention features/capabilities/* domain configuration --- docs/drvlxc.html.in | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) Index: libvirt-1.2.6/docs/drvlxc.html.in =================================================================== --- libvirt-1.2.6.orig/docs/drvlxc.html.in +++ libvirt-1.2.6/docs/drvlxc.html.in @@ -540,6 +540,53 @@ debootstrap, whatever) under /opt/vm-1-r </domain> +

Altering the available capabilities

+ +

+By default the libvirt LXC driver drops some capabilities among which CAP_MKNOD. +However since 1.2.6 libvirt can be told to keep or +drop some capabilities using a domain configuration like the following: +

+
+...
+<features>
+  <capabilities policy='default'>
+    <mknod state='on'/>
+    <sys_chroot state='off'/>
+  </capabilities>
+</features>
+...
+
+

+The capabilities children elements are named after the capabilities as defined in +man 7 capabilities. An off state tells libvirt to drop the +capability, while an on state will force to keep the capability even though +this one is dropped by default. +

+

+The policy attribute can be one of default, allow +or deny. It defines the default rules for capabilities: either keep the +default behavior that is dropping a few selected capabilities, or keep all capabilities +or drop all capabilities. The interest of allow and deny is that +they guarantee that all capabilities will be kept (or removed) even if new ones are added +later. +

+

+The following example, drops all capabilities but CAP_MKNOD: +

+
+...
+<features>
+  <capabilities policy='deny'>
+    <mknod state='on'/>
+  </capabilities>
+</features>
+...
+
+

+Note that allowing capabilities that are normally dropped by default can seriously +affect the security of the container and the host. +

Container usage / management